On November 26, 2024, the U.S. Fifth Circuit Court of Appeals issued a ruling that overturned U.S. sanctions imposed under the International Emergency Economic Powers Act (“IEEPA”) on Tornado Cash, a virtual currency mixer comprised of open-source computer code known as “smart contracts.” The Fifth Circuit held that the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) overstepped its legal authority when it prohibited dealings with Tornado Cash “property” after finding that Tornado Cash’s immutable smart contracts were not considered “property” under the IEEPA.
In August 2022, Tornado Cash was designated by OFAC for enabling malicious cyber actors to launder approximately $7 billion worth cybercrime proceeds since its creation in 2019, including $455 million stolen by the Lazarus Group, a state-sponsored hacking group in North Korea. Following Tornado Cash’s designation, OFAC also designated Roman Semenov, Tornado Cash’s co-founder and key developer in August 2022.
The Fifth Circuit ruled in favor of six plaintiffs-appellants who challenged OFAC’s decision to sanction the mixer. In September 2022, the plaintiffs, who used Tornado Cash for legitimate purposes, claimed that OFAC lacked the authority to sanction Tornado Cash under the IEEPA because (1) Tornado Cash was not a foreign “national” or “person,” (2) the immutable smart contracts did not qualify as “property,” and (3) Tornado Cash could not have a property “interest” in immutable smart contracts. The district court ruled in favor of OFAC finding that Tornado Cash could be designated as a “person” under the IEEPA; that smart contracts do qualify as “property,” and that the decentralized autonomous organization (“DAO”) that runs Tornado Cash had an interest in its smart contracts because it derived profits from their crypto mixing services. The plaintiffs’ appeal was filed in response to this decision.
In its judgment, the Fifth Circuit described Tornado Cash as “an open-source, crypto-transaction software protocol” that offers “privacy (by anonymizing digital transactions) and immutability (as the software code is unownable, uncontrollable, and unchangeable – even by its creators).” The Fifth Circuit also acknowledged that the IEEPA authorizes the President to sanction foreign actors that pose a threat to U.S. national security – sanctions that include blocking “any property in which any foreign country or a national thereof has any interest.” However, based on a review of OFAC’s regulatory definition of property, the Fifth Circuit determined that Tornado Cash’s immutable smart contracts did not qualify as “property” because they were incapable of being owned or controlled. The court also determined that the immutable smart contracts did not qualify as “contracts” (despite of the misleading name) or “services” under OFAC’s regulatory definitions. Based on these findings, the Fifth Circuit concluded that OFAC exceeded its statutory authority when it sanctioned Tornado Cash. Because of its conclusion, the court decided that there was no need to address whether Tornado Cash qualified as an “entity” or whether it had an “interest” in the immutable smart contracts.
The Fifth Circuit also emphasized that the broad powers granted by the IEEPA were not limitless and that the task of “[m]ending a statute’s blind spots or smoothing its disruptive effects falls outside of our lane.” The court stated that legislating was “Congress’s job – and Congress’s alone” and suggested that Congress could update the IEEPA, which was enacted during the Carter Administration, to include modern technologies like crypto-mixing software.