Tornado Cash Sanction Has Wider Liability Implications For Crypto Sector

On August 8, 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) sanctioned a virtual currency mixer, Tornado Cash, and listed it as a Specially Designated National (“SDN”). OFAC alleged that Tornado Cash was used to launder more than $7 billion worth of virtual currency since it was created in 2019. As a result, U.S. persons are prohibited from dealing with Tornado Cash and required to block all property of Tornado Cash– meaning any funds routed through Tornado Cash must be frozen. This aggressive and novel action has triggered a debate between law enforcement and privacy advocates that is playing out in both the courts and the press.

U.S. Sanctions Governing Virtual Currency

While people use virtual currency for many legitimate purposes, the U.S. government has identified clear national security concerns associated with their use. For example, the technology has been used to further a variety of illicit activities, including sanctions evasion, money laundering, terrorist financing, ransomware demands, and fraud. This activity has caught the attention of OFAC, the U.S. government office that implements and administers U.S. economic sanctions. OFAC’s purpose is “to prevent targets such as terrorists, international narcotics traffickers, weapons of mass destruction proliferators, and perpetrators of serious human rights abuse from accessing the U.S. financial system for purposes contrary to U.S. foreign policy and national security interests, and to change the behavior of such targets.” While sanctions typically target broad regions or countries, governments, or specific individuals and entities, OFAC has begun to adapt its typical sanctions playbook to govern the use of cryptocurrencies. Currently, sanctions involving virtual currency transactions or wallets derive from a number of executive orders implementing sanctions programs, including those related to North Korea, Iran, cybercrime, and Russia.

To alert the virtual currency industry to the sanctions restrictions and prohibitions with which they may not be familiar, OFAC has issued specific industry guidance. While helpful, this guidance also puts the industry on notice that OFAC rules apply and that the industry must meet its compliance obligations. The stakes are especially high since penalties for violations are imposed under a “strict liability” standard. In other words, covered businesses and individuals will be held civilly liable for violations even if they did not know they were violating or intending to violate sanctions. Penalties can amount to over $300,000 per violating transaction and add up quickly. For example, on October 16, 2022 OFAC settled with Bittrex, a virtual currency exchange, for over $24 million.

On the other hand, OFAC encourages parties to voluntarily self-disclose any suspected or potential violations in exchange for the chance at significantly lower penalties. In such cases, lack of knowledge or intent, along with other factors, including maintaining a compliance program and cooperating with OFAC, can result in a further reduced penalty, or even only a warning letter.

The Designation of Tornado Cash and the Debate over Privacy, Free Speech, and Law Enforcement Objectives

On August 8, 2022, OFAC sanctioned Tornado Cash, alleging that it was used to launder more than $7 billion in virtual currency. This included over $455 million stolen by a designated North Korean government-sponsored hacking group that committed the largest known virtual currency theft. This designation has been widely seen as a significant, novel, and aggressive enforcement action, which OFAC may be using to broaden the scope of its regulatory authorities. The sanction relied on authorities granted to OFAC under Executive Order 13694 (“EO 13694). EO 13694, authorizes the listing of “any person” determined to be responsible, complicit in, or engaged directly or indirectly in cyber-enabled activities that are likely to result in or contribute to a threat to U.S. national security, foreign policy, or economic health or financial stability of the United States. However, it is not clear that Tornado Cash, as a virtual currency mixer, falls under the definition of “any person.”

EO 13694 defines “person” to mean “an individual or entity,” and the term “entity” to mean “a partnership, association, trust, joint venture, corporation, group, subgroup, or other organization” Tornado Cash does not appear to fall under any of these terms. Specifically, Tornado Cash is neither a person nor an entity. Rather, it is autonomous code, operating a smart contract without ownership or control by any person or entity. In contrast, the previous designation of Blender.io, another virtual currency mixer, is distinguishable from Tornado Cash because it ultimately is controlled by individuals who can be sanctioned (and importantly, who can contest the designation). The Tornado Cash designation, however, includes smart contracts not controlled by any person that can be used to execute and mix virtual currency for any user without requiring control or custody by any third party.

The Tornado Cash designation prompted lawsuits alleging that OFAC overstepped its authority by designating software code, which is neither a person nor entity and which cannot avail itself of due process to remove it from the SDN list, and is infringing on the rights of Tornado Cash users. Critics noted that the designation appears to be at odds with OFAC’s stated goal of changing the behavior of its targets. As software code, the designated smart contract cannot change its behavior. Additionally, lawsuits allege that the action infringes on the constitutional rights of individuals seeking to use Tornado Cash for legitimate purposes to protect their privacy in a blockchain system that records every transaction publicly. The Electronic Frontier Foundation is representing an individual challenging the sanctions as a violation of constitutional free speech rights.

OFAC has clarified that interacting with the Tornado Cash code would not necessarily violate the sanctions as long as individuals are not engaging in transactions using the code. This clarification does not satisfy the criticisms of privacy advocates and others, who continue to call for further explanation from OFAC and to fight the designation through the courts. Nonetheless, the sanction demonstrates OFAC’s continuing efforts to identify and prevent the illicit use of virtual currency. As this is a clear national security priority for the U.S. government, we only expect to more and potentially even increased enforcement relating to trade in virtual currency – whether through traditional sanctions mechanisms or evolving governance tools. Given the shifting regulatory terrain, anyone handling, facilitating, or operating in the virtual currency environment should carefully consider their risk exposure and take appropriate measures to reduce that risk.

About the Authors

Christian C. Contardo, Doreen Edelman, Laura Fraedrich and Abbey Baker are attorneys with US law firm Lowenstein Sandler LLP.