OFAC Takes Action Against Virtual Currency Tornado Cash in New Sanctions Enforcement | Coie Perkins


The Office of Foreign Assets Control (OFAC) of the United States Department of Treasury, August 8, 2022, sanctioned Tornado Cash virtual currency mixer. OFAC alleged it had been “used to launder more than $7 billion worth of virtual currency since its inception in 2019 [, including] more than 455 million dollars stolen by the Lazarus group[,]”a state-sponsored hacking group from the Democratic People’s Republic of Korea (DPRK) that OFAC has identified for sanctions in 2019in what the agency called largest known virtual currency heist to date.[1]

The OFAC action raises new questions about the scope and application of US sanctions on participants in digital asset markets and comes just five months after Tornado Cash co-founder Roman Semenov claimed that It would be “technically impossible” for sanctions to be applied against decentralized actors. protocols. As a decentralized protocol, the Tornado Cash code functions as a self-executing smart contract that activates when pre-determined conditions are met, independent of any manual intervention. Some felt that OFAC exceeded its legal authority and that the Tornado Cash action shows the tension between existing legal regimes and decentralized finance (DeFi) applications that are largely capable of operating without intermediation by natural or legal persons. .

OFAC has imposed sanctions against Tornado Cash pursuant to Executive Order 13694which allows the agency to take action against individuals who have “materially assisted in, sponsored, or provided financial, material, or technological support, or goods or services to or in support of cyber activity originating from, or directed by persons located wholly or substantially outside the United States who are reasonably likely to create, or have materially contributed to, a material threat to national security, foreign policy, economic health, or financial stability of the United States…” For these purposes, “person” means “an individual or entity” and “entity” is “a partnership, association, trust, joint venture, corporation, group, sub-group or other organization”.

To carry out its action, OFAC identified the entity “Tornado Cash“, with the aliases “Tornado Cash Classic” and “Tornado Cash Nova”, on its list of specially designated nationals and blocked persons (the SDN list) and also included the Tornado Cash website and various digital addresses as “identifications” . By virtue of its listing on the SDN list, all Tornado Cash real property and interests in the United States, or in the possession or control of US persons, must be blocked and reported to OFAC.[2] Additionally, all entities that are at least 50% owned, directly or indirectly, by Tornado Cash are also blocked. Unless authorized by OFAC, US Persons are prohibited from dealing, directly or indirectly, with Tornado Cash or in its real property or interests. These prohibitions include contributing or providing funds, goods, or services by, to, or for the benefit of Tornado Cash or facilitating another’s relationship with it. Because OFAC’s sanctions operate as a strict liability regime, liability may arise regardless of knowledge or intent to commit a violation.

Tornado Cash is clearly not a separate legal entity or individual, and therefore the basis and intended target(s) of OFAC action is subject to some uncertainty. Although the agency did not provide an explanation, it appears to have concluded that the Tornado Cash entity now on the SDN list qualifies as a “partnership, association, trust, joint venture, corporation, group, subgroup, or other organization” liable to sanctions. under EO 13694.[3] Regardless of its legal status, the organization may include co-founders, the natural persons participating in a multi-signatory (multisig) wallet (which has since dissolved), operators of a Twitter account Account and a website, and other participants, including a Decentralized Autonomous Organization (DAO) (which recently only had 12 participants in a vote) and TORN token holders.[4] On these facts, OFAC may have considered that some or all of these participants constituted some unincorporated organization.

Some of the Ethereum addresses identified in the release may be under the control of this organization, potentially including an entity organized and identified as Tornado Cash or at least a group of people who set out to create and operate Tornado Cash. On the other hand, like Coin Center argue, at least some of the sanctioned addresses that are now blocked are not controlled by people, as they simply refer to the smart contract itself, which, as Coin Center describes, “automatically executes[s] when called by any user in the world by giving them the appropriate inputs. In any event, it is unclear how the identified Ethereum addresses represent Tornado Cash property or real estate interests. Representative Tom Emmer (R-MN) made a similar point to Treasury Secretary Janet Yellen in an August 23 letter seeking clarification on the scope of OFAC’s action. Notwithstanding this ambiguity, since the addresses were included in OFAC’s notice, all assets held or passing through these addresses should be treated as escrow property by U.S. Persons until OFAC removed from designation.

