November 2024 Ruling Overturns Tornado Cash Sanctions

Mixers have been a key topic in regulatory debates in recent years. Although they have legitimate uses, they’ve also been used by criminals, leading to regulatory actions. Tornado Cash, a platform powered by immutable smart contracts, was sanctioned in 2022, causing controversy over whether code itself can be sanctioned. In 2024, this decision was overturned. This article explains what Tornado Cash is, why it was sanctioned in 2022, and how a court decision in November 2024 ruled that smart contracts don’t fit within current legal frameworks.

About Tornado Cash

Tornado Cash is a decentralized, non-custodial protocol designed to enhance privacy on the Ethereum blockchain by obfuscating the transaction history of Ethereum and other ERC-20 tokens. It uses smart contracts to enable users to deposit assets and withdraw them to a different address, effectively breaking the on-chain link between the sender and the recipient. The protocol employs zk-SNARKs, a cryptographic technology that allows for the verification of transactions without revealing the underlying data.

Tornado Cash gained popularity among legitimate users who sought privacy for their transactions. However, its privacy features also attracted illicit actors who used it to obfuscate the origin of stolen or illegally obtained crypto assets, raising concerns from regulators and law enforcement agencies.

About Smart Contracts

To fully grasp the Tornado Cash case, it is essential to understand the concept of smart contracts and the distinction between mutable and immutable ones. A smart contract is a self-executing digital agreement, where the terms are embedded directly in code. These contracts operate on blockchains, commonly Ethereum, and automatically execute when predefined conditions are satisfied.

Smart contracts are categorized into two types: "mutable" and "immutable." Mutable smart contracts are those that can be managed, altered, or updated by a party or group. In contrast, immutable smart contracts, once deployed, cannot be modified or removed from the blockchain. Although a mutable contract can be transformed into an immutable one, this change is irreversible. Once a contract becomes immutable, it operates independently, and no individual or entity can regain control over it. 

Tornado Cash, introduced in 2019 as an open-source protocol on Ethereum, initially included both mutable and immutable smart contracts. At first, the developers retained the capability to update the code of the pool smart contracts, making them mutable. 

However, in 2020, a “trusted setup ceremony” was held, involving over 1,100 participants, during which control over the pool smart contracts was permanently relinquished. As a result, at least twenty smart contracts, including the pool contracts, became irreversibly immutable. These contracts then operated as fully autonomous, self-executing programs, no longer subject to alteration, removal, or external control. 

2022: Tornado Cash Sanctioning

Tornado Cash was linked to laundering over $7 billion in virtual currency, including $455 million stolen by the Lazarus Group, a North Korean state-sponsored hacking organization sanctioned in 2019. The platform also facilitated the movement of illicit funds from major cybercrimes, such as $96 million from the Harmony Bridge hack on June 24, 2022, and $7.8 million from the Nomad Bridge heist on August 2, 2022.

On August 8, 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) made an unprecedented decision to sanction Tornado Cash’s smart contracts, rather than targeting specific countries, individuals, or service providers. This marked a unique case where the sanctions directly addressed the smart contracts themselves, autonomous lines of code operating on the Ethereum blockchain.

This action sparked widespread debate about whether OFAC had exceeded its statutory authority by adding Tornado Cash to the Specially Designated Nationals list. Critics argued that the platform’s self-executing, open-source nature placed it outside the scope of what is legally sanctionable under existing regulations.

2024: U.S. Appeals Court Ruling

On November 26, 2024, an appellate judge ruled that the Treasury Department overstepped its authority in 2022 when it sanctioned Tornado Cash. The ruling supported the plaintiffs' argument that immutable smart contracts, which operate without direct human control, do not qualify as "property" under the Act.

Why Immutable Smart Contracts Are Not Property

In 2020, more than a thousand volunteers contributed to a "trusted setup ceremony" for Tornado Cash, aimed at permanently eliminating the possibility of anyone modifying, removing, or gaining control over the code.

