OFAC Tornado Cash – The Ultimate Guide

The storm surrounding Tornado Cash continues. After the Office of Foreign Assets Control (OFAC) took the unusual step of listing Tornado Cash as a Specially Designated National (SDN) in 2022, it has recently sanctioned one of the virtual currency mixer’s co-founders, and the U.S. Department of Justice (DOJ) announced charges against the same co-founder and another. Under OFAC’s sanctions, U.S. persons are prohibited from conducting transactions with Tornado Cash, and those that violate OFAC’s sanctions can face steep penalties—including criminal penalties in some cases.

The Tornado Cash saga has been a veritable whirlwind over the past year. In this Ultimate Guide, our OFAC compliance and sanctions defense lawyers recap the events to date and explain what investors, intermediaries, and other U.S. parties need to know.

OFAC’s Efforts to Target Tornado Cash

To understand the significance of OFAC’s efforts to target Tornado Cash, we need to begin with an explanation of what Tornado Cash is. Tornado Cash is not a company, but rather a digital platform for facilitating cryptocurrency transactions. As OFAC explains:

“Tornado Cash . . . is a virtual currency mixer that operates on the Ethereum blockchain and indiscriminately facilitates anonymous transactions by obfuscating their origin, destination, and counterparties, with no attempt to determine their origin. Tornado receives a variety of transactions and mixes them together before transmitting them to their individual recipients.”

While Tornado Cash’s failure to identify parties to the transactions it facilitates raises red flags from an OFAC compliance perspective, this is not OFAC’s only concern. As OFAC goes on to explain, “While the purported purpose [of anonymously mixing cryptocurrency assets] is to increase privacy, mixers like Tornado are commonly used by illicit actors to launder funds, especially those stolen during significant heists.”

OFAC’s sanctioning of Tornado Cash (as discussed in greater detail below) isn’t the first time that the federal government has targeted a virtual currency mixer. In 2020, the Financial Crimes Enforcement Network (FinCEN) assessed a $60 million civil monetary penalty against Larry Dean Harmon, who operated the virtual currency mixers Helix and Coin Ninja. Notably, however, FinCEN’s enforcement action involving Helix and Coin Ninja was based on violations of the anti-money laundering provisions of the Bank Secrecy Act (BSA) and other pertinent federal statutes. As noted, FinCEN also fined the individual behind these platforms rather than sanctioning the programs themselves.

Additionally, while OFAC’s sanctioning of Tornado Cash was unusual, it was not unprecedented. OFAC previously sanctioned the virtual currency mixer Blender.io in May of 2022 after it was used to process a portion of the proceeds of a $620 million virtual currency heist carried out by Lazarus Group. Lazarus Group is a hacking syndicate sponsored by the Democratic People’s Republic of Korea (DPRK).

OFAC Designates Tornado Cash as an SDN

OFAC designated Tornado Cash as an SDN on August 8, 2022. In doing so, it alleged that the virtual currency mixer had been used to launder more than $7 billion in cryptocurrency, including nearly half a billion dollars stolen by the Lazarus Group. As OFAC wrote at the time:

“Tornado is being designated . . . for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, a cyber-enabled activity originating from, or directed by persons located, in whole or in substantial part, outside the United States that is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States and that has the purpose or effect of causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, or financial information for commercial or competitive advantage or private financial gain.”

In designating Tornado Cash, OFAC also made clear that it intends to continue targeting virtual currency mixers in the future. Noting that criminals have “increased their use of anonymity-enhancing technologies, including mixers” and citing the U.S. Treasury Department’s 2022 National Money Laundering Risk Assessment, OFAC’s announcement of Tornado Cash’s designation labels virtually all virtual currency mixers as “a threat to U.S. national security.” The announcement also notes that the U.S. Treasury Department will “continue to investigate the use of mixers for illicit purposes and use its authorities to respond to illicit financing risks in the virtual currency ecosystem.”

OFAC’s sanctioning of Tornado Cash (and Blender.io) is notable because these are not entities, but rather platforms that only exist in the digital realm. OFAC has the authority to sanction “persons,” which some have argued (unsuccessfully, as discussed in greater detail below) does not encompass digital platforms. However, OFAC has justified its sanctions, in part, by relying on Tornado Cash’s decentralized autonomous organization (DAO). Noting that a “person” includes a “partnership, association, joint venture, corporation, group, subgroup, or other organization,” OFAC states in FAQ 1095:

“Tornado Cash’s organizational structure consists of: (1) its founders and other associated developers, who together launched the Tornado Cash mixing service, developed new Tornado Cash mixing service features, created the Tornado Cash Decentralized Autonomous Organization (DAO), and actively promoted the platform’s popularity in an attempt to increase its user base; and (2) the Tornado Cash DAO, which is responsible for voting on and implementing new features created by the developers.”

