OFAC and Tornado Cash: A Timeline of the Events Leading to (and Following) OFAC’s Sanctions
Tornado Cash is in the news once again. After the Office of Foreign Assets Control (OFAC) sanctioned the digital currency mixer in August 2022, it recently announced sanctions against one of the platform’s co-founders in coordination with the U.S. Department of Justice’s (DOJ) announcement of parallel criminal charges. OFAC’s efforts to target Tornado Cash and its founders present concerns for many other organizations and individuals as well—including Tornado Cash users and operators of other cryptocurrency mixing platforms.
In this article, we provide a detailed overview of the events leading to (and following) OFAC’s sanctioning of Tornado Cash. This timeline is instructive for understanding how the events unfolded, and it provides some important insights for interested parties with regard to OFAC compliance and sanctions defense going forward.
“OFAC’s designation of Tornado Cash is important for several reasons. It puts numerous other platforms, companies, and individuals at risk, and it sends a clear message that OFAC and its federal law enforcement partners have a long-term strategy to target the use of cryptocurrency in criminal enterprise.” – Dr. Nick Oberheiden, Founding Attorney of Oberheiden P.C.
As is so often the case, the history behind OFAC’s sanctioning of Tornado Cash provides not only essential context, but also lessons for the future. With this in mind, we start our timeline three years before OFAC announced that Tornado Cash would be listed as a Specially Designated National (SDN):
Tornado Cash Launches as an Open-Source Cryptocurrency Mixing Platform in 2019
Tornado Cash launched as a digital currency mixer in 2019. An article in Coin Telegraph describes the platform’s origin story as, “a fascinating account of true decentralization dreamers fighting the regulatory powers that be.” As the article notes, while Tornado Cash began as an experiment, it quickly grew into one of the world’s largest mixers, and this—along with other circumstances—led to scrutiny from OFAC and other governmental authorities.
Crucially, Tornado Cash’s code is open-source; and, Coin Telegraph reports, due to the platform’s decentralized structure, “[s]topping Tornado Cash is completely beyond the Treasury’s ability at present.” This, perhaps, is among the reasons why OFAC has worked aggressively to prevent use of the platform through other means.
OFAC Sanctions the Lazarus Group in 2019
Shortly after Tornado Cash launched, OFAC announced sanctions against the Lazarus Group. According to OFAC’s September 13, 2019 press release, the Lazarus Group is a “North Korean state-sponsored malicious cyber group responsible for North Korea’s malicious cyber activity on critical infrastructure.”
While the Lazarus Group predates Tornado Cash, it began using the digital currency mixer sometime between its launch and April 14, 2022. This is when the Federal Bureau of Investigation (FBI) announced that it had confirmed the Lazarus Group’s involvement in the theft of $620 million in Ethereum. In announcing its sanctions against Tornado Cash shortly thereafter, OFAC would write that the platform was responsible for processing “over $455 million stolen by the Lazarus Group,” as well as more than $100 million in other “malicious cyber actors’ funds.”
FinCEN Imposes $60 Million Civil Monetary Penalty on Helix and Coin Ninja Founder in 2020
As Tornado Cash rose to prominence and gained the attention of the Lazarus Group and other cyber criminal organizations, other digital currency mixing platforms were already being used in similar ways. In 2020, the Financial Crimes Enforcement Network (FinCEN) imposed a $60 million civil monetary penalty on Larry Dean Harmon, the operator of Helix and Chief Executive Officer of Coin Ninja. According to FinCEN, Harmon and Helix operated in willful violation of the Bank Secrecy Act’s anti-money laundering (AML) provisions, including its “registration, program, and reporting requirements.” This included (i) failing to register as a money services business, (ii) failing to implement an effective AML program, and (iii) failing to report suspicious activity to FinCEN.
While Harmon and Helix did not face OFAC sanctions, FinCEN’s enforcement action is relevant as the first identified federal effort to target a digital currency mixing platform. FinCEN’s enforcement action set the stage for OFAC’s subsequent efforts to sanction digital currency mixers—as OFAC itself acknowledged when it announced its sanctions against Tornado Cash.
U.S. Treasury Department Issues 2022 National Money Laundering Risk Assessment
In its press release announcing the designation of Tornado Cash, OFAC also referenced the U.S. Treasury Department’s 2022 National Money Laundering Risk Assessment. Citing the report, OFAC stated that “[c]riminals have increased their use of anonymity-enhancing technologies, including mixers, to help hide the movement or origin of funds.”
