Updated: OFAC Issues Sanctions Against Virtual Currency Mixer Tornado Cash | Practical Law

Updated: OFAC Issues Sanctions Against Virtual Currency Mixer Tornado Cash | Practical Law

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) announced economic sanctions against virtual currency mixer Tornado Cash, which, according to OFAC, was used to launder more than $7 billion.

Updated: OFAC Issues Sanctions Against Virtual Currency Mixer Tornado Cash

Practical Law Legal Update w-036-6249 (Approx. 6 pages)

Updated: OFAC Issues Sanctions Against Virtual Currency Mixer Tornado Cash

by Practical Law Finance
Published on 16 Aug 2022 • USA (National/Federal)
The US Department of the Treasury's Office of Foreign Assets Control (OFAC) announced economic sanctions against virtual currency mixer Tornado Cash, which, according to OFAC, was used to launder more than $7 billion.
On August 8, 2022, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) announced economic sanctions against virtual currency (VC) mixer Tornado Cash, which, according to OFAC, has been used to launder more than $7 billion since its creation in 2019. In a related statement, US Secretary of State Anthony Blinken noted this amount includes $600 million laundered for Lazarus Group and APT38, North Korean state-sponsored hacking groups. The sanctions were imposed pursuant to Executive Order 13694, as amended (EO 13694) and come after the first ever sanctions issued against a VC mixer, Blender.io, were announced in May 2022 (see Legal Update, OFAC Issues First Sanctions Against Virtual Currency Mixer).
Tornado Cash operates on the Ethereum blockchain and facilitates transactions without determining the origin of the transaction or clarity around the destination or counterparties to the transaction. VC mixers like Tornado Cash and Blender.io work under the pretext of providing increased privacy to transaction participants. They mix various transactions before transmitting them on to individual recipients. As with Blender.io, OFAC asserts Tornado Cash assisted in conducting illicit transactions that posed a threat to US national security interests by aiding the conduct of financial activity by North Korea.
Tornado Cash was added to OFAC's List of Specially Designated Nationals and Blocked Persons (SDN List) pursuant to EO 13694. This designation means US persons are prohibited from engaging in transactions with Tornado Cash and that all of the property in which it has at least a 50% percent ownership interest is blocked. Any financial institution or other person engaging in blocked transactions or activities with a blocked entity may expose itself to sanctions or enforcement action (see Practice Note, OFAC Economic Sanctions: Cryptocurrency and Blockchain).
EO 13694 authorizes US economic sanctions for a party that engages in activity that has the purpose or effect of causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, or financial information for commercial or competitive advantage or private financial gain (see Legal Update, New Executive Order Authorizes OFAC to Impose Sanctions on Perpetrators of Malicious Cyber Threats).
Update – Coinbase-backed lawsuit: On September 8, 2022, six users of Tornado Cash filed a complaint in the US District Court for the Western District of Texas, Waco Division, accusing OFAC and the Department of the Treasury of violating their constitutional rights to free speech and overstepping their authority in sanctioning the cryptocurrency mixer, instead of a person or an entity. The complaint specifically asserts that while OFAC has certain authority to impose economic sanctions, its jurisdiction does not extend to software code and smart contracts as used by Tornado Cash.
The largest US based crypto exchange Coinbase is funding the lawsuit. In a blog post on its website, Coinbase CEO and cofounder Brian Armstrong indicated that the sanctions threaten the future of DeFi, and web3 specifically. He expressed three concerns:
  • The Department of Treasury could have used a more nuanced approach to sanctioning bad actors than sanctioning open source software because doing so punished innocent people and results in less privacy and security. Armstrong reasoned that "sanctioning open source software is like permanently shutting down a highway because robbers used it to flee a crime scene."
  • The Department of Treasury was empowered by the US Congress to sanction people, not software.
  • Sanctioning software will have a chilling effect on innovation because the sanctions imply that software developers will be held responsible for how software is used, when they have no power to control it.
Armstrong noted that in its role as one of the largest crypto companies, Coinbase has a responsibility to safeguard the industry against administrative overreach and actions that treat crypto unfairly.
Update – Coin Center: On October 12, 2022, Coin Center, a cryptocurrency-focused nonprofit organization, filed a complaint in the US District Court for the Northern District of Florida, Pensacola Division, against the Department of the Treasury and OFAC for adding Tornado Cash to OFAC's SDN List. According to the complaint, Coin Center used the Ethereum blockchain, including the Ethereum addresses that constitute the core of Tornado Cash's tool, and asserted it would have continued to use Tornado Cash but for the sanctions.
Coin Center asserts the actions of Treasury and OFAC are unlawful on four grounds, which are that the criminalization of Tornado Cash:
  • Exceeded the agencies' statutory authority under 50 U.S.C. §1702(a)(1) because Tornado Cash completes functions that do not include “any property in which any foreign country or a national thereof has any interest."
  • Exceeded the agencies' regulatory authority under 31 C.F.R. §578.201(a) because Tornado Cash is not a person.
  • Is arbitrary and capricious under 5 U.S.C. §706(2)(A) because the agencies:
    • Did not consider that the actions against Tornado Cash would subject people to criminal liability without any voluntary action on their own part;
    • would result in a deprivation or seizure of the assets of Americans who had moved funds to a Tornado Cash address but not yet released them, without any constitutionally required process;
    • would discourage expressive associations and the inhibit the right of Americans to write and publish code freely;
    • changed their position as to whether they could sanction a technology, not controlled by any persons. without explanation; and
    • defied their own cyber-related sanctions rule on prohibited transactions, 31 C.F.R. §578.201(a), requiring them to exercise their sanctioning power only in matters involving "persons" by acting against Tornado Cash, which, Coin Center asserts, is a technology.
  • Violated the constitutional rights of Tornado Cash users who utilize it to protect their privacy.
Coin Center requests an order removing Tornado Cash from OFAC's SDN list.
Update - redesignation: On November 8, 2022, OFAC delisted and then redesignated Tornado Cash on SDN List under EO 13694, as amended, and Executive Order 13722 for the same reasons that it was originally designated but based on additional information as well as its obfuscation efforts that OFAC asserts are specifically benefitting the Democratic People's Republic of Korea (DPRK) weapons program.