This, according to OFAC, is sufficient to constitute an “other organization” under the definition of “person” established in the International Emergency Economic Powers Act (IEEPA). Due to ongoing concerns about the risks associated with illicit use of Tornado Cash, the platform remains on OFAC’s list of sanctioned “persons” to this day.

OFAC Designates Tornado Cash Co-Founder Roman Semenov as an SDN

More than a year after sanctioning Tornado Cash, OFAC added one of the platform’s three co-founders, Roman Semenov, to its SDN list. On August 23, 2023, OFAC announced the sanctions based, in part, on Semenov’s knowledge that “an Ethereum address that was publicly attributed to the Lazarus Group and identified on the Specially Designated Nationals and Blocked Persons List (SDN List), containing hundreds of millions of dollars in stolen proceeds from the widely publicized $620 million Ronin bridge heist, was being used to send funds through Tornado Cash’s service.”

At this point, it is not clear why OFAC has only announced the sanctioning of one of Tornado Cash’s three co-founders. However, as the federal government’s efforts to target Tornado Cash are ongoing, it is possible that OFAC may sanction additional individuals and/or entities in the future.

Legal Challenges to OFAC’s Designation of Tornado Cash Fail

After OFAC announced its sanctioning of Tornado Cash, legal challenges followed. Cryptocurrency and coding advocates challenged OFAC’s authority to sanction the platform (which the Electronic Frontier Foundation (EFF) describes as an “open-source project”) in addition to raising First Amendment concerns. However, on August 17, 2023, the U.S. District Court for the Western District of Texas sided with the U.S. Treasury Department, dismissing all of the arguments raised.

Put our highly experienced team on your side

Dr. Nick Oberheiden

Founder

Attorney-at-Law

Lynette S. Byrd

Former DOJ Trial Attorney

Partner

Brian J. Kuester

Former U.S. Attorney

Hon. Kevin McCarthy

55th Speaker, U.S. House of Representatives (ret.)

Government Consultant

Mike Pompeo

Of Counsel

Former U.S. Secretary of State

John W. Sellers

Former Senior DOJ Trial Attorney

Linda Julin McNamara

Federal Appeals Attorney

Nicholas B. Johnson

Former Prosecutor

Roger Bach

Former Special Agent (DOJ)

Chris J. Quick

Former Special Agent (FBI & IRS-CI)

Michael S. Koslow

Former Supervisory Special Agent (DOD-OIG)

Ray Yuen

Former Supervisory Special Agent (FBI)

The DOJ’s Criminal Charges Against Tornado Cash’s Co-Founders

Following OFAC’s sanctioning of Tornado Cash, the DOJ also began scrutinizing the virtual currency mixer’s operations and organizational structure. In coordination with OFAC’s sanctioning of Semenov, the DOJ announced charges against Semenov and one of his co-founders, Roman Storm of Washington, on August 23.

In its press release, the DOJ alleges that Semenov and Storm operated Tornado Cash as a “scheme designed to help other criminals launder and conceal funds using cryptocurrency, including by laundering hundreds of millions of dollars on behalf of a state-sponsored North Korean cybercrime group sanctioned by the U.S. government.” The unsealed indictment includes charges for conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed money transmitting business.

What Do OFAC’s Efforts to Target Tornado Cash Mean for Other Parties?

So, what does all of this mean for you? Under OFAC’s sanctions, all U.S. persons (including both individuals and organizations) are prohibited from conducting transactions with OFAC. As OFAC explains in its FAQ 1079, those who have money held by Tornado Cash must now obtain a specific license in order to withdraw their funds. Given the federal government’s focus on digital currency mixers generally, individuals and organizations should be cautious about placing their funds with other mixers as well—and those that operate (or are thinking about establishing) a digital currency mixing platform should exercise extreme caution in light of the risks involved.

Violations of OFAC sanctions can lead to both civil monetary penalties and criminal prosecution. Use of digital currency mixing platforms can lead to charges for money laundering and other federal crimes as well. As a result, a proactive approach to compliance is key, and those that are facing allegations (or at risk of facing allegations) should seek experienced counsel promptly.

Contact the OFAC Compliance and Sanctions Defense Lawyers at Oberheiden P.C.

Our lawyers represent individuals and organizations in all OFAC-related and cryptocurrency and blockchain-related legal matters. If you have questions or concerns, we invite you to get in touch. Please call 888-680-1745 or contact us online to arrange a confidential consultation.