OFAC Sanctions on Tornado Cash — August 2022

Tornado Cash is an Ethereum-based privacy mixer that allows users to deposit ETH or ERC-20 tokens and later withdraw to a different address, severing the on-chain link between source and destination.

On 8 August 2022, the US Treasury's OFAC added 44 Tornado Cash smart-contract addresses to the Specially Designated Nationals list. The designation cited the protocol's use by North Korea's Lazarus Group to launder $455M in proceeds from the Ronin Bridge hack and other exploits totalling approximately $7B since 2019. US persons were prohibited from interacting with the listed addresses.

The action was novel. OFAC had previously sanctioned individuals, entities, and specific wallet addresses controlled by sanctioned parties. Tornado Cash's contracts, by contrast, were autonomous code that anyone could call. Civil liberties organisations including the Electronic Frontier Foundation argued the sanctions targeted protected speech and lawful privacy use.

Co-founder Roman Storm was arrested in August 2023. Co-founder Roman Semenov was charged in absentia. Storm was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business; charges of conspiracy to violate sanctions and to commit money laundering deadlocked. In November 2024 the Fifth Circuit Court of Appeals ruled in Van Loon v. Department of the Treasury that OFAC had exceeded its statutory authority by treating the immutable smart contracts as "property" of a sanctioned entity. OFAC removed the contract addresses from the SDN list in March 2025 while maintaining sanctions against the founders.