Forwarded the Original Title: Tornado Cash’s victory: Paving the Way for Decentralized Network Development

On November 26, 2024, the U.S. Fifth Circuit Court of Appeals ruled that the U.S. Treasury Department’s OFAC sanctions on Tornado Cash were unlawful and exceeded its statutory authority. As Coinbase’s Chief Legal Officer Paul Grewal stated, “This is a historic victory for the crypto industry and everyone who cares about defending freedom.”

No one wants criminals to use crypto protocols, but the laws enacted by Congress do not empower regulators to completely block entire technology-neutral open source code because some users do evil. Regulatory enforcement that exceeds authority needs to be limited.

The appellate court clarified that while OFAC has legitimate grounds to prohibit illegal activities, Tornado Cash, as an immutable smart contract (a line of privacy-supporting software code), does not constitute “property” of a foreign national or entity. This means that (1) it cannot be legally blocked, and (2) OFAC exceeded the statutory authority granted by Congress.

This ruling is groundbreaking for the crypto industry. It not only establishes the definition of immutable smart contracts but also provides guidance and direction for the industry as it navigates complex global regulatory landscapes.

This article, written from the perspective of a Web3 legal professional, analyzes the significance of the Tornado Cash case. It examines the source of OFAC’s regulatory authority, the definition of immutable smart contracts, and the future development trends of decentralized networks.

1. What is Tornado Cash?

Tornado CashIt is a well-known currency mixing application on Ethereum that aims to provide users with privacy protection for transactions. It achieves private and anonymous transactions by confusing the source, destination and counterparty of digital currency transactions.

Tornado Cash accepts transactions (user deposits) of various token types. Through the application of zero-knowledge proof (ZKP) technology, its smart contracts mix transactions together, severing the public link between deposit and withdrawal addresses. The funds are then transmitted to the counterparty (user withdrawal), ensuring transaction privacy and preventing on-chain monitoring of users’ activities.

The Tornado Cash mixing smart contract offers two invaluable features: Privacy (anonymous digital transactions) and Immutability (the software code cannot be owned, controlled, or altered—even by its creators).

While on-chain wallets are technically anonymous, transactions between wallets are traceable and permanently recorded on the blockchain. With certain techniques, determined individuals can link wallet transaction records to real-world identities, which poses a significant privacy risk. Tornado Cash addresses this issue by breaking the transaction trail between wallets, thereby protecting the privacy of the wallet owners.

(Tornado Cash Case)

2. Background of Tornado Cash Sanctions

Tornado Cash, as an innovative application of neutral technology, helps legitimate users protect transaction privacy but cannot prevent malicious users from employing it for illegal purposes, such as money laundering.

On August 8, 2022, Tornado Cash was sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). The sanctions designated the Tornado Cash protocol, 37 Tornado Cash smart contracts (including at least 20 immutable smart contracts), and a donation address as “entities,” placing them on the sanctions list. This action was taken because North Korean hacking groups allegedly used Tornado Cash for cybercrimes, including money laundering.

Three months later, OFAC issued new guidance that included sanctions against 53 Ethereum addresses related to the Tornado Cash protocol. In the guidance, Tornado Cash was identified as an entity operated by its DAO (Decentralized Autonomous Organization). Based on this, OFAC blocked “all real estate, personal property, other assets, and property interests” of Tornado Cash entities under U.S. jurisdiction.

By adding Tornado Cash to the Specially Designated Nationals and Blocked Persons (SDN) list, OFAC imposed a comprehensive prohibition on any transactions involving Tornado Cash-related “property.” OFAC’s definition of such “property” included open-source computer code known as “smart contracts.”

This means that any interaction by individuals or entities with the on-chain addresses listed in the SDN is illegal. According to OFAC’s press release at the time, over $7 billion in illicit funds had been laundered through Tornado Cash since 2019. OFAC stated that Tornado Cash provided material assistance, sponsorship, and financial and technical support for illegal cyber activities both within and outside the United States. These activities posed significant threats to U.S. national security, foreign policy, economic health, and financial stability, thus leading to OFAC’s sanctions.

