Reported by Patrick D. Daughert, Kenneth Breen, and Phara A. Guberman

(Summary featured below. To read full report, go to: https://www.foley.com/p/102l4ga/tornado-cash-and-the-legality-of-mixers/)

The Tornado Cash case highlights the ongoing legal uncertainty surrounding crypto mixers and their role in the broader financial ecosystem. Tornado Cash, launched in 2019, is a decentralized protocol that uses zero-knowledge proofs to allow users to obscure the origin and destination of digital assets, enhancing privacy but raising red flags for regulators. The U.S. government argued that the platform was exploited by bad actors, most notably North Korea’s Lazarus Group, to launder billions of dollars. This led to Tornado Cash being sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) in 2022, sparking years of litigation about whether code itself could be sanctioned and whether regulators had exceeded their authority. Ultimately, courts and the Trump administration rolled back the sanctions, signaling a shift in policy toward recognizing the neutrality of decentralized technologies.

Despite the removal of sanctions, criminal charges against Tornado Cash’s founders continued. Roman Storm and Roman Semenov were indicted in 2023 on conspiracy charges related to money laundering, sanctions violations, and operating an unlicensed money transmitting business. The Department of Justice (DOJ), however, adjusted its enforcement priorities under the 2025 Blanche Memorandum, which sought to end “regulation by prosecution” and clarify that developers of neutral tools without criminal intent should not be held responsible for others’ misuse. As a result, prosecutors trimmed charges against Storm before trial, dropping claims related to FinCEN registration and focusing instead on whether he knowingly facilitated the transmission of criminal proceeds.

The trial in summer 2025 underscored the tensions between privacy, innovation, and enforcement. Prosecutors emphasized that Storm knew criminals used Tornado Cash and failed to implement safeguards, while the defense framed it as a neutral privacy tool with legitimate purposes, likening it to encrypted messaging apps. After four weeks of arguments and nearly a week of deliberation, the jury reached a split decision: Storm was convicted of conspiracy to operate an unlicensed money transmitting business but the jury deadlocked on the more serious charges of conspiracy to commit money laundering and sanctions violations. This partial mistrial left unresolved whether developers of privacy-focused tools can be held liable for illicit use by others, and the case is now likely headed to appeal.

The verdict leaves the crypto industry in a state of uncertainty. While the DOJ has signaled a more restrained approach to prosecuting developers, the lack of clear legal standards means mixers and similar technologies still face regulatory risk. Lawmakers are debating whether to enact explicit protections for privacy-enhancing tools, but until legislation is passed, developers must navigate a landscape where financial privacy can be celebrated or condemned depending on context. The Tornado Cash saga illustrates both the promise and peril of decentralized finance — a space where innovation collides with national security concerns, and where courts, regulators, and Congress continue to struggle over where the lines should be drawn.