In a landmark decision, the US Treasury officially lifted sanctions on Tornado Cash in March 2025, reversing its 2022 designation as a sanctioned entity. This unexpected move reignited debates on crypto privacy, financial regulations, and the legal status of decentralized protocols.
This article explores how Tornado Cash works, why it was sanctioned for facilitating illicit transactions, and the legal battles that followed. We’ll also examine the broader implications of its delisting and what it means for crypto businesses navigating regulatory uncertainty.
Crypto mixers and tumblers are tools designed to obscure the origin of cryptocurrency transactions by blending unrelated funds using various techniques. These services operate by assigning each user a unique deposit address, where they send their crypto. The deposited funds are then mixed with those of other users or dispersed across a vast network of wallets controlled by the mixer, making it difficult to trace the original source. To further enhance anonymity, mixers may repeat this process multiple times.
There are two main types of mixers: centralized and decentralized. The key distinction is that centralized mixers are operated by third parties, while decentralized mixers function autonomously through smart contracts. Tornado Cash was a notable example of a decentralized mixer, operating on Ethereum and allowing users to anonymize their transactions without relying on an intermediary. As one of the most popular privacy tools in the crypto space, it gained significant adoption before being sanctioned by U.S. authorities in 2022.
On August 8, 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Tornado Cash, citing its role in laundering illicit funds. The report specifically highlighted that the mixer facilitated the laundering of $455 million for the Lazarus Group, a North Korean cybercrime syndicate sanctioned since 2019.
Additionally, Tornado Cash was used to process $96 million from the Harmony Bridge heist in June 2022 and $7.8 million from the August 2022 Nomad heist. Beyond these cases, our research identified several other major exploits from 2021 to 2022 that utilized the service, including the BitMart hack, Beanstalk flash loan exploit, Fei Protocol Fuse exploit, and Vee Finance exploit.
The sanctions were comprehensive. “As a result of today’s action, all property and interests in property of the entity above, Tornado Cash, that is in the United States or in the possession or control of U.S. persons is blocked and must be reported to OFAC,” the Treasury Department stated in its press release.
Following the ban, Tornado Cash’s website and associated digital assets were swiftly taken down. However, because its smart contracts were deployed on Ethereum and function autonomously, users with technical expertise could still interact with them via scripts. Reports also suggested that some mirrors of the service persisted on the dark web. As a result, while inflows into Tornado Cash dropped significantly from their peak of $3 billion, the mixer still processed around $200 million in transactions by September 2023. The sanctions effectively restricted access, limiting its use primarily to advanced users.
In November 2024, an appellate judge ruled that the Treasury Department had overstepped its authority by sanctioning Tornado Cash in 2022. The court sided with the plaintiffs, agreeing that immutable smart contracts—programs that operate without direct human control—do not meet the legal definition of "property" under the relevant sanctions laws.
Commenting on the ruling, Natalia Latka, Policy and Regulatory Affairs Director at Merkle Science, noted that the decision “aligns with the industry's longstanding argument against sanctioning code itself.” However, she pointed out that key legal questions remain unresolved, particularly concerning the liability of developers, as evidenced by the ongoing case against Tornado Cash developer Roman Storm.
In March 2025, the US Treasury officially lifted the sanctions, making it legal once again for Americans to use Tornado Cash. Reacting to the decision, Roman Storm, whose criminal trial is set to begin in July, 2025, expressed relief, saying he was “very pleased” to see the sanctions removed.
The delisting of Tornado Cash could be a positive signal for Storm’s defense, as it reinforces the argument that the Treasury’s initial action was overly broad and legally questionable. However, his trial remains a separate matter, with prosecutors likely to focus on his personal role in developing and operating the service rather than the broader issue of whether code itself can be sanctioned.
Regardless of the outcome of Storm’s trial, crypto businesses must remain compliant with sanctions, even in rare cases where they are overturned. With Merkle Science’s Compass, businesses have been able to monitor Tornado Cash-related sanctions and assess exposure to any wallets linked to the mixer.
Following the reversal, these sanctions are now lifted. Transactions involving Tornado Cash will no longer result in automatic blacklisting or prohibition. However, the use of a mixer—while sometimes lawful—will still serve as one risk indicator among many in determining whether a transaction or address is categorized as low, medium, or high risk. Compass offers one of the most advanced rule engines in blockchain analytics, adapting in real time to changes in enforcement—whether sanctions are imposed or, as seen in March 2025, reversed. Get in touch for a free demo.