Looking closely at the potential implications of OFAC’s action, a few questions arise, including the following:

  • What does this mean for ownership and real estate interests in Tornado Cash, the tornado.cash website, and named addresses to block and report to OFAC?
  • How do you apply OFAC’s “50% rule” in this context?
    • The designated addresses and website probably have no other entities, except that these addresses may be associated with the DAO, as explained below. However, given the uncertainty regarding which Tornado Cash entity is subject to sanctions, it is also unclear what, if anything, it or anyone associated with the entity owns.
  • Beyond the blocking provisions, applicable prohibitions include prohibiting the provision of funds, goods or services by, to or for the benefit of Tornado Cash, and the receipt of funds, goods or services from Tornado Cash .
    • Given the lack of clarity on what (or who) the Tornado Cash entity is, it remains unclear to whom any funds, goods or services might be brought or provided to involve Tornado Cash, other than by the nature of the interaction with the blocked property or identifiers listed on the OFAC website, including the tornado.cash website and addresses.

Given these substantial uncertainties, it is not surprising that the initial fallout from OFAC’s action was swift and decisive. The block reports that Tornado Cash Discord and governance forum pages are no longer accessible, while its email, website, and GitHub code repository pages have also been removed. Meanwhile, centralized blockchain node services Infura and Alchemy also blocked access to the mixer’s front-end website, and Circle froze all USD Coin (USDC) that was in sanctioned addresses (prohibiting the receipt or transfer of USDC funds on the chain of this address). The response from the DeFi community has, unsurprisingly, been generally negative (including following the arrest of a Tornado Cash developer in the Netherlands).[6]

We will continue to monitor developments and provide additional updates as needed.

[1] According On-chain analysisSince becoming active in August 2019, Tornado Cash has received over $7.6 billion from Ethereum, 18% of which comes from sanctioned entities (noting that these transactions were “almost entirely” before the entities be sanctioned) and 11% of the funds were “stolen from other cryptocurrency services and protocols.”

[2] Entities owned, directly or indirectly, 50% or more by one or more of the sanctioned parties are also blocked.

[3] The application of sanctions to informal and/or decentralized organizations is not without precedent. For example, many terrorist groups and drug cartels also lack a formal organizational structure and are nonetheless sanctioned as “groups” or “other organizations” by relevant sanctions authorities. However, the practical application of sanctions blocking provisions to these organizations may be difficult to implement for this reason, as is found to be the case with this designation.

[4] By comparison, FinCEN (which is a separate agency within the Treasury Department’s Office of Terrorism and Financial Intelligence), issued guidance in 2019 that individuals who develop or deploy a decentralized application may “be qualified of []money transmitter[s] under the [Bank Secrecy Act]“, just like” people who use the DApp to carry out certain financial activities “. US Department of the Treasury Fin. Child Crimes Network, Application of FinCEN regulations to certain business models involving convertible virtual currencies, FIN-2019-G0001, p. 27 (9 May 2019) (last accessed 29 August 2022).

[5] As the governance token of Tornado Cash, TORN gives its holders the right to vote to decide on protocol upgrades and other developments.

[6] See for exampleJerry Brito and Peter Van Valkenburgh, “US Treasury Sanction of Privacy Tools Imposes Sweeping Restrictions on All Americans”, https://www.coincenter.org/us-treasury-sanction-of-privacy-tools-places-sweeping-restrictions-on-all-americans/; Shalini Nagarajan, “Arrest of Tornado Cash developer sparks protest in Amsterdam”, https://blockworks.co/tornado-cash-developers-arrest-sparks-protest-in-amsterdam/

[View source.]


Comments are closed.