On March 21, 2025, the U.S. Department of Treasury announced that it was removing economic sanctions against Tornado Cash – an action reflected in a filing made by the Department in Van Loon v. Department of the Treasury on the same day. The Department also emphasized that it remains committed to exposing and disrupting malicious cyber actors and their exploitation of digital assets, especially in light of the hacking and money laundering campaign launched by the Democratic People’s Republic of Korea (“DPRK”) and the Kim regime aimed at stealing, acquiring and deploying digital assets. The Department also confirmed its commitment to closely monitor transactions that may involve malicious cyber actors or the DPRK and urged U.S. persons to use caution to avoid exposure to cyber-related risks.
On August 8, 2022, the Office of Foreign Assets Control designated Tornado Cash – a decentralized virtual currency mixer comprised of open-source computer code known as “smart contracts” – pursuant to Executive Order 13694, for enabling malicious cyber-enabled activities by facilitating anonymous virtual currency transactions without attempting to determine the source of the funds. U.S. sanctions were imposed after investigators determined that the platform was used to launder more than $7 billion worth of virtual currency since its creation in 2019, including $455 million in virtual currency stolen by the Lazarus Group, a U.S.-sanctioned, state-sponsored hacking group in the DPRK that committed the largest known virtual currency heist at that time.
On September 8, 2022, six individuals who used Tornado Cash for legitimate purposes challenged the designation by arguing that OFAC had exceeded its statutory authority and infringed upon users’ constitutional rights. On November 26, 2024, the U.S. Fifth Circuit Court of Appeals agreed with plaintiffs and overturned the sanctions against Tornado Cash. The Court held that OFAC had overstepped its legal authority when it prohibited dealings with Tornado Cash “property” after finding that Tornado’s immutable smart contracts were not considered “property” under the International Emergency Economic Powers Act (“IEEPA”). The Court also found that Tornado Cash’s immutable smart contracts did not quality as “contracts” or “services” under OFAC’s regulatory definitions.
U.S. Department of Treasury Press Release | U.S. Department of Treasury Notice