On August 8, 2022, the Office of Foreign Assets Control of the United States Department of the Treasury (“OFAC”) sanctioned Tornado Cash, a virtual currency mixer that operates on the Etherium blockchain. By adding Tornado Cash to its Specially Designated Nationals list (“SDN list”), OFAC effectively banned Americans from using the service. In announcing the sanctions, OFAC pointed to what it alleged was Tornado Cash’s involvement in the laundering of more than $7 billion worth of virtual currencies since the crypto mixer’s creation in 2019. On August 10, 2022, authorities in the Netherlands arrested an individual suspected of being one of the developers of Tornado Cash in connection with what Dutch Fiscal Information and Investigation Service (“FIOD”) described as “concealing criminal financial flows and facilitating money laundering through the mixing of cryptocurrencies.”
Background
Cryptocurrency mixing services like Tornado Cash mix potentially identifiable cryptocurrency funds with others in private pools before transferring the funds to receivers. The resulting disconnect between the funds deposited by the user and the funds withdrawn by the user seeks to obfuscate the audit trail of cryptocurrency transactions. Notably, these services are provided in the absence of any know-your-customer (“KYC”) procedures or any other effort to determine the origins of the funds. OFAC noted that although the ostensible reason for these mixers is to increase privacy, mixers like Tornado Cash are frequently used to launder funds obtained during malicious cyber activities.
According to the OFAC announcement, Tornado Cash was used to launder billions of dollars’ worth of virtual currencies over the past three years, including $455 million stolen by a state-sponsored North Korean hacking group (itself a sanctioned entity) in 2019, and over $100 million in funds stemming from two different malicious cyber actions earlier this year. The Dutch authorities’ announcement hewed to largely the same allegations, highlighting the North Korean group’s alleged use of the mixer and referencing OFAC’s sanctions days earlier. The unnamed suspect, referenced only as a 29-year-old man in line with Dutch privacy regulations, was to have been brought by an examining judge on August 12.
OFAC’s designation of Tornado Cash prohibits, among other things, transactions by U.S. persons involving any property or interests of Tornado Cash, essentially preventing Americans from using the service at all.
The action was the second OFAC sanctions designation of a currency mixer this year, following the May 6, 2022 designation of Blender.io (“Blender”). Additionally, in 2020, the Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) assessed a $60 million civil monetary penalty against Larry Dean Harmon, the CEO of Coin Ninja, another mixer, for violating the Bank Secrecy Act, and the Department of Justice charged Harmon with operating an unlicensed money transmitting business. Harmon pled guilty to participating in a money laundering conspiracy in 2021 and has yet to be sentenced.
Key Takeaways
OFAC Latest Actor to Take Substantial Steps. While bipartisan legislation that would set rules new for cryptocurrency and place such oversight primarily with the Commodity Futures Trading Commission was introduced last month, it is unlikely to be acted upon prior to the midterm elections. The Tornado Cash sanctions are the latest sign that other government actors are not waiting, but rather aggressively entering the void, seeking to make the case that their traditional law enforcement and regulatory mandate provide ample justification for regulating the crypto sector.
For example, less than a month ago, the SEC charged three individuals with insider trading related to public announcement that certain digital assets would be listed on the cryptocurrency exchange Coinbase, and in doing so asserted that certain of those assets were securities under SEC v. Howey Co., 328 U.S. 293 (1946) for purposes of the Rule 10b-5 charges. The charges—which, in addition to requiring the SEC to prove the traditional elements of insider trading, further require the SEC to prove that the assets were securities—were a further demonstration of the SEC’s intense skepticism of the cryptocurrencies, which SEC Chair Gary Gensler compared to the “Wild West” in public remarks in August 2021. More recently, on August 9, 2022, the SEC announced charges against a company for conducting an unregistered initial coin offering of crypto asset securities, which included a springing penalty of up to $30.9 million if it does not register the coins under the Securities Act subject to narrow exceptions—a development further reflective of the Commission’s view that most forms of digital assets are securities that must comply with onerous registration obligations before being made available to investors. In late 2021, the Department of Justice launched its National Cryptocurrency Task Force, which has claimed a number of visible prosecutions since that time, including wire fraud charges in the Coinbase case. And in April 2022, the New York State Department of Financial Services issued guidance to virtual currencies under its jurisdiction that emphasized the importance of KYC-related controls, sanctions screening and transaction monitoring.
OFAC released its own guidance for the virtual currency industry in October 2021, and the Tornado Cash and Blender sanctions demonstrate OFAC’s willingness to act on that guidance and enforce sanctions regulations in the crypto context. That OFAC is taking aim at mixers whose ostensible purpose is to increase privacy is important, as for many crypto users—legitimate and illicit alike—the primary appeal of cryptocurrency is enhancing privacy and avoiding intrusive government oversight.
Taking Aim at Technology. While OFAC’s announcement of the sanctions refers to Tornado Cash as an “entity,” the actual “entity” entry added to the SDN list would be unrecognizable to an observer of sanctions developments two decades ago. The listing consists mostly of addresses on the Etherium blockchain—sequences of what appear to an outside observer to be randomly generated letters and numbers. The listing and some of its practical applications prompt questions about whether OFAC has sought to sanction an “entity” or a form of technology.
To be clear, Tornado Cash has some of the trappings of both. Its developers appear to exist as a DAO—a “decentralized autonomous authority”—with no centralized leadership. There does not appear to be a conventional business attached to it that can be shut down—a feature that distinguishes it from Blender, which had a centralized custodial service. The leadership structure mirrors some aspects of the mixer itself, which is built on a decentralized framework and exists primarily as code. In light of this, it may well be that the designation of Tornado Cash tests the term “sanctioned entity” as never before.
Ransomware Implications. On September 21, 2021, OFAC issued guidance intended to highlight the sanctions risks associated with ransomware payments. The core of that guidance was a message to potential ransom payers: the risks included in paying ransom or extortionate demands to hackers was the possibility of making payments to sanctioned entities, including state-sanctioned bad actors in Russia, North Korea and other national security problem areas—potentially creating culpability for the victims of ransomware attacks. OFAC’s sanctioning of crypto mixers adds another layer to these concerns. If a ransomware victim is instructed to pay using technology that involves a sanctioned mixer, it is possible that both the payee and the method of payment may give rise to sanctions liability. As OFAC instructed in its September 2021 guidance, reporting ransomware attacks as soon as possible and moving in tandem with the relevant government agencies may be the best way to avoid a negative enforcement response in such circumstances.
Increased Crypto Policing Efforts. The sanctioning of Tornado Cash adds to the mounting interest on the part of the federal government in policing the crypto space. The arrest of the suspected developer in the Netherlands underscores that American authorities are not alone in their heightened interest. And the targeting of a mixer that may serve to expand the very notion of a sanctioned entity suggests the degree to which not only cryptocurrency regulations, but the regulated, are also an expanding frontier.