Cryptocurrency update: OFAC releases FAQs on its sanction of crypto mixer Tornado Cash

By John Bassilios

A cryptocurrency mixer known as Tornado Cash was sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC) in August 2022. This is not the first time that a cryptocurrency mixer has been sanctioned by OFAC, with Blender.io being sanctioned in May 2022. Unlike Blender, Tornado Cash is an open-sourced self-executing protocol.

The sanction of Tornado Cash therefore marks the first time that a software, rather than a person, has been sanctioned by OFAC. This article provides an overview of the sanction and OFAC’s recent release of FAQs.

What is Tornado Cash?

Tornado Cash is an open-sourced software project comprising a collection of smart contracts on the Ethereum blockchain. The smart contracts enable users to transact on Ethereum privately through a mixing process. Tornado Cash’s smart contract code is carried out automatically, meaning no person controls the operation of the smart contracts.

Cryptocurrency has a reputation for anonymity as it is possible to enter into transactions with only the other party’s wallet address. However, cryptocurrency is not truly anonymous as the nature of blockchain makes it possible to trace all transactions occurring through an account. The purpose of cryptocurrency mixing is to enhance the privacy of its users, by mixing funds together and distributing them at random in order to obfuscate the trail of funds.

The nature of a mixing service makes it susceptible to abuse by cybercriminals as a method of money laundering. Both Blender and Tornado Cash were used in virtual asset heists by Lazarus Group, a Democratic People’s Republic of Korea state-sponsored hacking group that was sanctioned by the US Treasury in 2019.

Impact of the sanction

OFAC is responsible for administering economic and trade sanctions based on US foreign policy and national security goals. An equivalent authority in Australia is the Australian Transaction Reports and Analysis Centre (AUSTRAC).

OFAC’s sanction requires all property and interests in property of Tornado Cash in the US or held by US persons to be blocked and reported to OFAC, including transactions to US persons or within the US that involve any property of designated or blocked persons. Practically speaking, as transactions occur automatically under a smart contract, it is not possible to block the transaction itself. Accordingly, cryptocurrency wallet addresses that receive cryptocurrency from Tornado Cash will be blocked.

In response to the sanction, some cryptocurrency users (including high-profile individuals such as Coinbase CEO Brian Armstrong and Ethereum founder Vitalik Buterin) have suffered from ‘dusting attacks’. A dusting attack involves sending a large number of victims tiny amounts of unsolicited cryptocurrency from Tornado Cash in an attempt to have their accounts blocked by OFAC, demonstrating an unintended consequence of the sanction.

Legality of the sanction

It is questionable whether OFAC has overstepped its statutory authority in sanctioning a software.

The sanctioning action was taken pursuant to Executive Order 13694, which authorises the sanction of a ‘person’ (described as an individual, partnership, association, trust, joint venture, corporation, group, subgroup or other organisation).

A non-profit crypto advocacy group, Coin Center, released analysis on 15 August 2022 discussing why it believed that OFAC has overstepped its statutory authority and violated constitutional rights.

These concerns had been shared by US Senator Tom Emmer, who sent a letter dated 23 August 2022 to the US Treasury Secretary raising several concerns with the sanction, including whether OFAC considers Tornado Cash to be controlled by a person, the impact of the sanction on innocent US persons and the inability for OFAC to uphold the appeals process.

OFAC releases FAQs

To address the public response to the sanction, on 13 September 2022 OFAC released a list of FAQs. The FAQs provide responses to the following questions.

• What is prohibited as a result of OFAC’s designation of Tornado Cash?
  OFAC states that the designation included certain virtual currency wallet addresses associated with Tornado Cash, as well as the URL address for Tornado Cash’s website. It also clarifies that the prohibition does not extend to interacting with open-source code itself or visiting the historical Tornado Cash website through archives.

• Can US persons engage in transactions involving identified Tornado Cash virtual currency wallet addresses absent a specific license from OFAC?
  OFAC confirmed that US persons are prohibited from engaging in transactions involving identified virtual currency wallet addresses unless a specific licence is obtained.

• Do OFAC reporting obligations apply to ‘dusting’ transactions?
  OFAC states that while technically the regulations would apply to dusting transactions, OFAC would not prioritise enforcement against delayed receipt of any reports of blocked property.

• I sent virtual currency to Tornado Cash but did not complete the mixing transaction or otherwise withdraw my virtual currency before Tornado Cash’s August 8, 2022 designation. How can I complete the transaction or withdraw my virtual currency without violating US sanctions regulations?
  OFAC permits affected US persons to apply for a specific licence authorising them to withdraw their cryptocurrency from Tornado Cash. As part of the licensing request, the affected person should be prepared to provide all relevant information regarding their transaction with Tornado Cash