Tornado Cash's legal victory paves the way for the development of decentralized networks
TechFlow Selected TechFlow Selected
Tornado Cash's legal victory paves the way for the development of decentralized networks
On Chain is the New Online.
Navigating Web3 tides with focused insightsBy Will Wang
On November 26, 2024, the U.S. Fifth Circuit Court of Appeals ruled that the U.S. Department of Treasury's Office of Foreign Assets Control (OFAC) sanctions against Tornado Cash were unlawful and exceeded its statutory authority. As Coinbase General Counsel Paul Grewal stated: "This is a historic victory for the crypto industry and everyone who cares about defending freedom."
No one wants criminals using cryptographic protocols, but Congress has not authorized regulators to completely block entire technology-neutral open-source codebases simply because some users misuse them. Regulatory enforcement actions that exceed legal authority must be restrained.
The appellate court clearly held that while OFAC does have legitimate grounds to prohibit illegal activities, Tornado Cash—as an immutable smart contract (lines of privacy-enhancing software code)—does not constitute "property" of a foreign national or entity. This means (1) such code cannot legally be blocked, and (2) OFAC overstepped the statutory authority granted by Congress.
This ruling is landmark in significance for the crypto industry, not only clarifying the definition of immutability in smart contracts, but also offering guidance and direction for the crypto sector facing complex global regulatory environments.
Therefore, from the perspective of a Web3 legal practitioner, this article analyzes the pivotal importance of the Tornado Cash case—examining the source of OFAC’s enforcement powers, the legal definition of immutable smart contracts, and future trends in decentralized networks.
1. What Is Tornado Cash?
Tornado Cash is a well-known Ethereum-based coin mixing application designed to provide users with transaction privacy. It obscures the origins, destinations, and counterparties of cryptocurrency transactions, thereby enabling private and anonymous transfers.
Tornado Cash accepts deposits of various token types. The smart contract leverages zero-knowledge proof (Zero Knowledge Proof) technology to mix these transactions together, severing the public link between deposit and withdrawal addresses, then relays funds to recipients (upon user withdrawal), achieving transaction privacy and freeing users from concerns about on-chain surveillance.
The Tornado Cash mixing smart contract provides two valuable features: Privacy (anonymous digital transactions) and Immutability (the software code is unownable, uncontrollable, and unchangeable—even its creators cannot alter it).
While blockchain wallets are pseudonymous, wallet-to-wallet transactions are traceable and permanently recorded on the blockchain. With sufficient technical effort, someone could potentially link wallet activity to real-world identities—an alarming prospect. Tornado Cash directly addresses this issue by breaking the transaction trail between wallets, thus protecting the privacy of end users.
(Tornado Cash Case)
2. Background of Tornado Cash Sanctions
This innovative yet neutral technology can help legitimate users protect transaction privacy, but cannot prevent malicious actors from abusing it—for example, for money laundering.
On August 8, 2022, Tornado Cash was sanctioned by OFAC. The protocol, 37 Tornado Cash smart contracts (including at least 20 immutable smart contracts), and a donation-receiving address were designated as entities and added to the Specially Designated Nationals (SDN) list. The justification was that North Korean hacker groups had used Tornado Cash to commit cybercrimes such as money laundering.
Three months later, OFAC issued updated guidance adding 53 Ethereum addresses associated with Tornado Cash to the sanctions list. These guidelines treated Tornado Cash as an entity operated by its DAO, blocking “all real, personal, and other property and interests in property” under U.S. jurisdiction related to Tornado Cash.
By adding Tornado Cash to the SDN list, OFAC imposed a comprehensive ban on any transactions involving its “property.” In this context, OFAC defined “property” to include open-source computer code known as “smart contracts.”
In effect, any interaction—by any individual or entity—with blockchain addresses on the SDN list became illegal. OFAC claimed in its press release that since 2019, over $7 billion in illicit funds had been laundered through Tornado Cash, providing material assistance, sponsorship, or financial and technological support to illegal online activities both within and outside the United States—activities posing significant threats to U.S. national security, foreign policy, economic health, and financial stability—justifying the sanctions.
3. First Instance Ruling Upheld OFAC Authority
Six Tornado Cash users, funded by Coinbase, sued OFAC in the first instance. Their primary argument—one ultimately supported on appeal—was that OFAC violated the U.S. Administrative Procedure Act by lacking the authority to sanction Tornado Cash, because: (1) Tornado Cash is not a foreign “national” or “person”; (2) immutable smart contracts do not qualify as “property”; and (3) no party holds a property “interest” in immutable smart contracts.
The district court rejected the plaintiffs’ motion, concluding that: (1) Tornado Cash qualifies as an “entity” that may be designated under law; (2) smart contracts constitute “property”; and (3) the DAO operating Tornado Cash holds an “interest” in the smart contracts because it profits from services running on them.
This ruling sparked major controversy within the industry, especially regarding the classification of “smart contracts”—a technologically neutral product—under regulatory frameworks. It prompted deep reflection on the balance between Web3 privacy and financial regulation. If software code like a smart contract is deemed “property,” it could infringe upon constitutional rights protected by the First Amendment, including freedom of speech and personal privacy.
Happily, the recent appellate decision provides a clear answer—and a brighter future for decentralized networks.
（Understanding OFAC’s Crypto Regulation Logic Through the Tornado Cash Case）
4. Appellate Ruling Clarifies Definition of Immutable Smart Contracts
On November 26, 2024, the appellate court overturned the lower court’s decision, ruling that OFAC’s sanctions were unlawful and exceeded its statutory authority.
