Tornado Cash: The Legal Storm Upsetting the Cryptocurrency World

On 3 June, Vitalik Buterin donated 30 ETH (USD 113,000) to Juicebox, the legal aid fund for the founders of Tornado Cash: Alexey Pertsev and Roman Storm. The two computer scientists were charged with money laundering, the first by Dutch authorities, the other by American ones. Let us try to retrace the story to understand the deeper meaning of this technical tool and its political and legal implications.

In recent years, the debate on data processing and how it can be protected in respect of privacy has become central. Cryptocurrencies have been seen in this context as a means to maintain anonymity. In reality, most blockchains, including Ethereum and Bitcoin, can be defined as a public and transparent transaction ledger, where every transaction cannot be changed. This means that, in reality, on these blockchains users are not really anonymous as they are identified by their public address.

So if you can link that address to an individual or a company, you can have the entire financial history of that person at your disposal. In a way, in the name of transparency, something very important has been sacrificed: privacy. Obviously, there are methods to prevent the public address - i.e. the cryptocurrency container of a person - from being linked to a specific IP address, for instance many computer scientists use Tor, a browser that allows anonymous web surfing. Tornado Cash thus meets a need, that of protecting one's privacy.

What is Tornado Cash?

Tornado Cash is a crypto mixer or, rather, a series of smart contracts, i.e. an open source programme that lives on Ethereum's blockchain. Tornado Cash gives users the possibility to put their cryptocurrencies into a central pool - a kind of safe - and withdraw them later using a mechanism that exploits zero-knowledge proof, through which anonymity is guaranteed.

Events that Lead to Sanctions Against Tornado Cash

In June 2022, one hundred million dollars were stolen from the Harmony Blockchain, a week later, this attack was linked to the North Korean hacker group Lazarus. It would appear that the Lazarus attackers were then able to use Tornado Cash to launder the proceeds of those hacks. And this is precisely why the Treasury Department's Office of Foreign Asset Control (OFAC) decided to sanction Tornado Cash and various Ethereum and USDC wallets associated with this crypto mixer. In fact, USDC issuer Circle froze seventy-five thousand dollars of funds linked to Tornado Cash addresses. According to OFAC, Tornado Cash has been used for money laundering by various criminal syndicates.

OFAC claims that approximately seven billion dollars have been laundered; however, it should be pointed out that seven billion is the entire amount of money that has passed through Tornado Cash and therefore it cannot be assumed that all of it has come from criminal activity.

After a few days, on 10 August 2022 to be precise, the young Russian computer scientist Alexey Pertsev was questioned. The latter was accused by the FIOD - Dutch Tax Investigation Department - of aiding and abetting money laundering. Alexey has participated in various Ethereum hackathons over the years and has published open source code under his own name. In 2018, he founded a company called PepperSec alongside two other developers - Roman Semenov and Roman Storm. Much of Tornado Cash's code was made by these very computer scientists. Semenov, after his colleague's arrest, stated that his account on GitHub, a site where open source code is published, was closed.

Previously, other centralised cypto mixers such as Blender had been sanctioned; however, it should be pointed out that the case of Tornado Cash is different, precisely because it is decentralised and therefore almost impossible to censor definitively.

Independent of the control of any developer or central authority, it cannot be stopped; to do so would require 'shutting down' the entire Ethereum blockchain.

We would point out that even if Tornado Cash was taken down, as the code is public, it could be copied for the creation of an identical crypto mixer. Obviously, there are ways to prevent, or at least complicate, access to Tornado Cash, and Alchemy and Infura, two important node providers - i.e. nodes that serve to interface with the Ethereum blockchain - have blocked access to the crypto mixer in question.

The arrest of Pertsev caused such outrage that there was even a protest in the centre of Amsterdam in support of the young computer scientist. However, a few days later, more charges were brought against Pertsev. In fact, according to the intelligence firm Kharon, Pertsev worked for the Russian-based Digital Security OOO in 2017. The US Treasury sanctioned the company in 2018, alleging that it had engaged in dealings the Federal Security Service (FSB) of Russia since 2015.

However, so far, no evidence has been provided of an alleged direct connection between PepperSEC - a company founded by Pertsev - and Digital Security OOO, nor between PepperSec and Russian intelligence agencies. The Russian computer scientist's wife, Ksenia Malik, denied that her husband had any such connection, and in an interview with CoinDesk said that Pertsev: "He has never been associated with the FSB in Russia or similar organisations."

Roman Storm, on the other hand, was arrested on 23 August 2023 in Washington state. The arrest followed charges of conspiracy to commit money laundering, sanctions violations, and operating an unauthorised money transmission business. In a video posted on his X page Roman asks for help:

"2024 is the year that will define the rest of my life. Honestly, I'm scared. But also hopeful that this community cares with a passion. Please donate towards my legal defence (https://wewantjusticedao.org)."

In addition, Roman thanks Vitalik for the financial contribution he received:

The European Parliamentarian Patrick Breyer also spoke out on the Tornado Cash affair, stating in a parliamentary statement:

"The anonymity we enjoy when using cash, which protects our financial freedom, must not be criminalised when applied to digital currencies"

Both Breyer and Snowden repeatedly said: 'Privacy is not a crime'. Snowden also reposted Roman's video, asking for help for his colleague.

It should be noted that Tornado Cash can be used by anyone in order to remain anonymous, even for purposes that go against Russian interests. Vitalik Buterin, in fact, stated that he used this programme precisely to send money anonymously to the Ukrainian government. So the accusations of collaborating with Putin's government do not seem logically plausible, although they cannot be ruled out a priori.

Edward Snowden called the decision to censor Tornado Cash highly illiberal and authoritarian. Indeed, one has to ask whether it can be considered illegal to write computer code. And above all, what sense does it make, since one wants to carry out an illegal activity, to publish that code under one's own name, which is what Pertsev did. From this point of view, Dutch law would seem to have fewer protections for computer scientists than US law.

American Open Source Code Legislation

In the US, open source code is protected by the First Amendment. These protections were made possible by Daniel J. Bernstein, a professor at Illinois University, who brought a case against the US in the 1990s for protecting encrypted software. The judge issued a ruling that regulatory restrictions on an individual's ability to publish open source code constituted a violation of the First Amendment.

This means that even publishing code capable of producing assault weapons through a 3D printer cannot be considered a crime, unless there is evidence that the individual in question intends to commit a crime, for example by sharing that code with terrorist groups. A young Texan, Cody Wilson, actually created an open source code to produce, via 3D printers, guns. After being pressured to remove the code in question, he sued the US Department of Justice and won the case. In the United States, computer code is considered a form of freedom of expression.

Alexey was placed under house arrest in April 2023 pending trial. During the trial, the Dutch court ruled that Tornado Cash was indeed used for money laundering activities, sentencing the young computer scientist to five years and four months in prison in May 2024.  This decision caused outrage among many in the industry, so much so that the legal aid fund for the two computer scientists raised over $2 million.