Treasury Department Sanctions Popular Cryptocurrency Mixer, Citing Growing Threat

The Treasury Department on Monday officially placed Tornado Cash, a popular cryptocurrency mixer tool, on its sanctions list, citing use of the service by North Korea to launder stolen cryptocurrency. While Treasury and White House officials described mixers as a growing threat to U.S. national security, some leading voices in the crypto-trading community refer to mixers simply as “privacy tools” that the public should have access to. 

Virtual currency mixers like Tornado Cash work a bit like an actual tornado: They receive transactions of virtual currency and mix them together. Users can pull out the amount they contributed, but since it’s “mixed,” that means the withdrawal won’t be the same chunk of blockchain they originally purchased. That makes it very difficult for regulators or watchdogs to monitor the origin and destination of virtual currencies in the mixer. 

“While the purported purpose is to increase privacy, mixers like Tornado are commonly used by

illicit actors to launder funds, especially those stolen during significant heists,” the Treasury Department said in a statement Monday. 

Treasury officials say that different parties have used Tornado Cash to “launder” more than $7 billion in virtual currency since its inception in 2019, including more than $455 million the North Korean government stole that same year via a state-sponsored hacking team called the Lazarus Group. That’s money North Korea uses to fund weapons development, a senior White House official told reporters.

The sanctions designation shows, “The [Biden] administration's focus on putting pressure on the North Korean regime, given how much hacks, specifically hacks of cryptocurrency-related ecosystems, have been a source of hard revenue funding,” for the North Koreans, the White House official said. “The illicit use of mixers allow criminals to commit these hacks.”

By placing Tornado Cash on the Specially Designated Nationals list, all U.S. persons are prohibited from using the tool or linking virtual currency wallets to Tornado Cash.

But unlike other entities on the list, Tornado Cash is not a company or a person. It’s a decentralized service. There is no corporate entity that runs it or that is accountable for the way it’s used. 

Roman Semenov, the Russian-born founder of Tornado Cash, told CoinDesk in January that, “The Tornado Cash team mostly does research and publishes the code to GitHub [an open-source code repository.] All the deployments, protocol changes, and important decisions are made by the community via Tornado Governance [decentralized autonomous organization] and deployment ceremonies," which he said are code publishing events. That means the people writing the code for the mixer have virtually no say in how users use it. 

Semenov later tweeted that he had been kicked off of GitHub.

“There is not much we can do in terms of helping investigations, because the team doesn't have much control over the protocol,” he said.

That decentralization may make it difficult to stop or regulate the propagation of the protocol, but the very real criminal sentences the Treasury Department can put on its use—which could include a 30 years behind bars—should make the tool much less desirable. 

“The U.S. was likely scanning key North Korean wallets and saw a lot of money go through Tornado Cash, so they sanctioned/blacklisted the entirety of their wallets,” Mario Nawfal, founder of virtual currency consulting company IBC, noted on Twitter. “Now anyone trying to sell tokens that have touched Tornado Cash's wallets won't be able to now on major [currency exchanges.]”

Muneeb Ali, CEO of Trust Machines, a company that builds virtual currency apps, said the Treasury Department announcement showed government disregard for Americans’ right to privacy, or to access privacy tools. “It’s time to put our crypto tribalism aside; the crypto wars II are starting: US Treasury puts privacy tool Tornado Cash on the sanctions list. This list is meant for people, not tech tools. Privacy tools are for every American,” he tweeted. 

Patrick Hansen, a virtual currency advisor at Presight Capital, took a sort of middle-of-the-road position, arguing on Twitter that the community needs to focus on developing and promoting its own tools to thwart money laundering, or face more action from regulators. 

“Ideologically, I believe that financial privacy tools like Tornado Cash should be protected at all costs. But pragmatically, I fear that focusing the narrative on protecting anonymous transfers is fighting a losing regulatory battle detrimental to the broader crypto [anti-money laundering] rules.”

That creates a challenge and opportunity in the future for crypto traders and for the government: Can the industry create its own tools to better prevent money laundering and financial crime before the government steps in to put popular tools on the sanctions list? White House and Treasury officials on Monday said they are making aggressive efforts to “partner” with the industry to prevent money laundering via virtual currency. 

A senior Treasury official said that the reaction from the industry to such outreach has been “pretty broad.”