Reference Guide:

OFAC has imposed economic sanctions on the cryptocurrency mixing service Tornado Cash, banning US individuals and businesses from using its services. Because Tornado Cash allows customers to hide the origin of a crypto transaction, it has reportedly been exploited by criminals to launder money, including the proceeds of ransomware attacks. This is another step in the US government’s efforts to crack down on illicit financial activity in the virtual currency ecosystem. The standard for violating OFAC sanctions is strict liability; therefore, U.S. companies may wish to seek legal advice on risk mitigation given the government’s focus on potential money laundering using cryptocurrency.

On August 8, 2022, the Treasury Department’s Office of Foreign Assets Control (OFAC) imposed economic sanctions on Tornado Cash, a popular cryptocurrency mixing service that allows customers to hide the original source of transactions. in virtual currency by “mixing” several transactions. then redistribute them. While the mix may have legitimate advantages in certain transactions, it can also be exploited by criminals to potentially launder cryptocurrency, including crypto received in ransomware attacks.

OFAC designated the sanctions pursuant to Executive Order 13694, which was issued following an increase in ransomware attacks and targets cyber threats to the national security of the United States.^[1] According to OFAC, Tornado Cash was responsible for the “laundering[ing] Proceeds of Cybercrimes,” including more than $455 million worth stolen from the Lazarus Group, a state-sponsored hacking group in the Democratic People’s Republic of Korea (DPRK) that the United States sanctioned in 2019. Among other things, the designation of Tornado Cash has the effect of prohibiting U.S. persons from using the service, as it is added to OFAC’s Specially Designated Nationals (SDN) list.

The move is just the latest signal of increased attention from US authorities to the role that mixers play in the anti-money laundering landscape. In October 2020, the Department of Justice issued a cautionary note on mixers in its cryptocurrency enforcement framework, warning that operators of mixing services could potentially be criminally liable for money laundering.^[2] In 2021, the DOJ sued the operator of the Darknet-based mixer Helix, which admitted the service was for the sale of narcotics and other illicit transactions.

The Tornado Cash designation comes just three months after OFAC’s first-ever designation of a blender service, blender.io, which also allegedly laundered virtual currency for the Lazarus Group. Unlike blender.io, which offered more traditional centralized mixing services, Tornado Cash is a smart contract-based mixing protocol built on the Ethereum blockchain, and it does not provide any custodial services. In March 2022, one of its three founders claimed that Tornado Cash’s code allowed the service to run indefinitely without any oversight or maintenance by its developers.

The example of Tornado Cash highlights the uncertainty about the potential liability of mixer developers for the actions of their customers. Federal authorities may have avoided these issues for now by pursuing an enforcement-through-sanctions approach rather than the more traditional criminal or civil penalties; the U.S. government generally has greater discretion and less burden to impose economic sanctions on non-U.S. persons. It remains to be seen whether this decision marks a change in tactics – perhaps a subtle prioritization of disruption over prosecution – or if it simply signals that US authorities intend to use the full range of tools to their disposition to target companies that they believe facilitate money. bleaching.

In a Press release announcing its sanction of Tornado Cash, OFAC noted that “The Treasury will continue to investigate the use of mixers for illicit purposes and use its powers to address illicit financial risks in the virtual currency ecosystem(emphasis added). Virtual currency businesses may wish to review and update, as appropriate, their Anti-Money Laundering and Anti-Terrorist Financing (AML/CFT) programs and sanctions, particularly with respect to cryptocurrencies that offer anonymization services. Cryptocurrency businesses should keep in mind that sanctioned mixers such as Tornado Cash may still be able to operate, even if subject to sanctions. As a result, cryptocurrency businesses subject to US jurisdiction must ensure that their platforms do not transact with sanctioned entities such as Tornado Cash, as violations of OFAC sanctions are subject to a standard of “strict liability”, which means that no intention, knowledge or reason to know that one is dealing with a sanctioned person is necessary for an offense to occur.

---

[1] See January 2017 GT Alert.

[2] See October 2020 GT alert.