Tornado Cash Indictments May Prove to Be Just a Localized Storm After All

The Tornado Cash indictments are being viewed by many as another tipping point for crypto. In that view, how the case plays out could define how the federal government can deal with decentralized trading platforms if they’re seen as broad precedents. But the case may be much more straightforward than initial reactions suggested.

You’re reading State of Crypto, a CoinDesk newsletter looking at the intersection of cryptocurrency and government. Click here to sign up for future editions.

Tornado Crash

The narrative

Roman Storm, one of the three co-founders and developers behind the Tornado Cash mixer, was arrested last week. A second, Roman Semenov, has also been indicted. A third, Alexey Pertsev, faces trial in The Netherlands, where he was arrested last year.

Why it matters

Are law enforcement officials and federal governments going after Tornado Cash in an effort to tamp down on all efforts to make crypto transactions private? Or is the case a much more straightforward one about running a website that allowed North Korea to launder hundreds of millions of dollars’ worth of crypto?

Breaking it down

So by now you’ve seen that the U.S. Department of Justice brought charges against Roman Storm and Roman Semenov, two of the co-founders of Tornado Cash. One – Storm – was arrested last week, is now out on bail and will appear before a judge in the U.S. District Court for the Southern District of New York next week.

The indictments and arrest drew alarm from the crypto ecosystem, with concerned individuals decrying what they saw as efforts to regulate the very development and deployment of software intended to guarantee privacy in transactions.

First: A disclaimer that we don’t yet have all the facts in the case. The DOJ hasn’t presented much beyond an indictment with allegations, and some of the allegations need important details to contextualize the arguments, as we’ll get into.

As far as the allegations themselves go, there are some facts that aren’t really great for the industry: the DOJ alleged that Storm and Semenov created a program and user interface that allowed for malicious actors to launder up to $1 billion in crypto – including North Korea’s Lazarus Group, which allegedly moved “hundreds of millions” through the mixer (leading to last year’s sanctions).

“These are individuals who were allegedly helping North Korea with economic transactions, allegedly in aid of a nuclear weapons program. Those are really, really serious allegations,” said Anand Sithian, a former financial crimes prosecutor now with Crowell & Moring.

But even if the actions alleged by the government are true and Tornado Cash was used to launder money to North Korea making crypto live down to its reputation as being a tool for the dregs of humanity, the charges against the three accused are very specific and this case may not be an indictment of the industry as a whole or a power grab over privacy tools.

The charges themselves – conspiracy to operate an unlicensed money services business, conspiracy to commit money laundering and conspiracy to violate the International Emergency Economic Powers Act (in other words, violate sanctions) are all based on agreements between the indicted parties.

“Certainly, the government will want to prove the substantive charge, that he actually did these things, but did these two individuals come to a meeting of the minds as to the conduct that is alleged to violate these federal statutes? That is what the government is going to have to prove,” he said.

It may also be difficult to distinguish between the time period where the developers had control over Tornado Cash from when they didn’t, he noted. Tornado Cash’s developers famously burned their keys, arguing they no longer had the ability to unilaterally change the smart contract code.

“It’s really hard to decipher if the government actually believes that they gave up control,” he said. But, this issue may only apply to the money services business charge.

Moreover, the DOJ seems to be specifically arguing that it was the user interface at issue, rather than the smart contract itself, said Craig Timm, a senior director of anti-money laundering at the Association of Certified Anti-Money Laundering Specialists (ACAMS).

“You’ve got to think about it sort of separate in your mind, the Tornado Cash smart contract from the user interface in the website, because I think that’s exactly what the Department of Justice is doing,” he said.

It seems unlikely the charges would be brought if there was no user interface, he added.

Tornado Cash’s native TORN token is another complicating factor, Sithian said. According to the indictment, the defendants used the token to profit off of the operation of Tornado Cash as a service. The filing cites messages they sent to each other, where they allegedly discussed the need to pump TORN’s price.

They converted their TORN token holdings into stablecoins, with Storm advising Semenov and Pertsev to create new wallets and further move the funds around, the indictment said. This allegation that the accused were using Tornado Cash to pad their own accounts is another serious blow against the accused and would again seem to argue that the indictment is more narrowly tailored than an attempt to rein in the industry.

The idea that “they were in the business of making money off really bad actors [is] a compelling argument for a jury,” he said. It can help prosecutors provide a reason for why Storm and Semenov were working on Tornado Cash, as opposed to the more altruistic argument that they just wanted to defend privacy.

Timm echoed this view, saying that prosecutors don’t need to prove a motive but prosecutors would typically share one anyway for the jury.

“What [the DOJ has] done here is lay out a bunch of evidence to try to paint the picture that these guys weren’t just in it for software or development, they just weren’t good Samaritans here,” he said. “They were in this for money, and in fact, they were deceptive with their community about the money they were making [and] how they were profiting.”

