Tornado Cash and the future of crypto privacy: Legal shifts and onchain implications

Tornado Cash has been removed from the U.S. sanctions list, raising big questions about code, privacy, and crypto regulation.

Tornado Cash is back in the news.

On March 21, the status of the crypto mixer was updated by the Treasury Department’s Office of Foreign Assets Control (OFAC): from blacklisted to... well, not blacklisted?

Tornado Cash was launched in 2019 as a mixer or a way for crypto users to obfuscate their onchain activity and introduce a layer of privacy to transactions that would otherwise be visible on a blockchain’s public ledger.

Notably — and this is something we’ll circle back to — Tornado Cash was built by its developers to be open source, Ethereum Virtual Machine-compatible, permissionless, and non-custodial.

At its core, Tornado Cash uses immutable smart contracts and zero-knowledge proofs to “mix” or shuffle transactions in a way that makes them untraceable. From the outset, the project was governed by a decentralized autonomous organization (DAO), not by a traditional company or centralized group of individuals.

There are obvious privacy implications to this kind of technology. A product like Tornado Cash — or other mixers offering similar services — can provide a critical privacy layer for people who regularly transact on crypto networks.

Without privacy tools, all crypto transaction details are recorded on a public ledger, viewable by anyone. This transparency has benefits. But it also raises concerns — especially when crypto is used for everyday transactions like receiving paychecks or making routine purchases. Over time, these visible patterns can reveal identifying details, opening the door to exploitation.

Conceptually, this isn’t so different from using a traditional payment service like Venmo. Each time someone uses Venmo — an app that simplifies interbank transfers — they can choose to make the transaction public or private.

But there are crucial differences. Venmo requires a regulated bank account. Tornado Cash is accessible to anyone with an internet connection.

You can probably see where this is going.

Criminal organizations find a lot of utility in privacy-mixing services.

In 2022, OFAC added Tornado Cash to its sanctions list, making it illegal for U.S. citizens, residents, and companies to use the service (and by implication anything resembling it).

At the time, the government accused the Tornado Cash project of laundering billions on behalf of international hacking groups.

The developers behind Tornado Cash were arrested and are still facing legal fallout, including charges related to money laundering and facilitating the concealment of criminal funds in both the U.S. and Europe.

All of this is a long way of saying: it’s a big deal that the Treasury Department has reversed course and removed Tornado Cash from OFAC’s sanctions list.

What’s most interesting about the case (as with many legal cases, actually) are the deeper implications for privacy technologies, and for the people who write and publish code on the internet.

One of the reasons cited for the recent reversal is that, through a series of legal proceedings, it became clear the technology itself (a series of smart contracts) doesn’t possess ownership status.

In other words, a recent U.S. appeals court decision made it clear: the code itself isn’t legally responsible.

What remains unclear is what that means for the people who built and launched the project. At least three of Tornado Cash’s core developers are facing serious money laundering-related charges in the U.S. One is already serving a five-year prison sentence in the Netherlands. The U.S.-based court cases are scheduled for this summer.

These proceedings have triggered countersuits from groups like the Electronic Frontier Foundation and others focused on privacy rights.

This shift in stance by the Treasury, as well as the future implications for onchain privacy tools designed for regular users, came into focus for me this week while working on the Open Money Project.

I just finished section (or chapter) four of the project, and it's becoming increasingly clear: one of the biggest unresolved tensions in onchain activity is the push-pull between transparency and privacy.

At a macro level, the public nature of blockchain transactions and the creation of analytics platforms that can dissect them does introduce a form of sunlight-as-disinfectant.

But at the micro (individual) level, having your entire personal financial history made public by default opens up new forms of surveillance and targeting.

This is just the beginning. The transparency vs. privacy debate is only going to grow as onchain activity scales, and as data analytics tools increase in fidelity.

That’s why, even if we’re not directly concerned with mixer tech, or the nuances of code ownership—the foundational question of how to build privacy controls into onchain systems needs to be front and center.

It’s one of those domains that will likely get more turbulent, and more contentious, before any resolution emerges.