Imagine you send Bitcoin to a friend. On the public ledger, anyone can trace that transaction back to your wallet. Now imagine you want to buy coffee without revealing your entire financial history to the world. That’s where crypto mixers come in. They are tools designed to break the link between sender and receiver, offering privacy in an otherwise transparent system. But for years, regulators viewed these tools with deep suspicion, treating them like digital money launderers. The most famous battleground was Tornado Cash, an Ethereum-based mixer sanctioned by the US government in 2022. For three years, using it felt illegal for Americans. Then, in March 2025, everything changed.
This article breaks down exactly what happened, why the sanctions were lifted, and what it means for developers and users today. If you’ve ever wondered if your privacy tools are safe or if you could get fined for using a mixer, this is the clarity you need.
What Exactly Is a Crypto Mixer?
A crypto mixer, also known as a tumbler, is a service that obscures the trail of cryptocurrency transactions. When you deposit funds into a mixer, they are pooled with deposits from other users. After a delay, you withdraw the same amount (minus fees) to a new address. Because the withdrawal doesn’t directly match the deposit time or address, tracing the flow of money becomes incredibly difficult.
Tornado Cash was unique because it wasn’t a company holding your money. It was a set of smart contracts on the Ethereum blockchain. You didn’t trust a middleman; you trusted code. Launched in 2019 by Roman Semenov and Roman Storm, it processed over $7.6 billion worth of Ether at its peak. About 30% of those funds were linked to illicit activities, according to Chainalysis, which fueled the regulatory firestorm.
| Feature | Traditional Bank | Tornado Cash (Pre-Sanction) |
|---|---|---|
| Custody | Bank holds your funds | User retains control via smart contract |
| Privacy | Low (KYC required) | High (No KYC required) |
| Regulation | Heavily regulated entity | Autonomous code (no legal entity) |
| Reversibility | Transactions can be reversed | Immutable on-chain transactions |
Why Did the US Government Sanction Tornado Cash?
In August 2022, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) added Tornado Cash to the Specially Designated Nationals (SDN) list. This was a massive shock. Usually, sanctions target people or companies-entities that can freeze assets or stop services. Tornado Cash was neither. It was software running autonomously on a global network.
The Treasury argued that Tornado Cash facilitated the laundering of more than $7 billion in cryptocurrency. Specific incidents drove this decision. North Korea’s Lazarus Group used Tornado Cash to wash $455 million stolen from the Axie Infinity hack. Other major exploits, including the Harmony Bridge Heist ($96 million) and the Nomad Heist ($7.8 million), also saw funds pass through the mixer. The government claimed the protocol failed to implement controls to stop malicious actors, effectively acting as a laundromat for cybercriminals.
For ordinary users, the sanction meant immediate practical problems. US persons were prohibited from interacting with any Tornado Cash smart contract addresses. Exchanges began blocking withdrawals to addresses tagged as "tainted" by analytics firms. Even if you weren’t a criminal, using the mixer became a compliance nightmare.
The Legal Battle: Code vs. Property
Legal experts quickly challenged the sanctions. A group called the Coin Center, along with users, sued the Treasury in the case Van Loon v. Department of Treasury. Their argument was simple but profound: You cannot sanction code. Smart contracts are immutable-they run automatically once deployed. There is no CEO to call, no server to shut down, and no bank account to freeze.
The core legal question was whether Tornado Cash’s smart contracts constituted "property" under the International Emergency Economic Powers Act (IEEPA). In November 2024, the US Fifth Circuit Court of Appeals delivered a landmark ruling. The court determined that OFAC had exceeded its authority. Immutable smart contracts do not qualify as property or interests in property because no one owns or controls them in a traditional sense. You can’t seize a line of code.
This ruling sent shockwaves through the industry. It suggested that the government couldn’t simply label decentralized technology as a sanctioned entity just because bad actors used it. However, the victory wasn’t total. While the contracts were cleared, the human developers remained in the crosshairs.
The 2025 Delisting and Current Status
Following the Fifth Circuit’s decision, the Treasury acted quickly. On March 21, 2025, OFAC officially lifted sanctions against Tornado Cash’s smart contracts. This made it legal again for Americans to interact with the protocol. You can now deposit and withdraw ETH without violating federal sanctions law.
