Court Rules OFAC Overstepped Authority: The Boundary Between Technology and Law in the Tornado Cash Case
TechFlow Selected TechFlow Selected
Court Rules OFAC Overstepped Authority: The Boundary Between Technology and Law in the Tornado Cash Case
Regardless of whether OFAC adds Tornado Cash to its sanctions list, these immutable smart contracts will continue to operate.
Navigating Web3 tides with focused insightsBy ZHIXIONG PAN
Can an immutable smart contract be subject to sanctions? This was the central question facing the U.S. Court of Appeals for the Fifth Circuit in the Tornado Cash case.
Yesterday, the court ruled that the Office of Foreign Assets Control (OFAC) under the U.S. Department of the Treasury had overstepped its authority by sanctioning Tornado Cash. This decision is not only a victory for the plaintiffs but also sparks broader discussions about technological neutrality and legal boundaries.
The rise of blockchain technology has brought a revolution in privacy and decentralization, but it has also introduced regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversies, the U.S. Treasury imposed strict sanctions against it.
However, the court found that Tornado Cash’s immutable smart contracts do not meet the traditional legal definition of "property." These smart contracts are decentralized, self-executing lines of code with no human control—neither ownable nor subject to exclusive use. Therefore, placing them on the Specially Designated Nationals and Blocked Persons List (SDN List) exceeded the scope of statutory authority granted to OFAC.
The implications of this ruling extend far beyond the individual case. It touches upon the legality of blockchain privacy tools and raises significant questions about technological neutrality and legal adaptability. The court's decision points toward future legislation and regulation: the inherent nature of technology must be distinguished from malicious use by individuals, preventing administrative agencies from overreaching due to technological neutrality.
In fact, the court's opinion contains many notable details worth examining.
Who Are the Plaintiffs?
The plaintiffs identify themselves as users of Tornado Cash—and more broadly, participants in the Ethereum and cryptocurrency ecosystem. They come from backgrounds including security auditing, Coinbase, client development, and hardware wallets, and are supported behind the scenes by Coinbase’s legal team. They are:
-
Joseph Van Loon (Auditware, former Apple)
-
Tyler Almeida (Coinbase)
-
Alexander Fisher (angel investor)
-
Preston Van Loon (core Ethereum developer and Offchain Labs / Arbitrum)
-
Kevin Vitale (GridPlus)
-
Nate Welch (former zkSync, Coinbase)
Who Are the Defendants?
-
U.S. Department of the Treasury and Secretary Janet Yellen
-
Office of Foreign Assets Control (OFAC), along with OFAC Director Andrea M. Gacki
Why Did the Plaintiffs File the Lawsuit?
The plaintiffs challenged the defendants’ actions, arguing that designating Tornado Cash’s immutable smart contracts as “property” and imposing sanctions exceeded their legal authority under the International Emergency Economic Powers Act (IEEPA) and violated the Administrative Procedure Act (APA).
The plaintiffs contended that these contracts are autonomous, decentralized code incapable of ownership or control, and therefore should not be sanctionable.
Which Court Issued the Ruling?
The United States Court of Appeals for the Fifth Circuit is an intermediate appellate court within the federal judiciary system. Above it stands the Supreme Court of the United States—the highest and final arbiter in the federal judicial hierarchy. Only a small number of cases reach the Supreme Court through appeal or special writs such as certiorari.
What Was the Outcome of the Court's Decision?
The court held that the defendant (OFAC) violated the International Emergency Economic Powers Act (IEEPA), because immutable smart contracts do not qualify as “property.”
The court determined that these smart contracts are decentralized, self-operating, and uncontrollable pieces of code, and thus cannot be valid targets of sanctions. At the same time, the court acknowledged that while technology may be misused, executive agencies cannot expand their powers beyond what the law allows. Ultimately, the court overturned the sanctions and called on Congress to address legal gaps concerning emerging technologies.
Why Did the Plaintiffs Sue on Behalf of Tornado Cash?
Although none of the six plaintiffs are developers of Tornado Cash, they all identified themselves as users who rely on Tornado Cash for legitimate, privacy-enhancing purposes.
