In an opinion issued on November 26, 2024, a unanimous three-judge panel of the United Staes Court of Appeals for the Fifth Circuit reversed a lower court’s decision and held that the United States Treasury Department did not have the right to sanction Tornado Cash because the statute that Treasury relied on authorized sanctions against “property” and Tornado Cash is not property. This blog post is a summary of the content of the court’s opinion.
The Tornado Cash decentralized, open-source software project was developed by a group of contributors who uploaded a series of smart contracts to the Ethereum blockchain in 2019. The Tornado Cash crypto transaction software protocol facilitates anonymous transactions by obfuscating the origins and destinations of digital asset transfers. More specifically, a set of Tornado Cash developed smart contracts that provide increased anonymity by “collect[ing], pool[ing], and . . . shuffl[ing] the cryptocurrencies deposited by many users.” These smart contracts are called “mixers.”
At a high level, the way that Tornado Cash works is that users first deposit crypto into a specific “pool” smart contract based on the amount and type of crypto they want to mix. For example, someone who wants to deposit and withdraw 100 Ether would start by sending 100 ETH to the “100 ETH Pool Contract.” Depositors then receive keys or a password entitling the holder to withdraw the same amount from a given pool, but this withdrawal can be made to an entirely different wallet than the depositing wallet, thus “sever[ing]” “any public link between the deposit and withdrawal addresses.”
There are legitimate uses for mixers. Some law-abiding cryptocurrency users employ mixers to maintain anonymity concerning their net worth, spending habits, and donations to political causes. Mixers can also be used to thwart criminals that would use this information to identify potential victims or set up phishing schemes. For example, plaintiff Joseph Van Loon sought to use Tornado Cash to run a blockchain service without falling prey to malicious cyberattacks. Plaintiff Tyler Almeida used Tornado Cash to anonymously donate to the Ukrainian war effort because he was worried that Russian hacker groups would target him specifically if they were able to easily trace the donation back to him.
But mixers are also “go-to tool[s] for cybercriminals” seeking to launder stolen cryptocurrency. Nearly a quarter of funds sent to mixers in 2022 were tied to money laundering efforts. Most relevant to this case, North Korea, through one of its cybercriminal organizations known as the Lazarus Group, hacked and stole almost one billion dollars’ worth of cryptocurrency. Because that dirty money needed to be laundered before it could be cashed out for traditional fiat currencies, North Korean hackers turned to mixers. More than 65 percent of North Korea’s dirty crypto went through mixers in 2021.
The International Emergency Economic Powers Act (IEEPA) allows the President to exercise extraordinary economic powers, including blocking “any property in which any foreign country or a national thereof has any interest.” In late 2022, Treasury, through its Office of Foreign Assets Control (OFAC), blacklisted Tornado Cash for its role in laundering virtual currency for malicious cyber actors. More specifically, some transactions using Tornado Cash software involved the North Korean Lazarus Group. By adding Tornado Cash to the list of Specially Designated National and Blocked Persons (SDN), OFAC imposed an across-the-board prohibition against any dealings with Tornado Cash “property,” which OFAC defined to include open-source computer code “smart contracts.”
Six users of Tornado Cash brought suit alleging Tornado Cash’s inclusion on the SDN list exceeded OFAC’s statutory authority. The district court disagreed, granting summary judgment to the Treasury Department and finding Tornado Cash subject to OFAC’s sanctioning authority. The plaintiffs appealed to the Fifth Circuit.
For the Fifth Circuit, the language of the statute is the starting point and IEEPA vests the President with the authority to regulate (or block) “property” in which a foreign “national” or “person” (or “entity”) has an “interest.” Although the statute does not define “property,” property has a plain meaning: It is capable of being owned. The immutable smart contracts at issue in this case are not property because they are not capable of being owned.
Treasury argued that that OFAC’s definition of property includes “contracts of any nature whatsoever.” The Fifth Circuit responded that, contrary to that argument, and the misleading name of the software, the immutable “smart contracts” are not actually contracts because contracts require “[a]n agreement between two or more parties,” whereas immutable smart contracts have only one party in play.
The immutable smart contracts at issue in this case are not “property” under the word’s common, ordinary meaning or under OFAC definitions. Thus, the Fifth Circuit held, Tornado Cash’s immutable smart contracts cannot be blocked under IEEPA, and OFAC overstepped its congressionally defined authority in doing so.
The court recognized the real-world downsides of certain uncontrollable technology falling outside of OFAC’s sanctioning authority and noted that presidential administrations are rightly concerned with malicious cyber-enabled activities. But it also pointed out that “our Constitution’s ingenious design demands that judges be sticklers when it comes to decoding legislative text” and stated that “mending a statute’s blind spots or smoothing its disruptive effects falls outside our lane.” IEEPA was enacted in the 1970’s and perhaps Congress will update the statute to target modern technologies like crypto-mixing software. But legislating is for Congress, not for the courts.
It was reported that Coinbase bankrolled the lawsuit. Paul Grewal, Coinbase’s chief legal officer, celebrated the Fifth Circuit’s ruling in the following posts on X: “Privacy wins. This is a historic win for crypto and all who cares about defending liberty.” He added, “No one wants criminals to use crypto protocols, but blocking open source technology entirely because a small portion of users are bad actors is not what Congress authorized. These sanctions stretched Treasury’s authority beyond recognition, and the Fifth Circuit agreed.”
There was also a direct impact on the price of the Torn, the Tornado Cash token. For most of calendar year 2024 it traded at about $2 or less. On November 25, 2024, the day before the Fifth Circuit’s decision, it traded at $3.49. As this post is being written on December 3, 2024, TORN is trading at $18.14.