Under the International Emergency Economic Powers Act, the President is permitted to “block any property in which any foreign country or a national thereof has any interest.” Although the statute does not define “property,” property has a plain meaning: It is capable of being owned. 

Property, by definition, is something that can be owned, controlled, and from which others can be excluded. Immutable smart contracts, once deployed on a blockchain, are beyond the control of any individual or entity, including their creators. They operate autonomously, executing code in response to user inputs without requiring -or permitting - human intervention. The inability to own or exclude others from using these contracts fundamentally disqualifies them from being considered property under legal frameworks such as the International Emergency Economic Powers Act. Ownership presupposes the capacity to exercise dominion or control, a characteristic entirely absent in Tornado Cash immutable smart contracts. 

Why Immutable Smart Contracts Are Not Contracts

The immutable smart contracts, regardless of their misleading name, are not “contracts” under OFAC’s definition of “property.” These contracts cannot be understood as contracts in the legal sense. 

A contract requires an agreement between two or more parties, predicated on mutual consent, offer, acceptance, and consideration. Immutable smart contracts lack these essential elements. They function as self-executing programs that respond to predefined conditions without any party agreeing to terms or entering into negotiations. Once a smart contract is made immutable, its developers relinquish all control, and it ceases to involve any ongoing relationship or obligations between parties. While mutable smart contracts might facilitate contracts by allowing for negotiations or alterations, immutable contracts, by definition, are static and incapable of forming the dynamic agreements characteristic of enforceable contracts.

Why Immutable Smart Contracts Are Not Services

The Department of the Treasury argued that the immutable smart contracts provided "services," but the court rejected this, clarifying that the contracts are tools used to facilitate services rather than services themselves.

A service typically involves human effort directed at performing a useful act for another party, often in exchange for compensation. Immutable smart contracts, however, are merely lines of code executing prewritten instructions. They do not perform acts in the sense of human effort; rather, they function as tools employed by users to achieve specific outcomes, such as pooling or mixing digital assets. These contracts enable users to utilize their functionality but do not provide services in the traditional sense because there is no provider actively offering or overseeing their use. They are more akin to automated tools, operating independently of any service provider once deployed.

Other Considerations

It is crucial to emphasize that the court's ruling specifically confirms that immutable smart contracts cannot be sanctioned. However, this decision does not shield mutable contracts, individuals, or entities misusing Tornado Cash from legal liability. While the smart contract itself is not considered sanctionable as "property," those who use it for illicit activities remain fully subject to prosecution. In essence, the ruling draws a clear distinction: the code, as an autonomous entity, cannot be sanctioned, but any misuse of it can and will be prosecuted.

The full impact of this ruling remains unclear. It could prompt stronger legislative initiatives or reignite debates about the balance between privacy and national security. What is certain, however, is that the ruling underscores challenges in how U.S. law addresses modern technologies. From a legal perspective, it is likely that Congress will either amend the International Emergency Economic Powers Act or introduce new legislation to address the complexities of emerging technologies. Until such changes occur, immutable protocols may continue to operate in a legal grey area, beyond the scope of sanctions traditionally designed for "property" or foreign entities.

Conclusion

The recent ruling overturning the 2022 sanctions on Tornado Cash's smart contracts aligns with the industry's longstanding argument against sanctioning code itself. The decision establishes that immutable smart contracts, due to their autonomous nature and lack of ownership, fall outside the scope of sanctionable "property" under current U.S. legal frameworks. This ruling echoes earlier critiques that targeting autonomous code may overstep regulatory authority and infringe on innovation and privacy rights.

However, this legal clarity on immutable smart contracts does not address the accountability of developers. The ongoing case of Roman Storm, a Tornado Cash developer, exemplifies this gap. It highlights unresolved questions about how developer liability will be determined, especially when their work enables both legitimate and illicit use.

In conclusion, while the court's decision represents a significant step toward differentiating between immutable technology and its misuse, it leaves critical issues unresolved. The balance between encouraging innovation and ensuring accountability will likely depend on future legislative action and ongoing legal cases, such as Roman Storm's, which will shape the broader regulatory landscape for decentralized technologies.