Coin Center, an industry group, took a competing view, saying the indictment’s allegations suggest that Storm and Semenov remained within parameters defined by the Financial Crimes Enforcement Network (FinCEN).

“The allegations include that the defendants: (a) paid for web hosting services for a user interface that allowed users to send transaction messages to the underlying smart contracts, (b) paid for a software repository (Github) where smart contract and user interface software and documentation was hosted, and (c) had (for a time before May 2020) “complete control” over the Tornado Cash smart contracts,” research director Peter Van Valkenburgh said in a blog post.

FinCEN’s guidance went on to say that the publisher of anonymizing software would not be treated like a money transmitter. Storm and Semonov, if they were only the publishers of the Tornado Cash software, shouldn’t be treated like the operators, Van Valkenburgh wrote.

Some parts of the case may hinge around the question of whether the defendants controlled Tornado Cash as a service.

Timm said the DOJ is trying to argue that Tornado Cash wasn’t decentralized, that it was a centralized entity running a website and trying to profit off of the service being provided.

“The allegations aren’t aimed at the smart contract. They’re aimed at the user interface where they could have done any number of things that could have shut it down, they could have put controls in it, they could have done any of these things once they knew criminal money is here, but they didn’t,” he said. “And they knew that their system was then designed to conceal it and make it easier for the criminals to move that money.”

Van Valkenburgh wrote that to Coin Center’s knowledge, the defendants never had the ability to directly access user funds, which would again suggest they weren’t violating FinCEN guidance for money transmitters.

The details about exchanges that were hacked reaching out to the developers for assistance and being turned away may play in here.

Of course, what we don’t know is whether the developers said they couldn’t help the hacked exchanges or if they wouldn’t help the hacked exchanges. If they said they couldn’t because they didn’t have control over the smart contract or any aspect of the user interface that would have allowed them to help, that’s one story. If they said they wouldn’t help, but could have, that’s an entirely different one. The indictment only says the defendants responded to at least two emails from exchanges “declining to offer any assistance.”

Brian Klein, Storm’s attorney, said there was “a lot more to this story” in a statement last week.

“We are incredibly disappointed that the prosecutors chose to charge Mr. Storm because he helped develop software, and they did so based on a novel legal theory with dangerous implications for all software developers,” he said. So while it’s possible that Klein is right and that when all the details are known, this case may prove a dangerous precedent for the crypto industry, from the facts that are known at present, it looks more targeted at Tornado Cash and the actors behind it rather than something that could have a chilling effect on the ecosystem.

Stories you may have missed

The taxman cometh

The U.S. Treasury Department and Internal Revenue Service published their proposed regulation for the long-awaited “broker” definition from the 2021 Infrastructure Investment and Jobs Act, otherwise known as the bipartisan infrastructure bill, otherwise known as that thing that occupied my every waking moment for like a month and had an immediate impact on job growth*.

*(At CoinDesk, which created the regulation team after that episode.)

The proposal itself walks through a definition for the term “broker,” capturing centralized crypto exchanges, payment processors, some hosted wallet providers, some unhosted wallet providers, some decentralized exchanges, etc. The industry wasn’t immediately impressed, complaining that decentralized exchanges would have to either begin collecting know-your-customer information or otherwise shutting down.

Treasury has kicked off a comment period that ends on Oct. 30, 2023, allowing the general public to weigh in and provide feedback – especially to some of the more controversial issues, such as the decentralized exchange component.

This week

• 17:00 UTC (1:00 p.m. ET) The federal court overseeing Sam Bankman-Fried’s pending trial will hold a hearing on the defense team’s motions to have him made more available to work on his defense, limit discovery and use an advice-of-counsel defense. Read all of our coverage here, including the defense team and prosecution’s arguments. You can listen in here.

Elsewhere:

• (The New Yorker) Ronan Farrow digs into Elon Musk’s history and his place in it. This is a compelling, in-depth read.

• (The Wall Street Journal) Binance had “substantial ruble trading volumes,” the Journal reported, which clients could use to tap funds at sanctioned banks in Russia. A spokesperson for the exchange later said it would consider “a full exit” from the country.

• (Vulture) On a lighter note, Kennedy Steve – who’s quietly a celebrity in the Air Traffic Control section of YouTube – weighed in on all the recent apparent near misses at airports. His closing advice: “It’s a big sky, and the planes are really small.”

• (The New York Times) That being said, there’s been a lot of these near misses.

If you’ve got thoughts or questions on what I should discuss next week or any other feedback you’d like to share, feel free to email me at nik@coindesk.com or find me on Twitter @nikhileshde.

You can also join the group conversation on Telegram.