As legal action picks up, the crypto industry is increasingly uncertain about potential fallout from recent sanctions against mixing service Tornado Cash.
In August, Tornado Cash — allegedly used to launder stolen funds linked to major hacks — was added to the Office of Foreign Asset Control’s Specially Designated Nationals (SDN) list, along with 45 associated Ethereum wallet addresses.
Complying to the sanctions and parsing out what this means for the future of the crypto industry, especially with regards to privacy, has been a challenge, industry members said.
Around 92% of the crypto ecosystem has exposure to Tornado Cash, Liat Shetret, director of global policy and regulation at Elliptic, reported during a Blockworks’ webinar Thursday.
“What that’s meant on the ground for crypto businesses is that their rate of false positives skyrocketed because once the sanctions dropped on Tornado Cash, then they were really immediately obligated to not have any kind of exposure to Tornado Cash,” Shetret said. “And yet that remains a little bit gray, depending on OFAC language and how folks interpret it.”
The Treasury alleges that North Korea-sponsored hacking collective Lazarus Group, which in March stole over $620 million in cryptocurrency from the Ronin Bridge protocol, attempted to conceal the origin of the funds with Tornado Cash. Blockchain analytics firm Chainalysis agrees.
“OFAC’s designation of Tornado Cash is a crucial moment in the fight against cryptocurrency-based crime,” a Chainalysis report said. “For one thing, it’s especially timely: More cryptocurrency is being stolen than ever, and in almost every hack we’ve observed this year, Tornado Cash has received at least some of the stolen funds.”
Regardless of the users employing Tornado Cash for legal reasons, lawmakers generally have a hard time justifying any use of the technology, according to lobbyists.
“Unfortunately, the national security hawks in Congress way out number the privacy hawks, and by a very large portion,” Ron Hammond, director of government relations at the Blockchain Association, said during the webinar. “Capitol Hill will always be more about taking more privacy rights slowly away in the name of national security.”
Cryptocurrency investors and users with ether locked in Tornado Cash moved forward with a lawsuit against OFAC Thursday, arguing that the regulatory authority overstepped its power by sanctioning the software. The legal effort is being funded by Coinbase, which is fighting regulatory battles of its own as uncertainty around token classification continues.
The suit, filed in federal court in the Western District of Texas, features six plaintiffs: Coinbase employees Tyler Almeida and Nate Welch, Prysmatic Labs co-founder Preston Van Loon, GridPlus engineer Kevin Vitale, Ethereum proponent and angel investor Alex Fisher, and former Amazon engineer Joseph Van Loon.
“To sanction a software is a very unique and interesting piece, and we’ve seen that the aftermath of this OFAC now has been delivered with a suit against them…so we’re gonna see a legal battle,” Shetret said. “I’m really quite desperate about this topic because it’s huge. It’s a massive issue and I think it’s really caused a lot of confusion.”
It’s not the first time OFAC has sanctioned a cryptocurrency mixer. In May, officials targeted Blender.io, a centralized service Lazarus Group also allegedly used to conceal stolen funds. But Tornado Cash is different, some experts say.
“Blender.io was designated back in May of this year, but it’s different and in a pretty meaningful way, which is that was a centralized custodial service and [Tornado Cash]…is just code,” Michael Mosier, former deputy chief in the Department of Justice’s money laundering and asset recovery section, said during a Twitter Spaces discussion last month.
“Just because Tornado Cash is now sanctioned, all that activity, it may be lulled for a day or two, but the [mixing] activity has spiked back up again on a variety of other platforms,” Shetret said. “The activity has not stopped, it’s just moved.”