As of today, Tuesday August 9, any US citizen caught using cryptocurrency mixing protocol Tornado Cash is in breach of sanctions law and could face millions in criminal charges or even jail time.
The US Office of Foreign Assets Control (OFAC) placed the Ethereum-based privacy protocol on the official sanctions list under suspicions that over US$7bn was laundered through the protocol since 2019.
Cited in the allegations were over US$455 in funds stolen by North Korean state-sponsored hackers and US$96mln stolen from the Harmony Bridge Heist.
“Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States,” read the press statement.
The statement continued: “Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks.
Tornado Cash founder Roman Semenov was booted from Github, the official website has been taken down, and TORN token fell by 30% in a day.
My @GitHub account was just suspended ????
Is writing an open source code illegal now?
— Roman Semenov ????️ ???????? (@semenov_roman_) August 8, 2022
Now what happens?
What is Tornado Cash?
While the sanctions come as a surprise, few were shocked by the latest clampdown.
Tornado Cash, In industry parlance, is (was?) what’s known as a “mixer”.
Mixers facilitate anonymous crypto transactions by “obfuscating their origin, destination, and counterparties, with no attempt to determine their origin,” according to OFAC.
In slightly more technical terms, Tornado Cash employs the use of “zero-knowledge proofs”, which are algorithms allowing for transactions to be processed without linking the transaction back to the sender.
The mixing element comes into play as such:
Pru wants to send Barry 1 ETH
That’s easy enough to trace, but what if:
Pru wants to send Barry 1 ETH
Matt wants to send Billy 1 ETH and
Sloane wants to send Maddy 1 ETH
With a mixer, we can theoretically jumble these transactions up, and the end result is the same!
Tornado Cash expands this trick out to many thousands of transactions, making third-party traceability essentially impossible.
It’s extremely clever in its simplicity, but is it ethical?
Certainly not according to OFAC, but many within the crypto community aren’t necessarily big fans either, not least due to the open secret that Tornado Cash was a breeding ground for criminal behaviour.
The ethics of Tornado Cash
One of the founding principles of Bitcoin and by extension cryptocurrency is “Don’t trust, verify”
Our bank statement is "don't trust, verify"
— Bitcoin (@Bitcoin) June 21, 2020
Since Tornado Cash transactions cannot be verified by anyone, doesn’t it go against one of the key crypto commandments?
I’d argue in favour of that, for anonymity and pseudonymity are two different principles; while the latter is central to crypto, the former is not.
There is also a legal question: Tornado Cash is not a company, a country, individual, and certainly not an aircraft – it’s a piece of open-source code – so how does it fit into the sanctions list?
OFAC has worked around this by banning not the entity itself, but the smart contracts that make up the platform.
This has at least some precedent in that Bitcoin addresses of known criminals have regularly been added to the sanctions list in the past.
But unlike Bitcoin addresses, a smart contract address is not owned by an individual; it is a neutral piece of code.
The legal debate over placing sanctions on smart contracts is sure to be one to watch.
Vitalik (partially) defends Tornado Cash
Ethereum founder Vitalik Buterin has come out in quasi defence of Tornado Cash, Tweeting that the protocol proved useful in donating to the Ukrainian war effort.
Herein lies one key defence of the protocol: Could a platform that allows people to skirt authoritarianism and channel funds to people in need really be so bad?
When weighing up the positive and the negatives, the scales will, undoubtedly, lean to one side or another depending on the individual.
Privacy coins in the spotlight
Tornado Cash is far from the only privacy protocol available to bad (and good) actors.
The multi-billion-dollar Monero coin uses different algorithms (called “ring signatures”) to achieve the same result as Tornado Cash.
ZCash, on the other hand, uses the same zero-knowledge proof method as Tornado Cash to obfuscate transactions.
These are both popular privacy coins, but a far bigger – nay the biggest – crypto platform could also be looking into zero-knowledge proofs.
Ethereum’s head honcho Vitalik Buterin has been talking up zero-knowledge proofs from as far back as 2017, and with the Ethereum Foundation’s constant tinkering with and upgrading of the underlying Ethereum technology, perhaps they are in the pipeline.
Whether OFAC will follow with sanctions in tow is anyone’s guess.