MSTR Cat

Crypto Law/Level V · Builders and launchers/5.2 Money rules/Lesson 7

Developers in court: Tornado Cash and Samourai

What prosecutors charged the people behind Tornado Cash and Samourai Wallet with, how those cases stood in October 2026, and which facts turned writing privacy software into a criminal case.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Writing and publishing code without ill intent is not a crime under the DOJ’s August 2025 position. The protection holds only while you do not run the service, take custody or knowingly serve criminals.
  2. Do not operate the service as a business by paying for infrastructure or relayers, charging fees, or promoting it as ‘clean dirty BTC’. Storm and the Samourai founders were convicted on this conduct beyond the code itself.
  3. Market only lawful uses and keep team chats clean. Prosecutors relied on messages and posts, and these cost nothing to get right but are permanent evidence.
  4. If told of criminal misuse, respond, for example by cooperating with police or blocking a known hack’s flows at a front-end you control. Continuing to transmit hacked funds after notice was central to the Storm case.
  5. S. 3611, the Blockchain Regulatory Certainty Act, would protect non-controlling developers but is not law as of October 2026. Until it passes, design for no control over user assets.

MaterialsThe SDNY press releases on Roman Storm’s indictment (23 August 2023) and conviction (6 August 2025)The SDNY press release on the Samourai Wallet sentencings (19 November 2025)The Oost-Brabant District Court’s English summary of the Alexey Pertsev judgment (14 May 2024)The docket of United States v. Storm, No. 1:23-cr-00430 (S.D.N.Y.), on CourtListener

Wonder

  1. Can someone go to prison for publishing open-source privacy software?
  2. What did Roman Storm’s jury actually decide, and is his case over?
  3. Has the Justice Department changed its position on developers since 2025?

Explore

  1. On 23 August 2023 prosecutors in the Southern District of New York unsealed an indictment of Tornado Cash founders Roman Storm and Roman Semenov for conspiracy to commit money laundering, conspiracy to violate sanctions and conspiracy to operate an unlicensed money transmitting business. They alleged the mixer helped launder more than $1 billion, including hundreds of millions of dollars for North Korea’s Lazarus Group. Storm was arrested in Washington State; Semenov remained at large. The case went to Judge Katherine Polk Failla. The criminal charges were separate from the sanctions question that the Fifth Circuit later decided in the users’ favour (lesson 5.2.6).
  2. After a trial of about four weeks, on 6 August 2025 the jury convicted Storm of conspiracy to operate an unlicensed money transmitting business, which carries a maximum of five years in prison, and could not agree on the money-laundering and sanctions counts. The government’s case stressed conduct beyond writing code: prosecutors said Storm and his co-founders paid for infrastructure, promoted the service, cashed out more than $12 million in profits and kept transmitting funds from the Ronin hack after the FBI attributed it to the Lazarus Group. In a later motion the defence argued that prosecutors had not proved he intended to help criminals misuse the tool.
  3. As of October 2026 the case was unresolved. Storm filed a motion for a judgment of acquittal in September 2025; Judge Failla heard argument in April 2026 and had not ruled. In August 2026 the retrial of the two deadlocked counts was postponed to 26 April 2027, to go ahead only if those charges remain. In early October 2026 prosecutors cited a 25 September 2026 decision of the D.C. Circuit upholding the conviction of Roman Sterlingov, operator of the Bitcoin Fog mixer, as support on the question of venue, meaning whether New York was a proper place for trial. Any ruling or retrial outcome could change the picture.
  4. Samourai Wallet was a Bitcoin wallet with two privacy features: Whirlpool, which coordinated batches of transactions between users (a ‘CoinJoin’), and Ricochet, which added extra hops between addresses. Its founders Keonne Rodriguez and William Hill were charged on 24 April 2024 and pleaded guilty on 30 July 2025 to conspiring to operate a money transmitting business that they knew transmitted criminal proceeds. Judge Denise Cote sentenced Rodriguez to five years on 6 November 2025 and Hill to four years on 19 November 2025, each with a $250,000 fine. Prosecutors relied on messages, including Hill promoting Whirlpool on a darknet forum as a way to ‘clean dirty BTC’.
  5. Outside the US, a Dutch district court in ‘s-Hertogenbosch convicted Tornado Cash developer Alexey Pertsev of money laundering on 14 May 2024 and sentenced him to five years and four months. The court said Tornado Cash itself carried out the concealment, so it was not a mere instrument of its users, and that if he had wanted to be able to act against abuse ‘he should have built it in’. Pertsev appealed, and the appeal was still pending in mid-2026 according to press reports. The reasoning differs from US law, but it shows how a design choice can be read as a choice about responsibility.
  6. US policy has shifted without settling the law. In August 2025 the Justice Department said publicly that new charges under 18 U.S.C. §1960(b)(1)(C) would not be approved where software is truly decentralised and nobody else has custody and control of user assets, and that merely writing code without ill intent is not a crime (lesson 5.2.1). A Senate bill, the Blockchain Regulatory Certainty Act (S. 3611), introduced on 12 January 2026, would protect non-controlling developers from money-transmitter treatment, but it was not law in October 2026 (lesson 3.2.5). A practical check: read your own public posts, marketing and team chats as a prosecutor would.

Key facts

  • The indictment of Tornado Cash founders Roman Storm and Roman Semenov was unsealed on 23 August 2023 in the Southern District of New York.
  • On 6 August 2025 a jury convicted Roman Storm of conspiracy to operate an unlicensed money transmitting business and deadlocked on the money-laundering and sanctions counts.
  • Roman Storm’s retrial on the deadlocked counts was rescheduled to 26 April 2027 while his acquittal motion remained pending.
  • Samourai Wallet founders Keonne Rodriguez and William Hill pleaded guilty on 30 July 2025.
  • Rodriguez was sentenced to five years in prison on 6 November 2025 and Hill to four years on 19 November 2025.
  • A Dutch court sentenced Tornado Cash developer Alexey Pertsev to five years and four months for money laundering on 14 May 2024.

Exercise nine, six, three, one

9CollectList up to 9 facts a prosecutor might point to in a case about privacy software, such as fees earned, servers paid for, marketing messages, chats about hacks, admin keys or responses to victims (some lists are shorter).
6ClusterSort them into 6 categories: control over the software, money earned, knowledge of misuse, promotion to users, responses to victims or police, and design choices.
3DistillReduce the 6 to 3 groups: facts suggesting the developer ran a service, facts suggesting the developer knew of crime, and facts consistent with only writing code.
1CrystallizeWrite 1 sentence explaining which facts, beyond writing code, the prosecutions of Tornado Cash and Samourai Wallet relied on.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS