Tornado Cash sanctions
The August 2022 designation by the US Treasury of a crypto mixing service used by North Korean hackers, reversed after an appeals court held that an immutable smart contract was not property that could be sanctioned.
A mixer takes in crypto assets from many users and returns them to new addresses, breaking the visible link between where funds came from and where they go. The service serves legitimate privacy as much as the laundering of stolen proceeds. By designating not a person but a set of smart contracts, the US Treasury extended sanctions to software that runs with no operator. The legal question was whether code that no one can change or own counts as property under the emergency economic powers statute. For ransomware victims and their insurers, the case shows that the sanctions list can target payment infrastructure rather than a group, and that it can also come off the list.
On August 8, 2022, OFAC designated Tornado Cash, through which more than 7 billion dollars had flowed since 2019, including more than 455 million stolen by the Lazarus group. On November 26, 2024, the Fifth Circuit Court of Appeals held in Van Loon that its immutable contracts were not property, and the Treasury removed Tornado Cash from its list on March 21, 2025.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.