The US Department of the Treasury has removed Tornado Cash from the OFAC sanctions list, reversing one of the most controversial enforcement actions in the digital asset sector. Tornado Cash is an Ethereum-based smart contract mixer designed to improve transaction privacy. Treasury said the decision followed its review of the novel legal and policy questions raised when financial sanctions are applied to activity taking place within evolving technological and legal environments.
In its statement tied to a Monday filing in Van Loon v. Department of the Treasury, the agency said it had exercised its discretion to lift the economic sanctions against Tornado Cash. That wording matters. It suggests the reversal was not simply political messaging, but a response to serious legal pressure, administrative reconsideration, and the practical difficulty of fitting decentralized blockchain software into traditional sanctions frameworks.
How the Tornado Cash dispute developed
Tornado Cash launched in 2019 as a decentralized privacy protocol on Ethereum. Its purpose was to make it harder to link deposits and withdrawals on-chain, giving users stronger transaction privacy. For some users, that made it a legitimate privacy tool. For regulators and law enforcement, however, it quickly became associated with illicit fund flows and obfuscation techniques.
The conflict escalated in August 2022, when Tornado Cash was added to the sanctions list maintained by the Office of Foreign Assets Control, or OFAC. US authorities alleged that the protocol had facilitated more than $7 billion in money laundering. That total included funds linked to North Korea’s Lazarus Group, one of the most frequently cited state-linked hacking organizations in crypto-related enforcement actions.
Once sanctioned, US persons were barred from using the service. The enforcement wave did not stop there. In 2023, co-founders Roman Storm and Roman Semenov were indicted over money laundering allegations tied to more than $1 billion in transactions. The case rapidly evolved beyond one protocol and became a broader test of whether open-source privacy software and autonomous smart contracts could be treated like sanctionable persons, entities, or property.
At the same time, six Tornado Cash users, supported by Coinbase, challenged Treasury in court. Their argument focused on the legal limits of OFAC’s authority. The central question was whether immutable or decentralized smart contracts could legally be placed under sanctions in the same manner as organizations or individuals that exercise control over assets and operations.
The courts proved decisive. A Texas federal court ruled in January 2025 that the smart contracts could not be sanctioned. Before that, the Fifth Circuit had already upheld the relevant direction in November 2024. Treasury’s latest move formalizes the practical effect of those legal setbacks and acknowledges that the original sanctions approach could not stand in its existing form.
Why Treasury changed course
Treasury’s explanation does not read like an endorsement of Tornado Cash itself. Instead, it reflects concern about how sanctions law should operate when the target is decentralized software rather than a clearly controlled entity. This is an important distinction. Traditional sanctions regimes were built around identifiable actors, institutions, or property interests. Tornado Cash forced regulators to confront whether a set of Ethereum smart contracts fits inside those categories.
The administration said its review focused on the novel legal and policy issues raised by sanctions against financial and commercial activity occurring within changing technological and legal settings. In other words, the issue was not only whether bad actors had used Tornado Cash. It was also whether OFAC had the legal basis to sanction this type of blockchain-based infrastructure in the first place.
This makes the decision notable for developers, lawyers, and compliance teams across crypto. If software code, particularly decentralized and immutable code, cannot be sanctioned in the same way as a traditional intermediary, regulators may need more tailored strategies. That could mean separating protocol code from operators, developers, front-end providers, relayers, or identifiable facilitators instead of treating them as a single sanction target.
Still, Treasury did not soften its broader enforcement posture. The agency made clear that lifting sanctions on Tornado Cash does not mean it has changed its view about the seriousness of illicit crypto activity. The move is better understood as a recalibration of legal method rather than a retreat from anti-money-laundering priorities or sanctions enforcement in the digital asset economy.
DPRK-linked cybercrime remains a central concern
Treasury used the announcement to reaffirm its intention to continue enforcing sanctions against the Democratic People’s Republic of Korea (DPRK). The agency said it remains deeply concerned about significant state-sponsored hacking and money laundering campaigns aimed at stealing, acquiring, and deploying digital assets for the benefit of the DPRK and the Kim regime.
The statement was linked to an active geopolitical context. The article specifically references the recent $1 billion+ hack involving Bybit, which was argued to have been carried out by Lazarous, described as a hacking group with DPRK ties. While the spelling differs from the more common “Lazarus,” the intended reference is clearly to the North Korea-linked threat actor that has appeared in multiple crypto theft investigations.
Treasury also warned that it will continue closely monitoring transactions that may benefit malicious cyber actors or the DPRK. It urged US persons to exercise caution before engaging in transactions that present such risks. That warning is significant for exchanges, wallet providers, market makers, compliance teams, and ordinary on-chain users. Even without Tornado Cash on the sanctions list, interactions involving stolen funds, suspicious routing, or sanctioned counterparties can still create serious legal and regulatory exposure.
So while one protocol has been removed from OFAC’s list, the larger enforcement message is unchanged: privacy technology does not shield users, platforms, or intermediaries from scrutiny when illicit funds are involved. Treasury appears eager to avoid any interpretation that this action weakens its resolve against state-backed cybercrime.
What this may mean for crypto and future cases
For many in the industry, the removal of Tornado Cash from the sanctions list will be viewed as a meaningful victory for privacy software developers and open-source advocates. The case has long symbolized a key fear in crypto: that writing or deploying code could expose developers to sanctions or criminal liability simply because third parties use the software for unlawful purposes.
At the same time, the article stresses that it is still too early to determine what the decision means for the broader Bitcoin and crypto industry. It is also unclear whether this outcome will materially affect other pending or future legal disputes, including cases against the developers of Samurai Wallet. That caution is important. A regulatory retreat in one case does not automatically establish a universal safe harbor for privacy tools, mixers, or wallet software.
The practical impact may depend on how future courts distinguish between autonomous code, developer intent, user conduct, and operational control. If regulators cannot sanction decentralized smart contracts directly, they may shift toward enforcement against interfaces, teams, custodial services, or actors who are easier to identify and regulate. That would reshape the compliance map without necessarily reducing pressure on privacy-oriented infrastructure.
US Treasury Secretary Scott Bessent summarized the government’s balancing act. He said digital assets present enormous opportunities for innovation and value creation for the American people. But he also stressed that securing the digital asset industry from abuse by North Korea and other illicit actors is essential for establishing US leadership and ensuring that Americans can benefit from financial innovation and inclusion.
That statement captures the policy direction behind the decision. Washington is not abandoning digital asset innovation, nor is it embracing unrestricted privacy infrastructure. Instead, it is trying to preserve room for innovation while insisting that national security, sanctions enforcement, and anti-abuse controls remain central. Tornado Cash may be off the OFAC list, but the broader conflict between privacy, decentralization, and regulation is far from over.