U.S. Treasury Clarifies Key Points on Tornado Cash Sanctions

A month after it first added Tornado Cash to its sanctions list, the Treasury Department has acknowledged that the protocol was not only used by cybercriminals.

New Guidance for Law-Abiding Users

The United States Treasury Department has finally responded to some of the questions raised by the Tornado Cash ban.

The Treasury’s website was amended today to include clarifications about the sanctions leveled against Tornado Cash on August 8. The new guidelines primarily address law-abiding U.S. citizens’ concerns regarding interacting with the protocol.

Tornado Cash is an Ethereum-based privacy protocol that allows users to obfuscate their transactions on the blockchain. The Office of Foreign Assets Control (OFAC), claiming the platform was popular among money-launderers, cybercriminals, and North Korean hacking syndicates like Lazarus Group, added the protocol to its sanctions list on August 8. The crypto industry was quick to comply: Circle, Github, Infura, and Alchemy were among the first to blacklist Ethereum addresses that had interacted with Tornado Cash, and major exchanges such as Coinbase and Kraken soon followed suit.

According to the new guidance, U.S. citizens who began transacting with Tornado Cash before August 8 and did not withdraw their funds before the sanctions announcement may now require a license from OFAC to engage with the protocol once again to unblock their funds. Users will be required to provide information such as wallet addresses, transaction hashes, time stamps, and currency amounts. OFAC claimed it would have a “favorable licensing policy,” indicating the department would likely make the process easy for applicants.

The Treasury also addressed the issue of “dusting.” Crypto wallets cannot prevent inbound flows, meaning that malignant actors can send cryptocurrencies from Tornado Cash into wallets that belong to other people. Television host Jimmy Fallon, Ethereum creator Vitalik Buterin, and Coinbase CEO Brian Armstrong have already suffered from a dusting attack, among others. OFAC stated that while regulations technically apply to these transactions, victims of dusting attacks could file a report stating they’d received blocked property. It furthermore stated that it would not prioritize enforcement against delayed reports (which normally must be filed within 10 days).

Lastly, OFAC stated that while transacting with the Tornado Cash protocol is strictly prohibited under U.S. sanctions laws, interacting with the open-source code itself is not illegal. This means that copying the protocol’s code, sharing it online, including it in written publications, or teaching about it is still possible for U.S. citizens. The Treasury added that visiting the Tornado Cash website itself, or archives of it, was not prohibited.

The Treasury Softens Its Stance (A Bit)

The Treasury’s new guidance provides welcome clarifications for law-abiding users of the Tornado Cash protocol in the United States. But more importantly, it implicitly acknowledges that the protocol can, in fact, be used for legitimate reasons. This is a meaningful shift from OFAC’s initial stance: Secretary of State Anthony Blinken had claimed on Twitter that Tornado Cash was a “DPRK state-sponsored hacking group” when the sanctions were enacted on August 8. However, the tweet was quickly taken down. The clarifications admit the possibility that not all Tornado Cash users were using the protocol for money-laundering and provide recourse for the law-abiding who saw their funds frozen as a result of the sanctions.

It’s possible these clarifications are partly the result of the crypto industry’s strong pushback against the ban. Circle CEO Jeremy Allaire, Kraken CEO Jesse Powell, and Coinbase CEO Brian Armstrong were among those strongly criticizing the sanctions; Coinbase furthermore announced that it was funding lawsuits brought against the Treasury by six legitimate Tornado Cash users. 

The new guidance still falls short of addressing crucial questions, however. As Congressman Tom Emmer (R-MN) pointed out, the Tornado Cash ban is a “divergence from OFAC precedent” in the sense that it targets a piece of open-source software and not a person or an entity. The legality of such a move was questioned by Armstrong, as well as crypto advocacy groups such as Coin Center. Furthermore, Tornado Cash developer Alexey Pertsev is still held in prison in the Netherlands without charges. Pertsev may have been arrested solely for his contribution to a protocol that the Treasury now acknowledges may provide legitimate use-cases.

Disclaimer: At the time of writing, the author of this piece owned BTC, ETH, and several other cryptocurrencies.