On August 8 2022, the U.S. Office of Foreign Assets Controls (OFAC) sanctioned “crypto-mixer” Tornado Cash, alleging that more than $7 billion worth of virtual currency had been laundered through the protocol since it began operating in 2019, including over $455 million by the North Korean state-sponsored hacking group, the Lazarus Group (sanctioned by OFAC in 2019). In addition to sanctioning the Tornado Cash protocol and URL, OFAC also sanctioned several large wallets associated with Tornado Cash.
Unlike previous designations of wallet addresses, individuals, and entities (including the mixer, Blender.io), Tornado Cash is a decentralized, self-executing smart contract protocol. In fact, a lawsuit has been filed on behalf of users of the service challenging the Tornado Cash designation on the basis that it does not qualify as an entity, property or person. Moreover, the designation has also left many virtual asset service providers as well as ordinary users with questions about what to do with funds sitting in the Tornado Cash pool, or how to deal with cryptocurrencies which may have flowed through Tornado Cash. The designation has nonetheless spurred significant interest and concern within the space about how to comply with sanctions related to cryptocurrencies. (See analysis and our comments on this here: FT Cryptofinance: DeFi is DeFi Until Washington Says it’s Not).
OFAC “Tornado Cash” FAQs
According to OFAC, although the Tornado Cash website has been deleted, it remains available through Internet archives. OFAC clarified that, without “additional facts,” it would not be a sanctions violation to visit the internet archives for the Tornado Cash historical website, or to otherwise interact with the open-source code (for example, “making it available online for others to view, as well as discussing, teaching about, or including open-source code in written publications, such as textbooks”). It would also not be a violation to merely visit the Tornado Cash website, if it were to become active again.
OFAC clarifies that the sanctions prohibit U.S. persons from “engaging in transactions with” Tornado Cash, or with one of the listed wallet addresses (unless otherwise exempt or authorized by OFAC). In particular, U.S. persons which sent funds to Tornado Cash prior to its designation must apply for a specific license from OFAC to withdraw the assets. Provided there is no other sanctionable conduct, OFAC will apply a favorable licensing policy. Interestingly, OFAC also clarifies that the prohibitions technically apply to the so-called “dusting” transactions (i.e., the unsolicited receipt of virtual assets from Tornado Cash), and therefore recipients must file a blocked property report and may need to seek a corresponding license to deal with the funds. However, OFAC will not prioritize enforcement for any delays in doing so, to the extent that these “dusting” transactions have no other sanctions nexus.
Although numerous questions remain (such as whether miners should confirm blocks containing a Tornado Cash transaction), and virtual asset service providers are taking different approaches, these FAQs provide welcome clarification for ordinary users affected by the Tornado Cash designation.