MSTR Cat

Crypto Law/Level V · Builders and launchers/5.2 Money rules/Lesson 6

Tornado Cash: sanctions on code

How the US sanctioned a set of smart contracts, why the Fifth Circuit said immutable code is not property that can be blocked, and what that ruling leaves open for builders.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Reading, copying, publishing and teaching the Tornado Cash code was never prohibited by OFAC’s 2022 FAQs. Sharing open-source code is free and lawful, provided you do not transact with sanctioned parties.
  2. Van Loon (5th Cir., 26 Nov 2024) held that immutable contracts nobody owns are not blockable property. That binds only Texas, Louisiana and Mississippi, and Tornado Cash was delisted on 21 March 2025.
  3. Mutable contracts, admin keys, front-ends, relayers and companies can still be sanctioned, so if you keep any of these, screen against the SDN list. Operator-run mixers like Blender.io and Sinbad were listed.
  4. If dusted from a sanctioned address, report it to OFAC. OFAC has said it would not prioritise enforcement against dusted US persons who reported late with no other sanctions link, so report promptly anyway.
  5. Making code immutable may limit the reach of sanctions, but it also removes any way to stop misuse, which a Dutch court held against Pertsev. Decide that trade-off before you deploy.

MaterialsTreasury press release jy0916, ‘U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash’ (8 August 2022)Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. 26 November 2024)The amended final judgment in Van Loon, No. 1:23-CV-312-RP (W.D. Tex. 28 April 2025)Treasury’s ‘Tornado Cash Delisting’ statement (21 March 2025)

Wonder

  1. How can a government sanction software that nobody runs?
  2. After Van Loon, can a smart contract ever be put on the SDN list?
  3. Was it ever illegal to read or publish the Tornado Cash code?

Explore

  1. Tornado Cash, created in 2019, is a ‘mixer’ on Ethereum: users deposit fixed amounts into pool smart contracts and later withdraw to a different address by presenting a cryptographic proof, which breaks the visible link between sender and recipient. According to the Fifth Circuit, the pool contracts started out changeable (‘mutable’) but in 2020 the developers made them irreversibly ‘immutable’, so no one, including their creators, could alter or remove them. Other parts stayed mutable, including governance contracts controlled by holders of the TORN token and a registry of ‘relayers’, third parties who submit withdrawals for users. That mix of controllable and uncontrollable parts shaped the legal fight.
  2. On 8 August 2022 OFAC added Tornado Cash to the SDN list under Executive Order 13694, a cyber-crime sanctions order. Treasury said the mixer had been used to launder more than $7 billion since 2019, including over $455 million stolen by North Korea’s Lazarus Group, more than $96 million from the June 2022 Harmony bridge hack and at least $7.8 million from the August 2022 Nomad hack. The listing named Ethereum addresses of the smart contracts as identifiers, so any US person sending to or receiving from them risked a violation. On 8 November 2022 OFAC redesignated Tornado Cash, adding North Korea-related authorities.
  3. In September 2022 OFAC issued four FAQs on the designation. They said US persons were not prohibited from copying the open-source code and posting it online, or from discussing, teaching about or including it in publications such as textbooks, absent other facts. Users with transactions stuck in the pools could apply for a specific licence to complete them. For ‘dusting’, when someone sends tiny unsolicited amounts from Tornado Cash to strangers’ addresses, OFAC said it would not prioritise enforcement against US persons who reported late, if there was no other sanctions link. The FAQs drew a line between code as information and transacting with the contracts.
  4. Six Tornado Cash users sued in Texas. The district court sided with Treasury, but on 26 November 2024 the Fifth Circuit reversed in Van Loon v. Department of the Treasury. Writing for the panel, Judge Willett held that the immutable smart contracts are not the ‘property’ of a foreign national or entity under the International Emergency Economic Powers Act, because property means something capable of being owned, so they cannot be blocked and OFAC exceeded its authority. The court suggested Congress could update the 1977 statute for technologies like mixers. A parallel suit by the advocacy group Coin Center had lost in a Florida district court and was on appeal.
  5. On 21 March 2025 Treasury removed Tornado Cash from the SDN list, saying it had ‘exercised our discretion’ after reviewing novel legal and policy issues, while remaining ‘deeply concerned’ about North Korean hacking and laundering. On 28 April 2025 the Texas district court entered an amended final judgment declaring OFAC’s action unlawful, setting it aside and permanently barring Treasury from enforcing it. In July 2025 the Eleventh Circuit, on a joint request, vacated the Florida ruling and ordered the Coin Center case dismissed. The sanctions question was settled for these contracts; the criminal cases against developers continued separately (lesson 5.2.7).
  6. The holding is narrow. It concerns immutable code that no one owns or controls, and it binds federal courts only in Texas, Louisiana and Mississippi. Mutable contracts with admin keys, front-end websites, relayers, companies, DAOs that exercise control and the people behind them can still be sanctioned, and OFAC had already listed operator-run mixers such as Blender.io in May 2022 and Sinbad in November 2023. For builders, immutability may limit sanctions reach but also removes any way to stop misuse, a point the Dutch court in Alexey Pertsev’s case held against him (lesson 5.2.7). A practical check: list each component of your system that someone can still upgrade, pause or switch off.

Key facts

  • OFAC designated Tornado Cash on 8 August 2022 under Executive Order 13694.
  • Treasury said Tornado Cash had been used to launder more than $7 billion since 2019, including over $455 million stolen by the Lazarus Group.
  • On 26 November 2024 the Fifth Circuit held in Van Loon v. Department of the Treasury that Tornado Cash’s immutable smart contracts are not property under IEEPA.
  • Treasury removed Tornado Cash from the SDN list on 21 March 2025.
  • On 28 April 2025 the Western District of Texas set aside OFAC’s Tornado Cash action and permanently enjoined its enforcement.
  • OFAC’s first sanctions on a virtual currency mixer targeted Blender.io in May 2022.

Exercise nine, six, three, one

9CollectList up to 9 parts of a smart-contract system you use or are building, such as core contracts, an upgrade proxy, an admin or pause key, a governance token, a website, a relayer or an indexer (some lists are shorter).
6ClusterSort them into 6 categories: immutable code, upgradeable code, keys held by a person, keys held by a DAO, off-chain services run by someone, and parts whose control you cannot determine.
3DistillReduce the 6 to 3 groups: parts the Van Loon reasoning may cover, parts that someone owns or controls, and parts you need to investigate.
1CrystallizeWrite 1 sentence explaining what the Van Loon decision decided about immutable smart contracts and one thing it did not decide.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS