tl;dr
Despite the delisting of Tornado Cash smart contracts by the US Treasury Department’s Office of Foreign Assets Control (OFAC) in March, developers and operators of decentralized privacy protocols remain at risk of US sanctions enforcement. A recent report highlights that although the Fifth Circuit C...
Despite the US Treasury Department’s Office of Foreign Assets Control (OFAC) delisting Tornado Cash smart contracts in March, developers and operators of decentralized privacy protocols continue to face the threat of sanctions enforcement under the Treasury’s broad authority.
A recent report highlights that while the Fifth Circuit Court of Appeals ruled that Tornado Cash’s immutable smart contracts do not qualify as property under the International Emergency Economic Powers Act (IEEPA), OFAC retains the power to sanction mutable protocols and their developers. This was exemplified by OFAC’s ongoing sanctions against Tornado Cash co-founder Roman Semenov, citing alleged indirect assistance to North Korea.
The Treasury’s enforcement strategy extends liability to developers based on the downstream use of their software by sanctioned entities, despite a lack of clear legal guidelines on liability thresholds. This approach places creators of privacy tools in a regulatory gray zone, with the risk of sanctions and criminal charges hinging on how their technology is used rather than intent.
The report also reveals ambiguity in OFAC’s designation standards, especially regarding decentralized software and anonymous users. The broad scope of cyber-enabled threat and North Korea sanctions leaves unclear how OFAC differentiates legal frameworks or defines “support” for illicit activities.
Although Tornado Cash’s smart contracts were removed from the Specially Designated Nationals list, OFAC framed this as a discretionary move without admitting fault or limiting its regulatory reach, preserving the ability to reimpose sanctions if circumstances change.
The final court ruling is still pending, with possible wide-reaching implications for future sanctions on decentralized finance (DeFi) protocols. Meanwhile, privacy tool developers operate amid legal uncertainty, as enforcement actions may focus more on perceived use cases of their software than clear legal boundaries.