Released in February 2022, the 2022 National Money Laundering Risk Assessment provides a comprehensive overview of the federal government’s efforts to combat money laundering and related crimes. Among other risks, the report discusses “anonymity-enhanced cryptocurrencies and service providers.” While noting that “anonymity-enhancement technologies” already present challenges for federal authorities, the report states that while these platforms and service providers have AML compliance obligations under the Bank Secrecy Act, “they may deliberately operate in a noncompliant manner to make it more difficult for regulators and law enforcement to trace illicit funds.”
OFAC Sanctions Blender.io, Another Digital Currency Mixer, in May 2022
When OFAC sanctioned Tornado Cash, it wasn’t the first time that the Office had imposed sanctions on a digital currency mixing platform. That distinction belongs to the sanctions OFAC imposed on Blender.io on May 6, 2022.
In announcing the “first-ever sanctions on a virtual currency mixer,” OFAC wrote in its press release that the Lazarus Group used Blender.io to process more than $20 million of the proceeds from its $620 million Ethereum heist. In language that would be mirrored in OFAC’s press release announcing its sanctioning of Tornado Cash, OFAC also wrote that:
“Blender is being designated . . . for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, a cyber-enabled activity originating from, or directed by persons located, in whole or in substantial part, outside the United States that is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States and that has the purpose or effect of causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, or financial information for commercial or competitive advantage or private financial gain.”
While OFAC’s efforts to target Blender.io were undoubtedly related to concerns with the platform itself, it also appears in many ways that these efforts were intended to set the stage for OFAC’s subsequent sanctioning of Tornado Cash.
OFAC Sanctions Tornado Cash in August 2022
OFAC sanctioned Tornado Cash on August 8, 2022. Noting that “[v]irtual currency mixers that assist criminals are a threat to U.S. national security,” OFAC based its sanctions largely—though not entirely—on Tornado Cash’s processing of cryptocurrency stolen by the Lazarus Group. OFAC sanctioned Tornado Cash pursuant to two Executive orders: E.O. 13722 (“Blocking Property of the Government of North Korea and the Workers’ Party of Korea, and Prohibiting Certain Transactions with Respect to North Korea”) and E.O. 13694 (“Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities”).
OFAC’s sanctioning of Blender.io and Tornado Cash was significant because the sanctions applied to the digital currency mixing platforms themselves—rather than the entities or individuals behind them. In response to questions regarding its authority to issue the sanctions, OFAC explained its justification in FAQ 1095:
“A ‘person’ subject to designation under E.O. 13722 or E.O. 13694, as amended, includes an individual or an entity, defined as ‘a partnership, association, trust, joint venture, corporation, group, subgroup, or other organization. . . .’
“OFAC designated . . . Tornado Cash . . . [as] a ‘partnership, association, joint venture, corporation, group, subgroup, or other organization’ that may be designated pursuant to [the International Emergency Economic Powers Act (IEEPA)]. Tornado Cash’s organizational structure consists of: (1) its founders and other associated developers, who together launched the Tornado Cash mixing service, developed new Tornado Cash mixing service features, created the Tornado Cash Decentralized Autonomous Organization (DAO), and actively promoted the platform’s popularity in an attempt to increase its user base; and (2) the Tornado Cash DAO, which is responsible for voting on and implementing new features created by the developers.”
While OFAC’s designation faced legal challenges (including lack of authority to designate a digital currency mixer as a “person”), to date, these challenges have failed. On August 17, the U.S. District Court for the Western District of Texas dismissed a lawsuit seeking to overturn OFAC’s designation on First Amendment and other grounds.
OFAC Sanctions Tornado Cash Co-Founder, DOJ Files Charges
A week after challenges to its sanctioning authority failed, OFAC announced additional sanctions against one of Tornado Cash’s co-founders, Roman Semenov. The same day, August 23, 2023, the DOJ announced the unsealing of an indictment against Semenov and another Tornado Cash co-founder, Roman Storm. Similar to OFAC’s press releases, the DOJ’s press release makes clear that the agency intends to continue to prioritize targeting digital currency mixers and their criminal users in the future.
Dr. Nick Oberheiden, founder of Oberheiden P.C., focuses his litigation practice on white-collar criminal defense, government investigations, SEC & FCPA enforcement, and commercial litigation.