MSTR Cat

Crypto Law/Level I · What crypto is in law/1.1 Why law reaches crypto/Lesson 1

Code is not outside the law

Why software that runs by itself still sits inside legal systems, and where courts have drawn the lines around it.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Using non-custodial, immutable software for your own account costs nothing in licensing: FinCEN guidance FIN-2013-G001 says a user acting for themselves is not a money transmitter. The catch is that every resulting sale, swap or reward is still taxable property under IRS Notice 2014-21.
  2. If a contract flaw lets you take funds, the lawful cheap route is to return them through the project’s published bug-bounty or safe-harbor terms and accept the bounty; keeping them can be theft or fraud, and the bounty is taxable income.
  3. Members of an unwrapped DAO risk being treated as an association, as the Ooki DAO ‘person’ ruling of 9 June 2023 shows; a Wyoming DAO LLC (W.S. 17-31) costs a $100 filing fee to cap liability, but owes an annual report and its own tax filings.
  4. Before using any app, a free ten-minute read of its terms shows the operating entity, governing law and dispute forum; that tells you which regulator and court can help, and costs nothing, though an arbitration clause may still waive class actions.

MaterialsThe SEC’s Report of Investigation on The DAO (Release No. 81207, 25 July 2017), on sec.govThe CFTC press release on the Ooki DAO judgment (Release 8715-23, 9 June 2023)The Fifth Circuit opinion in Van Loon v. Department of the Treasury (No. 23-50669, 26 November 2024)The terms of service of one crypto app or website you use

Wonder

  1. If a smart contract lets me do something, does that make it legal?
  2. Can a piece of software, or a group that runs one, be sued or punished?
  3. Who is responsible when nobody seems to be in charge of a protocol?

Explore

  1. The phrase ‘code is law’ comes from Lawrence Lessig’s 1999 book Code and Other Laws of Cyberspace. Lessig argued that software design regulates behaviour alongside law, social norms and markets: what a program allows shapes what people can do. In crypto the slogan is often turned around to mean that whatever a smart contract permits is fair. A smart contract is a program stored on a blockchain that runs automatically when its conditions are met. Courts and regulators in the United States and elsewhere treat what a program permits and what the law permits as two separate questions.
  2. The first big test came in 2016. The DAO was an investment fund run by smart contracts on Ethereum. On 17 June 2016 an attacker used a flaw in its code to divert about 3.6 million ether, roughly one-third of the ether it held. Most of the Ethereum community adopted a ‘hard fork’, a change to the blockchain’s rules, on 20 July 2016 to return the funds. In a report dated 25 July 2017, the US Securities and Exchange Commission (SEC) concluded that DAO tokens were securities under federal law, automated or not. It chose not to bring an enforcement action.
  3. Organisations that exist mainly as code can also be held liable. A DAO, or decentralised autonomous organisation, is a group that makes decisions through token votes recorded on a blockchain. On 9 June 2023 a federal court in California, in a case brought by the Commodity Futures Trading Commission (CFTC), ruled that the Ooki DAO was a ‘person’ under the Commodity Exchange Act. It found the DAO had run an illegal trading platform and acted as an unregistered futures commission merchant. The court ordered $643,542 in penalties, trading and registration bans, and the shutdown of the DAO’s website. Lesson 5.3.4 covers what this means for members.
  4. Courts also look closely at what code is and is not. In Van Loon v. Department of the Treasury, decided on 26 November 2024, the US Court of Appeals for the Fifth Circuit held that Tornado Cash’s immutable smart contracts, programs that nobody can change or control, were not ‘property’ that the Treasury’s Office of Foreign Assets Control could block under the sanctions statute it relied on. The court reversed the lower court and sent the case back. Treasury removed Tornado Cash from its sanctions list on 21 March 2025. The ruling limited one sanctions power; it did not place the people who write or use such code beyond the law (lessons 5.2.6 and 5.2.7).
  5. The practical lesson is that code decides what is possible, while law decides the consequences. A bug that lets someone drain a pool of funds does not settle whether taking those funds was theft, fraud or market manipulation; courts answer that by applying existing laws to the facts (lessons 6.1.5 and 6.2.6). The same goes for consumer protection, tax and anti-money-laundering rules. A transaction can be valid on the blockchain, meaning the network accepted and recorded it, and still be unlawful, taxable or open to a lawsuit.
  6. Law reaches code through people and organisations: developers, companies that run websites and apps, token holders who vote, exchanges, and the users themselves. A practical check is to open the terms of service of a crypto app you use and look for three things: the legal entity that operates it, the country or state whose law governs the terms, and how disputes are resolved. Even services that describe themselves as decentralised usually have a company behind the website, and that company is the one regulators and courts can most easily reach (lesson 1.1.4).

Key facts

  • Lawrence Lessig’s 1999 book Code and Other Laws of Cyberspace introduced the idea that software code regulates behaviour alongside law, norms and markets.
  • On 17 June 2016 an attacker exploited The DAO’s code and diverted about 3.6 million ether, roughly one-third of its ether.
  • The SEC’s report of 25 July 2017 concluded that DAO tokens were securities, and the SEC chose not to bring an enforcement action.
  • On 9 June 2023 a US federal court held that the Ooki DAO was a ‘person’ under the Commodity Exchange Act and ordered $643,542 in penalties.
  • In Van Loon v. Department of the Treasury (5th Cir., 26 November 2024), the court held that Tornado Cash’s immutable smart contracts were not blockable ‘property’.
  • The US Treasury removed Tornado Cash from its sanctions list on 21 March 2025.

Exercise nine, six, three, one

9CollectList up to 9 things you do with crypto, or that you have seen others do, where the software decides what is possible, such as swapping tokens, voting in a DAO or using a bridge.
6ClusterSort them into 6 categories: trading, holding, governance votes, lending or yield, moving funds between networks, and actions you are unsure about.
3DistillReduce the 6 categories to 3 groups: actions where you know which company or person stands behind the software, actions where you could find out, and actions where nobody seems to be responsible.
1CrystallizeWrite 1 sentence explaining, in your own words, why something a smart contract allows can still be unlawful.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS