The founders and developers of Tornado Cash, an open-source tool for privacy preservation on Ethereum, are facing accusations of money laundering and violations of US sanctions in the United States.
The crypto "mixer" Tornado Cash is once again in the headlines. A year ago, the US Department of the Treasury made history by adding the protocol to the sanctions list as the first smart contract. Shortly after, Tornado Cash developer Alexey Pertsev was arrested in the Netherlands. Pertsev remained in a Dutch prison until April 2023 before being placed under house arrest by the authorities. Now, the Southern District of New York has formally released an indictment against the two co-founders, Roman Storm and Roman Semenov.
Money laundering and violations of US sanctions
The charges revolve around alleged money laundering activities and violations of US sanctions. The indictment relates to the founding, operation, and promotion of Tornado Cash. The protocol is alleged to have facilitated over $1 billion in money laundering transactions to date. Among others, the sanctioned North Korean cybercrime organization Lazarus used the project to obfuscate stolen funds. The defendants were alleged to have known that the Tornado Cash service they operated was involved in these sanction-violating transactions.
While Tornado Cash blocked various cryptocurrency addresses on the web-based frontend since OFAC linked transactions to the North Korean hacker group Lazarus, the open-source code is stored in an immutable smart contract that was singled out for sanctions by the authorities.
Abuse of open-source software
The open-source protocol of Tornado Cash functions by mixing multiple transactions to obscure the original source of funds, thereby providing users with anonymity. Although the founders created the tool with the intention of improving privacy in the Ethereum ecosystem, fraudulent actors also misused the service for illegal activities.
The US authorities are now holding the founders of Tornado Cash accountable for the consequences of their open-source software. This accusation raises various legal and ethical questions. After all, smart contracts on the Ethereum blockchain are immutable and are operated by a decentralized network of nodes. As a result, there has been a public outcry from the open-source community.
Privacy is a fundamental human right. The same goes for financial privacy.
If all the Tornado Cash devs did was write code, their arrest is an infringement on those rights.
— Coin Bureau (@coinbureau) August 24, 2023
The US Department of Justice has not released further details about the specific cases of abuse or the extent of the alleged violations. Smart contract developers will now have to closely monitor the developments of the case. The process will undoubtedly set a precedent for future lawsuits against other open-source software and their founders.