But here is the catch: The Treasury kept sanctions on Roman Semenov, one of the co-founders. This created a nuanced regulatory stance. The technology itself is legal, but specific individuals associated with its creation may still face restrictions. It separates the tool from the builder. For most users, this distinction matters little-you’re interacting with code, not a person. But for developers building similar privacy tools, it’s a warning sign.
Since the delisting, activity on Tornado Cash has seen a modest rebound. While it hasn’t returned to its pre-sanction glory, inflows have stabilized around $200 million monthly. Users are cautious, aware that while federal sanctions are gone, individual exchanges and banks may still apply their own risk policies.
Roman Storm’s Criminal Trial: The Human Cost
While the contracts were unshackled, developer Roman Storm faced a different fate. The Department of Justice (DOJ) proceeded with criminal charges against him, arguing that he personally operated an unlicensed money transmitting business and conspired to violate sanctions. This trial highlights a critical divide in crypto regulation: Can you be held criminally liable for writing open-source code that others misuse?
The DOJ’s position is that developers aren’t neutral when they profit from the protocol or actively market it. They argue Storm knew his tool would be used for illicit purposes and benefited from it. Critics call this a chilling effect, fearing it will discourage innovation in privacy tech. If every developer worries about jail time for their code’s usage, who will build the next generation of decentralized applications?
As of September 2026, the legal landscape remains complex. Protocol-level sanctions have been invalidated, but individual liability is being tested in real-time. This dual-track approach suggests regulators are shifting focus from banning technology to prosecuting specific human actions.
Implications for Privacy and DeFi
The Tornado Cash saga reshaped how we think about digital privacy. Before 2022, privacy was often dismissed as a niche concern for criminals. Today, it’s recognized as a fundamental right, essential for fungibility. Without mixers, all Bitcoin or Ether is traceable. If a coin was once used in a ransom payment, every future holder of that coin carries that stigma. Mixers restore fungibility by making coins indistinguishable.
Other protocols took note. Zcash, which uses zero-knowledge proofs for privacy, faced less direct regulatory heat partly because its architecture differs from Tornado Cash’s pool-based model. However, the precedent set by the Tornado Cash rulings protects all decentralized privacy tools. Regulators now know that banning autonomous code requires precise legal grounds, not just broad executive orders.
For investors and builders, the takeaway is clear: Decentralization offers resilience, but it doesn’t eliminate risk. Compliance is becoming more sophisticated, moving away from blunt force bans toward targeted enforcement against individuals. If you’re building in Web3, assume that regulators will look for human leverage points-founders, marketers, and treasury managers-even if the protocol itself is autonomous.
Frequently Asked Questions
Is Tornado Cash legal to use in the US now?
Yes, following the March 2025 delisting, it is legal for US persons to interact with Tornado Cash smart contracts. The Fifth Circuit ruled that the immutable contracts could not be sanctioned as property. However, always check with your specific exchange, as private institutions may still impose their own restrictions.
Why did the government sanction Tornado Cash initially?
The US Treasury sanctioned Tornado Cash in 2022 because it believed the mixer was facilitating significant money laundering, particularly for North Korean hackers like the Lazarus Group. They argued the protocol lacked adequate anti-money laundering controls.
Can I still get fined for using a crypto mixer?
Federal sanctions fines are unlikely now for standard usage since the contracts are delisted. However, if you are using a mixer to hide income from tax authorities or to facilitate illegal trade, you could still face civil or criminal penalties unrelated to the sanctions themselves.
What is the difference between sanctioning code and sanctioning a person?
Sanctioning a person restricts their ability to transact globally. Sanctioning code attempts to block access to a protocol. The courts ruled that autonomous code isn't 'property' and thus harder to sanction, whereas individuals remain fully liable for their actions and business operations.
Are there alternatives to Tornado Cash?
Yes, protocols like Zcash, Monero, and newer zk-Rollup based privacy solutions offer similar features. Some use different cryptographic methods, such as zero-knowledge proofs, which may present different regulatory profiles compared to the pool-based mixing of Tornado Cash.