Summary

On November 26, the U.S. Fifth Circuit Court of Appeals issued a partial ruling that Tornado Cash’s immutable smart contracts cannot be considered “property,” and are therefore not subject to the sanctions issued by the Office of Foreign Assets Control (OFAC).

This decision could become a turning point for crypto compliance, highlighting the ongoing debate between privacy and transparency in regulations. For businesses in this space, the ruling signals an evolving legal landscape that may shape future crypto regulations and potentially push regulators to adjust their frameworks to accommodate blockchain technology characteristics.

Background

Tornado Cash, a virtual currency mixer that runs on the Ethereum blockchain, is a service that mixes or “tumbles” users’ currency together to increase privacy by obfuscating crypto origin and ownership; in 2022 its software included both smart contracts. A smart contract is not a “contract” in the traditional sense, but a piece of code that automatically executes agreements under certain conditions. Mutable smart contracts can be modified after deployment, while immutable smart contracts cannot be altered once they are live. These characteristics of smart contracts played a key role in the November 26 ruling.

Smart contract definition: Self-executing contract with the terms of the agreement between buyer and seller being directly written into lines of code.[1]

OFAC designated Tornado Cash as a sanctioned party on November 8, 2022, citing its role in facilitating the laundering of “more than $7 billion worth of virtual currency since its creation in 2019.” Among the cybercriminals taking advantage of the mixer’s privacy features were North Korea’s Lazarus Group, the state-sponsored hacker group that exploited Tornado Cash to conceal funds stolen from multiple heists in 2022.

Tornado Cash’s designation came just months after OFAC sanctioned Blender.io, which had marked OFAC’s first-ever sanctions on a virtual currency mixer.

OFAC vs. Tornado Cash Users

 Following OFAC’s designation of Tornado Cash, six of the mixer’s users sued OFAC, arguing that “Tornado Cash’s inclusion on the SDN list exceeded OFAC’s statutory authority.” The Tornado Cash users claimed that OFAC lacked authority to designate Tornado Cash as a Specially Designated National (SDN) because:

1. Tornado Cash is not a foreign “national” or “person.”
2. The immutable smart contracts are not “property.”
3. Tornado Cash cannot have a property “interest” in the immutable smart contracts.

Initially, the district court ruled in favor of OFAC, determining that Tornado Cash was an “entity that may be properly designated as a person under IEEPA,” that smart contracts constitute “property,” and that the decentralized autonomous organization (DAO) that runs Tornado Cash has an “interest” in its smart contracts because it profits from its mixing services that run on those smart contracts. However, the users promptly appealed this decision, and in a partial ruling, the court reversed its previous decision regarding smart contracts as “property.”

It’s currently unclear when rulings will be made clarifying the “entity” status and “interest in property” issues. As stated in the case docket, “Because these immutable smart contracts are not “property” under the word’s common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority. Accordingly, we need not address whether Tornado Cash qualifies as an “entity” or whether it has an “interest” in the immutable smart contracts.”

Sanctions Implications

The ruling against OFAC’s designation of Tornado Cash raises important questions about the boundaries of regulatory authority when it comes to decentralized technologies like Tornado Cash, which has an organizational structure that does not fit neatly into current regulatory language. Despite this ruling that OFAC exceeded its authority when it sanctioned Tornado Cash, the history and potential of bad actors exploiting these technologies means that regulators and courts will likely continue to find ways to regulate cryptocurrency organizations’ transactions to protect national security.

For the crypto and compliance industries alike, this ruling demonstrated that long-standing regulations are deficient in addressing evolving technologies. While regulators are unlikely to stop targeting crypto anytime soon—as evidenced by OFAC’s sanctioning of a money laundering network for using digital assets to evade sanctions just days after the Tornado Cash ruling—they will need to refine their frameworks to account for the unique aspects of blockchain technology. As digital asset advancements continue to outpace regulatory developments and legitimate and illicit cryptocurrency use rises, agility will be key for businesses and regulators alike in navigating the evolving legal landscape.

While the ruling could have advantages for the crypto space, it should not overshadow the ongoing threats posed by nation-state threat actors, like the Lazarus Group, which continue to use cryptocurrency for money laundering and other illicit activities.

To navigate this gray area, businesses need to conduct thorough risk assessments on cryptocurrency exchanges and mixers to understand the controls these entities have in place to comply with Western sanctions. Though the entities with lax controls might not currently be sanctioned, there is a significant chance that they will fall under future regulations. In the present, dealing with such entities could carry reputational risk if they enable transactions with sanctioned parties.

FiveBy can assist in developing comprehensive compliance programs that align with the latest regulatory requirements and provide risk assessments to identify potential vulnerabilities when doing business with cryptocurrency exchanges and mixers. By leveraging FiveBy’s expertise, companies can navigate the complexities of digital asset regulations and sanctions, avoid penalties, and maintain the integrity of their operations.

[1] Furneaux, N. (2023). There’s No Such Thing As Crypto Crime (p. 304).