3. First Instance Ruling: OFAC’s Authority Deemed Legal

In a first-instance case funded by Coinbase, six Tornado Cash users sued OFAC. Their primary argument—and the only one later upheld on appeal—was that OFAC violated the U.S. Administrative Procedure Act by lacking the authority to sanction Tornado Cash. They argued that (1) Tornado Cash is not a foreign “national” or “person,” (2) immutable smart contracts are not “property,” and (3) Tornado Cash has no “interest” in immutable smart contracts.

The court of first instance rejected theTornado CashUser’s motion, the conclusion is:(1) Tornado Cashis an “entity” that may be designated as an individual under the law,(2)Smart contracts constitute “property”,(3)and operateTornado CashofKNIFEHas a “stake” in its smart contract because it derives profits from the services running on the smart contract.

This ruling sparked significant controversy, particularly regarding the classification of “smart contracts,” which are technically neutral tools. It also raised questions about privacy and financial regulation in the Web3 space. If smart contracts are defined as “property,” it could potentially infringe on First Amendment rights to free speech and privacy under the U.S. Constitution.

Fortunately, the recent appellate court ruling provided a clear answer and a brighter future for the development of decentralized networks.

（From the Tornado Cash incident, look at the US OFAC’s regulatory logic for Crypto）

4. Second Instance: Appellate Court Ruling Clarifies the Definition of Immutable Smart Contracts

On November 26, 2024, the appellate court overturned the district court’s ruling, declaring OFAC’s sanctions unlawful and beyond its statutory authority.

The key issue in the case was whether Tornado Cash, as an open-source, encrypted protocol for digital asset transactions, qualifies as “property” or “interests” under OFAC’s regulatory framework.

If the answer is no, then OFAC lacks the authority to impose sanctions on Tornado Cash.

OFAC’s regulatory enforcement powers derive from the International Emergency Economic Powers Act (IEEPA) and the North Korea Sanctions and Policy Enhancement Act, which grant the President the authority to regulate (or block) “property” or “interests” owned by foreign “nationals,” “persons,” or “entities.”

The IEEPA is an essential component of the U.S. modern sanctions system, authorizing the President to freeze assets of foreign actors deemed a threat to U.S. national security and to prohibit transactions with them. This broad authority is executed by the Treasury Department’s OFAC, which oversees various economic sanctions programs.

Through these powers, OFAC has defined terms such as “person,” “entity,” “property,” and “interest” in its regulations. It also provides channels for individuals affected by sanctions to challenge the designations or seek licenses for transactions involving blocked assets.

4.1 Immutable Smart Contracts

In its ruling, the appellate court distinguished between different types of smart contracts, avoiding the blanket classification from the district court that treated all smart contracts as “property.”

Smart contracts can be divided into two types: (1) Mutable Smart Contracts, which are typically controlled by one or more entities; (2) Immutable Smart Contracts, which cannot be controlled by anyone. Once a smart contract becomes immutable, no one can regain control over it.

Tornado Cash, as a decentralized, open-source software protocol, was initially launched in 2019 by a group of developers. While some of its smart contracts were mutable at the time, in 2020, the developers initiated a “trusted setup ceremony” to relinquish control. Over 1,100 users participated in this process, resulting in at least 20 smart contracts becoming irreversibly immutable.

As a result, Tornado Cash transformed into an autonomous system—a computer code that cannot be altered, deleted, or controlled. The software protocol operates independently on the blockchain without human intervention, and the Tornado Cash network is governed by a DAO (Decentralized Autonomous Organization).

4.2 Basis for OFAC’s Sanctions

Although Tornado Cash is a neutral protocol, and most users employ it for legitimate purposes, such as anonymously donating to the Ukraine war effort or avoiding hacker attacks, the protocol cannot effectively prevent malicious users from utilizing it to launder illicit gains.

This inability to restrict misuse is the reason for OFAC’s involvement. Under the International Emergency Economic Powers Act (IEEPA), the President is granted special economic powers following the declaration of a “national emergency” in response to any “unusual and extraordinary threat” originating in substantial part outside the United States, which poses risks to U.S. national security, foreign policy, or economy. These powers include freezing “any property in which any foreign country or a national thereof has any interest.”

4.3 Tornado Cash Does Not Constitute Property

While the law authorizes the President to regulate and enforce measures on “property” in which foreign “nationals,” “persons,” or “entities” have “interests,” the appellate court did not agree that immutable smart contracts can be classified as “property” or “interests.”

