Tornado Cash Ruling Affirms OFAC’s Broad Reach in Sanctions Enforcement

In August, Judge Robert Pitman of the federal district court for the Western District of Texas granted summary judgment for the U.S. Department of Treasury against a group of developers and users of the crypto mixer Tornado Cash, affirming the authority of the Treasury’s Office of Foreign Assets Control (OFAC) to include Tornado Cash on its specially designated nationals and blocked persons list (SDN). 

This was the first time that a federal court reviewed OFAC’s designation of a decentralized mixer, and came on the heels of OFAC sanctioning Tornado Cash in 2022. Then, it found that the mixer was used in a number of multimillion-dollar virtual currency thefts, including a $455 million heist by Lazarus Group, a Democratic People’s Republic of Korea state-sponsored hacking group. OFAC determined that since Tornado Cash’s creation in 2019, it had laundered over $7 billion in virtual currency. In issuing the designation, OFAC indicated that Tornado Cash had failed to institute controls to prevent its involvement in money-laundering transactions. 

The district court’s decision raises significant legal questions related to OFAC’s authority and the Fifth Amendment takings clause, as well as implications for the growing decentralized finance (DeFi) industry more broadly.

Key arguments

The plaintiffs argued that OFAC violated the Administrative Procedures Act (APA), the First Amendment’s free speech clause and the Fifth Amendment’s takings clause. 

APA challenge 

According to the plaintiffs, OFAC exceeded its authority by including Tornado Cash on its SDN list because Tornado Cash is not a foreign “national” or “person” within the meaning of the International Emergency Economic Powers Act (IEEPA). Further, the plaintiffs argued that even if Tornado Cash is a properly designated entity, it lacks a property interest in the deployed smart contracts that OFAC blocked. 

The court acknowledged that “person” has been defined in the regulations to mean an “individual or entity,” which, in turn, includes “a partnership, association, trust, joint venture, corporation, subgroup or other organization.” The court found that based on the plain meaning of “association,” OFAC need only establish: “(1) that Tornado Cash consists of a body of individuals, and (2) that this body furthers a common purpose.” Ultimately, the court found that Tornado Cash is an association and therefore can be designated. It held that “[s]ubstantial evidence supports the argument that founders, developers and DAO [decentralized autonomous organization] constitute ‘[a] body of persons who have combined to execute [the] common purpose’ of developing, promoting, and governing Tornado Cash.”

Further, the court found that the Tornado Cash DAO has a property interest in the deployed smart contracts because the DAO benefits from use of the protocol. The court acknowledged that OFAC provided broad definitions of the terms “property” and “interest in property” within its implementing regulations. The plaintiffs argued that the court should adopt the plain meaning of the term “property” and noted that the various examples of “property” in the regulation are all things that, consistent with the plain meaning, “are capable of being owned.” Therefore, according to the plaintiffs, the definition of “property” would not cover the concept of smart contracts, which they said are ownerless and immutable, i.e., the functionality of the smart contracts cannot be altered or stopped.

However, the court found that OFAC’s definition of property encompasses “contracts of any nature whatsoever” and cited judicial decisions outside of the IEEPA context where courts found that smart contracts are “merely a code-enabled species of unilateral contracts.” The court relied heavily on the plaintiffs’ acknowledgement that smart contracts are akin to vending machines, which the court described as “examples of unilateral contracts,” and found that neither a smart contract’s lack of human intervention nor its immutability “affect its status as a type of contract, thus, a type of property within the meaning of the regulation.” 

Finally, the plaintiffs argued that Tornado Cash does not have a property “interest” in the smart contracts. The court found that Tornado Cash has a beneficial interest based on the fact that the smart contracts it deployed have and will continue to generate revenue in the form of TORN tokens transferred to the DAO.

First Amendment challenge 

The plaintiffs also argued that OFAC’s designation of Tornado Cash violated the First Amendment’s free speech clause as it chills constitutionally protected “socially valuable speech” through contributions to political and social causes. They alleged that without the privacy offered by Tornado Cash, the ability to express views is hindered. The court rejected the argument, noting that alternative means exist to support causes anonymously.  

Takings claims

Lastly, some of the plaintiffs argued that Ether belonging to them is trapped in a Tornado Cash smart-contract pool, thereby constituting an unconstitutional taking under the Fifth Amendment. The court declined to consider this issue, noting that the plaintiffs did not move for summary judgment on this count and by failing to pursue the claim beyond the initial complaint, waived it.

Takeaways for corporate counsel and DeFi stakeholders

Given the novelty of this case, corporate counsel and stakeholders in the DeFi industry would do well to take note of the following takeaways:

Due process and the broad interpretations of ‘property’ and ‘interest’ 

The court agreed with OFAC that the smart contracts deployed by Tornado Cash were “property” and that Tornado Cash has an “interest” in the smart contracts. While there is no question that OFAC’s regulations seek to define these terms in the broadest sense possible, these sorts of ambiguous definitions can have due process and “fair notice” implications when applied to new factual scenarios in the course of an enforcement action. See Epsilon Elecs., Inc. v. U.S. Dep’t of the Treasury, 857 F.3d 913, 934 n.2 (D.C. Cir. 2017) (Silberman J., concurring).

These sorts of due process issues may not be as significant in future enforcement actions with similar factual scenarios, as this case provides the sort of notice that was arguably lacking at the time OFAC designated Tornado Cash. But in this case of first impression, these sorts of fair notice considerations were not fully explored by the district court in its decision to grant summary judgment in favor of the government. Potentially, such arguments could feature more prominently on appeal. 

Takings claims in the context of sanctions enforcement

The court’s ruling noted that plaintiffs could have made a case that their inability to access Ether trapped in a Tornado Cash smart contract pool violated the Fifth Amendment, which protects against the taking of private property by the government without just compensation. It did not provide meaningful analysis of this issue, which is similar to what many other courts have done either on preservation or national-security-based deference grounds. See e.g., Tran Qui Than v. Regan, 658 F.2d 1296, 1298–99, 1304 (9th Cir. 1981); Paradissiotis v. United States, 304 F.3d 1271, 1273 (Fed. Cir. 2002); Chichakli v. United States, 141 Fed. Cl. 633, 641 (2019).

The indefinite freezing of virtual assets of U.S. individuals not alleged to have engaged in wrongdoing, ostensibly for the public purpose of deterring behavior of a third party for national security purposes, would seem to present serious Fifth Amendment takings questions worthy of eventual judicial review on the merits.

Implications for DeFi

As discussed above, this was the first time that a federal court reviewed OFAC’s designation of a decentralized mixer. The court ultimately rejected the crux of plaintiffs’ argument that Tornado Cash is merely an autonomous software and that users rely on “immutable, autonomous, and self-executing” smart contracts. Instead, it sided with the government’s view that the structure of Tornado Cash met the definition of an association, thereby falling within OFAC’s authority to sanction. Notably, the court rejected the notion that a DAO is an anonymous, structureless body that cannot hold property interests or be regulated.

Following the decision, DeFi developers, members of governing organizations and users should be on notice that projects with which they are involved, even if they are seemingly decentralized, can become the subject of U.S. sanctions given OFAC’s broad authority. For users, this creates a risk that funds will be trapped.

The recent indictments against Tornado Cash’s co-founders show that there is risk of criminal liability for developers and others involved in the governance of such projects, even if the projects are decentralized.