For example, Tyler Almeida used Tornado Cash to anonymously donate to support Ukraine, fearing retaliation from Russian hacker groups if his transactions were traceable. Kevin Vitale began using Tornado Cash after discovering that someone had linked his cryptocurrency activity to his real-world identity. Others shared similar motivations.
Immutable Is the Key Term—How Is It Defined?
This case features extensive discussion, interpretation, and clarification around the term “immutable,” effectively recognizing the unique characteristics of decentralized systems and smart contracts. The court acknowledged that the nature of decentralized technology poses distinct challenges to existing legal frameworks.
The court concluded:
Because these immutable smart contracts are not ‘property’ under the word’s common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
因为这些不可变智能合约无论在普通的、通俗的意义下，还是在 OFAC 的定义下，都不构成「财产」，我们认定 OFAC 超越了其法定权限。
It further stated:
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can ‘exclude’ anyone from using the Tornado Cash pool smart contracts.
本案中涉及的不可变智能合约并不是财产，因为它们无法被拥有。
因此，没有人能够「排除」他人使用 Tornado Cash 智能合约的权利。
The court defined immutable smart contracts as follows:
A mutable smart contract is one which is managed by some party or group and may be changed.
An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.
可变智能合约是由某些个人或团体管理的合约，并且可以被更改。
不可变智能合约则无法从区块链上被更改或移除。需要注意的是，可变智能合约可以被更改为不可变的状态。但这是一个不可逆的过程；一旦智能合约变得不可变，就没有人能够重新获得对它的控制权。
But What About Hackers Using Tornado Cash for Money Laundering? No Immediate Solution.
The North Korean hacking group Lazarus Group stole nearly $1 billion in cryptocurrency through cyberattacks and needed to obscure fund origins via mixers to complete money laundering. OFAC alleged that Tornado Cash’s mixing functionality was used for this purpose, noting that over 65% of Lazarus Group’s laundering activities in 2021 involved cryptocurrency mixers—with Tornado Cash being one of the primary tools.
Thus, Tornado Cash was indirectly linked to the Lazarus Group’s money laundering operations and placed on the sanctions list.
The court acknowledged that although the Lazarus Group used Tornado Cash, this should not justify sanctioning the entire protocol. Since immutable smart contracts do not constitute “property” or “services” in the traditional sense, the whole protocol cannot be penalized merely because certain actors like Lazarus Group abused it.
Therefore, OFAC’s action exceeded its legal authority. The court urged lawmakers to update legislation rather than stretch existing sanctions frameworks.
IEEPA Was Enacted in 1977—Long Before the Modern Internet
Previously, OFAC relied primarily on the International Emergency Economic Powers Act (IEEPA)—enacted in 1977, long before the advent of the modern internet—as the legal basis for sanctioning Tornado Cash.
IEEPA grants the U.S. President authority to impose economic sanctions on foreign “property” when national security, foreign policy, or the economy faces an “unusual and extraordinary threat.” OFAC treated Tornado Cash as an “entity” and classified its smart contracts as tools associated with foreign cybercriminal organizations like North Korea’s Lazarus Group.
But the court emphasized that updating laws to meet new technological challenges is Congress’s responsibility—not a task for courts to accomplish by expanding statutory interpretations. The court rejected the Treasury Department’s attempt to broaden executive power through judicial reinterpretation.
Final Thoughts
This ruling matters not only for the legitimacy of privacy tools like Tornado Cash but also for establishing clear legal boundaries for the entire blockchain industry and decentralized technologies. The unique nature of immutable smart contracts was thoroughly examined, and the court’s decision provides crucial judicial support for the lawful use of similar technologies in the future.
At the same time, it presents new challenges for regulators: how to balance innovation and privacy protection while effectively curbing potential illicit uses.
After all, this is truly fascinating technology. Two sentences from the ruling perfectly capture its distinctive nature:
Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, "those immutable smart contracts remain accessible to anyone with an internet connection."
简单来说，无论 OFAC 是否将 Tornado Cash 列入制裁名单，这些不可变智能合约都会继续运行。
即使制裁生效，「这些不可变智能合约仍然对任何拥有互联网连接的人开放。」
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@ChainFeedsxyz