“Property” must be an asset capable of ownership, with clear ownership rights, including rights to control, exclude others, and dispose of the asset.

Property has a straightforward definition: it is something that can be owned. Property includes “everything which is or may be the subject of ownership, whether legal, beneficial, or private.” It is defined as “the condition of being owned by or belonging to some person or persons,” encompassing “the right to possess, use, and dispose of something.” Additionally, it includes the right “to exclude everyone else from interfering with it.”

In this case, Tornado Cash—represented by immutable smart contracts—clearly cannot be owned by anyone, nor can anyone be excluded from using it. Evidence shows that even after OFAC imposed sanctions on Tornado Cash, users could still access and interact with its underlying smart contracts.

“Those immutable smart contracts remain accessible to anyone with an internet connection.”

4.4 Tornado Cash Is Neither a Contract nor a Service

OFAC argued that immutable smart contracts could constitute “interests” related to “property,” such as contract rights or service rights. However, the appellate court clarified that while smart contracts are called “Smart Contracts,” they are not actual contracts (the smart contract is not itself a contract).

A contract is a mutual agreement between two or more parties that is revocable. Clearly, a smart contract is merely software code; it cannot make offers or exercise contractual rights such as revocation, which require legal parties to act. Similarly, immutable smart contracts cannot modify their code, delete code, or be removed from the Ethereum blockchain. A smart contract is simply an interaction between a user and software code.

Likewise, a service is defined as “the performance of some useful act or series of acts for the benefit of another, typically for payment.” In this case, a smart contract is just a piece of computer code. It cannot perform actions for the benefit of others or derive benefits.

The Tornado Cash smart contracts are merely tools used in providing a service, but they do not themselves provide services or control these contracts. (The immutable smart contracts are not property because they are not ownable, not contracts, and not services.)

4.5 The Appellate Court’s Ruling

As a result, the appellate court overturned the district court’s ruling, concluding that OFAC’s regulatory enforcement exceeded its statutory authority.

The court stated: “We recognize the downsides of certain unregulated and uncontrollable technologies in the real world. It is entirely appropriate for the President and government to address malicious cyber activities, which led to the enactment of IEEPA in 1977, predating the invention of the modern internet by several years.

However, the law grants the President and government agencies broad authority to regulate various economic transactions, but this authority is neither unlimited nor expandable.”

5. Victory for Decentralized Networks

Although this is only a ruling from the appellate court, and OFAC has the right to bring the case to the Supreme Court, the strong reasoning in favor of immutable smart contracts in the appellate decision makes it difficult to overturn.

As Coinbase aptly put it: On Chain is the New Online. With decentralized protocols and networks reaching an ever-growing number of people, the previously purely permissionless nature of on-chain activities must evolve toward greater legality and compliance. Striking a balance between fostering innovation in technology from a neutral perspective and enforcing regulation is an essential challenge for legislators and regulators alike.

Regardless, much like Grayscale’s victory over the SEC paved the way for the approval of a Bitcoin ETF, the Tornado Cash case has paved the way for the further development of decentralized networks.

As President Putin once said: Bitcoin and other electronic payment systems, as new technologies, cannot be completely banned. They will continue to evolve because they offer advantages in reducing costs and increasing transaction reliability.

（From OFAC and FinCEN, look at the conflict between Web3 privacy and financial regulation）

References:

[1] Tornado Cash Case

https://assets.ctfassets.net/c5bd0wqjc7v0/70EasapqSxH1kLInf3IQrd/1a1ce21cdc6bc903921f45018cce3821/Tornado_Cash.pdf

[2] How the Tornado Cash Lawsuit Was Won and Why It Matters

https://x.com/laurashin/status/1864031301029732727

Disclaimer:

1. This article is reproduced from [Web3 small rules]. Forwarded the Original Title: Tornado Cash’s victory: Paving the Way for Decentralized Network Development. The copyright belongs to the original author [will Awang]. If you have any objections to the reprint, please contact Gate Learn Team, the team will handle it as soon as possible according to relevant procedures.
2. Disclaimer: The views and opinions expressed in this article represent only the author’s personal views and do not constitute any investment advice.
3. The Gate Learn team translated the article into other languages. Copying, distributing, or plagiarizing the translated articles is prohibited unless mentioned.