Tornado Cash is an Ethereum-based privacy mixer launched in 2019 that lets users deposit ETH or ERC-20 tokens and withdraw them to a different address with no on-chain link between deposit and withdrawal. Built on zero-knowledge proofs (zk-SNARKs) deployed as immutable smart contracts. Sanctioned by US Treasury OFAC in August 2022, with the 2024 Fifth Circuit ruling partially reversing the legal posture by holding that immutable smart contracts cannot be sanctioned as property.
What it means in practice
The 2022 sanctions made Tornado Cash the structural test case for crypto-privacy regulation. OFAC’s designation prohibited US persons from interacting with the protocol smart contracts, treating the contracts themselves as the SDN-listed entity. The protocol continued to function (immutable code on a public blockchain cannot be shut down), but every US-incorporated front-end (Uniswap, MetaMask, Coinbase Wallet) blocked Tornado Cash interactions. The 2024 Van Loon v. Treasury ruling held that OFAC overreached by sanctioning property that was not actually owned by the sanctioned entity (the contracts were autonomous). OFAC delisted the smart contracts in March 2025 while maintaining sanctions against the entity Tornado Cash and individual developers. The Roman Storm criminal trial (one of the developers, prosecuted on money-laundering and sanctions-evasion charges) produced a hung jury in 2025; the legal posture remains contested.
Where it shows up
Used by: Ethereum users seeking transactional privacy on a public-by-default blockchain (the privacy use case is real and predates the sanctions), and (in the OFAC framing) by the Lazarus Group and other sanctioned actors laundering proceeds of crypto theft. The dual-use problem is structural: a privacy tool that works for journalists evading authoritarian-state surveillance also works for North Korean state hackers, and the regulatory response has not yet found a stable compromise. For legitimate Predaxia readers: any address that has ever interacted with Tornado Cash may be flagged at major exchange deposits, may face KYC re-verification, and may produce compliance friction even when the original interaction was legitimate. The defensive posture is awareness rather than continued use.
What you can change today
Three considerations. First, do not interact with Tornado Cash if you are a US person; the legal posture is unstable and the compliance friction at every major exchange remains significant regardless of the Van Loon ruling. Second, if your privacy needs justify on-chain mixing, consider Monero (privacy by design, not retrofit; not subject to the same sanctions framework as Tornado Cash) for the legs that need privacy, and accept stablecoin or BTC pseudonymity for the legs that do not. Third, for legitimate research, journalism, or compliance investigation that requires understanding Tornado Cash flows, use blockchain-forensics tooling (Chainalysis, TRM Labs, Elliptic) which surfaces the public-blockchain flows without requiring direct interaction with the sanctioned protocol.