The central issue in the case was whether an open-source, cryptographic digital asset transaction protocol like Tornado Cash constitutes “property” or an “interest” under OFAC regulations.
If the answer is no, then OFAC lacks the authority to impose sanctions on Tornado Cash.
OFAC derives its enforcement power from the International Emergency Economic Powers Act (IEEPA) and the North Korea Sanctions and Policy Enhancement Act, which authorize the President to regulate (or block) “property” in which foreign “nationals,” “persons,” or “entities” hold an “interest.”
IEEPA is a cornerstone of the modern U.S. sanctions regime. It authorizes the President to freeze assets of foreign actors deemed threats to U.S. national security and to prohibit transactions with them. This broad authority is administered by OFAC, which oversees numerous economic sanctions programs.
Under these statutes, OFAC has issued regulations defining key terms such as “person,” “entity,” “property,” and “interest.” It also provides mechanisms for affected parties to challenge designations and, in some cases, grants licenses for transactions involving blocked property.
4.1 Immutable Smart Contracts
The court distinguished between types of smart contracts in its opinion, avoiding the lower court’s error of treating all smart contracts uniformly as “property.”
Smart contracts fall into two categories: (1) mutable smart contracts, typically controlled by one or more parties; and (2) immutable smart contracts, which no one controls. Once a smart contract becomes immutable, no one can reclaim control over it.
In the case of Tornado Cash, it began in 2019 as a decentralized, open-source software protocol developed by a group of individuals. While some early smart contracts were mutable, in 2020 the developers conducted a “trusted setup ceremony” to relinquish control. Over 1,100 users participated, rendering at least 20 smart contracts irreversibly immutable.
Since then, Tornado Cash has functioned as self-executing computer code that cannot be altered, deleted, or controlled. The protocol operates autonomously on the blockchain without human intervention, with governance managed by a DAO.
4.2 OFAC’s Basis for Sanctions
Although Tornado Cash is neutral and most users employ it for legitimate purposes—such as anonymously donating to Ukraine or protecting against hacking—the protocol cannot prevent bad actors from using it to launder illicit proceeds.
This is precisely why OFAC intervened. Under IEEPA, the President may exercise special economic powers after declaring a national emergency in response to any “unusual and extraordinary threat” originating substantially outside the United States and threatening U.S. national security, foreign policy, or economy. This includes freezing “any property in which any foreign country or a national thereof has any interest.”
4.3 Tornado Cash Does Not Qualify as Property
While the law empowers the President to regulate “property” and “interests” held by foreign nationals or entities, the appellate court refused to classify immutable smart contracts as either “property” or “interests.”
“Property” implies something capable of ownership, with clear title and corresponding rights such as use, disposal, and exclusion.
Property has a plain meaning: It is capable of being owned. Property includes everything which is or may be the subject of ownership, whether a legal ownership, or whether beneficial, or a private ownership.
It is “the condition of being owned by or belonging to some person or persons” and encompasses “the right to possess, use, and dispose of something.” It also includes the right “to exclude everyone else from interfering with it.”
In this case, the immutable smart contracts comprising Tornado Cash clearly cannot be owned by anyone, nor can they exclude others from using them. Even after OFAC’s sanctions, users continue to interact with and invoke the underlying smart contracts.
“Those immutable smart contracts remain accessible to anyone with an internet connection.”
4.4 Tornado Cash Is Neither a Contract Nor a Service
OFAC argued that immutable smart contracts could represent “interests” related to property, such as contractual or service-related interests. But the court firmly stated that although called “smart contracts,” these are not actual contracts (the smart contract is not itself a contract).
A contract is a consensual agreement between two or more parties, revocable under certain conditions. A smart contract, however, is merely software code—it cannot make offers or exercise revocation rights. Similarly, immutable smart contracts cannot have their code changed, deleted, or removed from the Ethereum blockchain. They represent interactions between users and code, not binding agreements.
Likewise, a service involves performing useful actions for another party, typically for compensation. Here, a smart contract is just a line of code—it cannot act for another’s benefit or earn profit.
Tornado Cash smart contracts are merely tools used in delivering a service (are tools used in providing a service), and no one controls these contracts (The immutable smart contracts are not property because they are not ownable, not contracts, and not services).
4.5 The Appellate Court’s Ruling
Accordingly, the appellate court reversed the lower court’s decision, holding that OFAC’s enforcement action exceeded its statutory authority.
The court concluded: We recognize the risks posed by unregulated, uncontrollable technologies in the real world. Governments rightly concern themselves with malicious cyber activity—hence IEEPA became law in 1977, years before the modern internet existed.
Yet the law grants only broad—not unlimited or expansively interpreted—powers to regulate economic transactions. Those powers have limits.
5. A Victory for Decentralized Networks
While this is only an appellate decision and OFAC retains the right to appeal to the Supreme Court, the strength of the reasoning in the appellate opinion makes reversal unlikely.
As Coinbase said: On Chain is the New Online. As more decentralized protocols and networks reach mainstream adoption, the previously permissionless nature of on-chain activity must evolve toward compliance. Balancing innovation under technological neutrality with effective regulation remains a critical challenge for lawmakers and regulators alike.
Regardless, just as Grayscale’s victory over the SEC paved the way for Bitcoin ETFs, the Tornado Cash case clears a path for further development of decentralized networks.
As Putin once said: Bitcoin and other electronic payment methods, as new technologies, cannot be entirely banned—they will continue to develop due to their advantages in reducing costs and enhancing transaction reliability.
（Web3 Privacy vs. Financial Regulation: Insights from OFAC and FinCEN）
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
0xWillmfer
