U.S. Appeals Court limits OFAC’s sanctions authority in cryptocurrency mixer case

Tornado Cash is a virtual currency mixer that operates on the Ethereum blockchain. It relies on a  series of “smart contracts” comprised of software protocols to collect, pool, and shuffle cryptocurrency transactions, offering its users privacy by anonymizing digital asset transactions.  Beginning August 8, 2022 the US Department of Treasury’s Office of Foreign Assets Control (“OFAC”)  designated Tornado Cash and its related wallet addresses as Specially Designated Nationals (“SDNs”) under Executive Order (“Executive Order”) 13694, which was issued pursuant to the International Emergency Economic Powers Act (“IEEPA”). OFAC explained that it was designating Tornado Cash because its cryptocurrency mixing protocol was (allegedly) used by North Korea-linked hackers to launder stolen cryptocurrency proceeds. As a result of the designation, any transaction involving the “property” and “property interests”¹ of Tornado Cash and US Persons or any other US nexus (e.g., US-based services, US-based servers, US Dollar payments that transit through the US financial system) required OFAC authorization via a license.  associated with Tornado Cash. 

After the OFAC designation, six Tornado Cash users sued Treasury, arguing that the Tornado Cash immutable smart contracts are (i) not “property” under IEEPA, and (ii) that Tornado Cash is not an “entity” that could be targeted through IEEPA. At the trial stage, the Western District of Texas granted summary judgment in favor of Treasury. The plaintiffs, who included individuals seeking privacy for donations to Ukraine and employees of  the cryptocurrency exchange  who funded the litigation , appealed the trial court decision to the U.S. Court of Appeals for the Fifth Circuit (“Fifth Circuit”).

On November 26, 2024, the Fifth Circuit reversed the lower court decision and overturned Tornado Cash’s SDN designation. The Fifth Circuit published an opinion  saying that Tornado Cash’s lines of open-source autonomously-operated and immutable software code do not constitute “property,” and therefore are outside of the scope of OFAC’s sanctions designation authority. 

Please see below for further details on Tornado Cash and potential implications of the Fifth Circuit decision.

How Tornado Cash works

Tornado Cash is a decentralized, non-custodial cryptocurrency mixer that relies on software protocols called “smart contracts” to obscure the identity of cryptocurrency wallets by "mixing" their tokens and transactions. Its unique decentralization stems from an open-source codebase managed by a decentralized group whose membership is, in effect, open to the public. As a non-custodial service, Tornado Cash never gains custody of users' funds during the mixing process and does not collect fees for its services. Users deposit tokens into a smart contract and receive a key to withdraw an equivalent amount after the tokens have been mixed to obscure their origins. Tornado Cash’s smart contracts, generally, are immutable, meaning that once they are deployed as immutable, they cannot be altered, removed from the blockchain, or reclaimed by anyone, including those who deployed them. Additionally, due to the open-source nature of its code, anyone with technical skills can utilize the immutable smart contracts at issue in the case. 

The Fifth Circuit redefined the scope of “property” actionable through IEEPA

IEEPA allows the blocking of “any property in which any foreign country or a national thereof has any interest.” The Fifth Circuit ruled that the so-called “immutable smart contracts” associated with Tornado Cash cannot be considered property as they cannot be owned, are neither contracts nor a service, and cannot generate a profit for their creators.

The Fifth Circuit wrote that the plain meaning of property is that it is “capable of being owned.” Ownership entails “the right to possess, use, and dispose of something,” and the right “to exclude everyone else from interfering with it.” Applying this definition to the case, the court wrote that immutable smart contracts are not capable of being owned, because it is not possible for anyone, including the managers of Tornado Cash, to exclude anyone else from using the smart contracts. Nor could anyone alter existing immutable smart contracts. As the court noted, even with the OFAC’s sanctions in place, the immutable smart contracts “remain accessible to anyone with an internet connection.” Thus, the court held that smart contracts are not property. 

The Fifth Circuit also rejected Treasury’s contention that immutable smart contracts are property because they are (i) contracts, (ii) intangible assets like patents or copyright, or (iii) a kind of service. The court wrote that smart contracts, despite their name, lack the fundamental components of contracts as they do not require “an agreement between two or more parties” to use, and because they are, by design, irrevocable. Nor are smart contracts analogous to patents or copyright, because Tornado Cash cannot profit from them or claim ownership over them. Finally, the court wrote that smart contracts are not a service, but rather a software that provides the means to perform a service. 

The Fifth Circuit declined to address other issues raised by the plaintiffs, including the question of whether Tornado Cash should be considered an actionable “entity” within the meaning of EO 13694. EO 13694 defines “entity” as a “partnership, association, trust, joint venture, corporation, group, subgroup or other organization.” Tornado Cash’s decentralized nature – with no identifiable individual or group responsible for its management and operation – and its non-custodial method of operation differentiate it from other cryptocurrency mixers that OFAC had previously sanctioned, which were controlled by and gave profits to identifiable individuals or groups. The district court in this case had ruled that Tornado Cash was an “association” and thus an actionable entity. 

Despite its ruling in favor of Tornado Cash, the Fifth Circuit nevertheless recognized the negative implication of removing certain technologies from OFAC’s sanctioning authority. It wrote that Congress has the responsibility to update IEEPA in order to capture these technologies. 

Client implications

This ruling may curtail OFAC’s sanctions designation authority and limit the Treasury’s ability to act against providers of decentralized, open-source cryptocurrency mixers, tumblers, and other privacy-enabling technologies that can be misused by U.S. adversaries. In addition, this ruling may have implications for OFAC’s ability to target other kinds of open-source code and software if the creators do not control its use or profit from it, even when it is used by malicious actors. However, this ruling narrowly focused on whether the open-source code and immutable smart contracts at issue could be sanctioned under existing U.S. law, and did not touch on whether the developers or publishers of such code or software could be subject to sanctions or other penalties. Specifically, the founders of Tornado Cash have been charged with criminal violations of money laundering, sanctions, and unlicensed money transmission laws.

There is one additional challenge to the Tornado Cash designation proceeding in the 11th Circuit. The plaintiffs in that case also appealed an unfavorable district court ruling. The court heard oral arguments on November 11, 2024, and a decision is expected next year. If the 11th Circuit rules in favor of Treasury, the resulting circuit split may increase the likelihood of Supreme Court review.  

Authored by Mark Ye, Deborah Wei, Elizabeth Boison, Julia Diaz and Aleksandar Dukic.