August 12, 2022

OFAC Sanctions Cryptocurrency Mixing Service for Allegedly Facilitating Money Laundering

You've Reached Your
Free Article Limit This Month
Register for free to get unlimited access to all OnPractice content.
Register Now
Go-To Guide:
  • OFAC has imposed economic sanctions on cryptocurrency mixing service Tornado Cash, prohibiting U.S. individuals and companies from utilizing its services.
  • Because Tornado Cash allows customers to obscure the origin of a crypto transaction, it allegedly has been exploited by criminals to launder money, including proceeds from ransomware attacks.
  • This is another step in the U.S. government's efforts to crack down on illicit financial activity in the virtual currency ecosystem.
  • The standard for violating OFAC sanctions is strict liability; accordingly, U.S. firms may wish to consult with counsel on risk mitigation given the government's focus on potential money laundering using cryptocurrency.

On Aug. 8, 2022, the Department of the Treasury's Office of Foreign Assets Control (OFAC) imposed economic sanctions on Tornado Cash, a popular cryptocurrency mixing service that allows customers to obscure the original source of virtual currency transactions by "mixing" multiple transactions and then redistributing them. While mixing may have legitimate benefits in some transactions, it also may be exploited by criminals to potentially launder cryptocurrency, including crypto received in connection with ransomware attacks.

OFAC made the sanctions designation pursuant to Executive Order 13694, which was issued in the wake of an increase in ransomware attacks and targets cyber-enabled threats to U.S. national security.[1] According to OFAC, Tornado Cash was responsible for "launder[ing] the proceeds of cybercrimes," including more than the equivalent of $455 million stolen by the Lazarus Group, a Democratic People's Republic of Korea (DPRK) state-sponsored hacking group that the United States sanctioned in 2019. Among other things, the designation of Tornado Cash has the effect of prohibiting U.S. persons from utilizing the service, as it is added to OFAC's List of Specially Designated Nationals (SDNs).

The move is but the latest signal of U.S. authorities' increased attention to the role that mixers play in the anti-money laundering landscape. In October 2020, the Department of Justice struck a cautious note on mixers in its Cryptocurrency Enforcement Framework, warning that operators of mixing services could potentially be criminally liable for money laundering.[2] In 2021, DOJ prosecuted the operator of Darknet-based mixer Helix, who admitted the service was targeted to narcotics sales and other illicit transactions.

The designation of Tornado Cash comes only three months after OFAC's first-ever designation of a mixing service,, which also was alleged to have laundered virtual currency for the Lazarus Group. Unlike, which offered more traditional centralized mixing services, Tornado Cash is a smart-contract-based mixing protocol built on the Ethereum blockchain, and it provides no custodial services. In March 2022, one of its three founders claimed that Tornado Cash's code allows the service to be run indefinitely without any control or maintenance by its developers.

The Tornado Cash example highlights the uncertainty about mixer developers' potential liability for the actions of their customers. Federal authorities may have avoided these questions for now by pursuing an enforcement-through-sanctions approach rather than more traditional criminal or civil penalties; the U.S. government typically has wider discretion and a lower burden to impose economic sanctions against non-U.S. persons. It remains to be seen whether the move marks a shift in tactics—perhaps a subtle prioritization of disruption over prosecution—or if instead it simply signals that U.S. authorities intend to use the full range of tools at their disposal to target firms they believe facilitate money laundering.

In a press release announcing its sanctioning of Tornado Cash, OFAC noted that "Treasury will continue to investigate the use of mixers for illicit purposes and use its authorities to respond to illicit financial risks in the virtual currency ecosystem" (emphasis added). Virtual currency businesses may wish to review and update, as appropriate, their Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) and sanctions programs, particularly as they pertain to cryptocurrency businesses that offer anonymizing services. Cryptocurrency firms should be mindful that sanctioned mixers such as Tornado Cash may still be capable of operating, notwithstanding being subject to sanctions. Accordingly, cryptocurrency firms subject to U.S. jurisdiction must take care to ensure that their platforms do not transact with sanctioned entities such as Tornado Cash, as OFAC sanctions violations are subject to a "strict liability" standard, meaning no intent, knowledge, or reason to know that one is dealing with a sanctioned person is required for a violation to occur.

[1] See January 2017 GT Alert.

[2] See October 2020 GT Alert.

ALM expressly disclaims any express or implied warranty regarding the OnPractice Content, including any implied warranty that the OnPractice Content is accurate, has been corrected or is otherwise free from errors.

More From Greenberg Traurig

Can a business require a consumer to submit a declaration under penalty of perjury in order to prove their identity?

By David A. Zetoony Greenberg Traurig November 22 , 2022

The regulations implementing the CCPA require that a business verify the identity of a consumer that submits a specific-information access request to a “reasonably high degree of certainty.”

FINRA Targeting Crypto Asset Retail Communications

By William B. Mack Greenberg Traurig November 22 , 2022

The Financial Industry Regulatory Authority (FINRA) in November 2022 released a targeted exam letter pertaining to communications for crypto products and services.

New York State Cannabis Control Board Releases Proposed Adult-Use Regulations

By Lynelle K. Bosworth Greenberg Traurig November 22 , 2022

On Nov. 21, 2022, the New York State Cannabis Control Board (CCB) approved draft regulations governing the Adult-Use Cannabis program.

More From White Collar Crime

Can a business require a consumer to submit a declaration under penalty of perjury in order to prove their identity?

By David A. Zetoony Greenberg Traurig November 22 , 2022

The regulations implementing the CCPA require that a business verify the identity of a consumer that submits a specific-information access request to a “reasonably high degree of certainty.”

What is the difference between a category-level access request and a specific-information access request?

By David A. Zetoony Greenberg Traurig November 21 , 2022

The CCPA and its implementing regulations identify six types of information requests that a consumer can submit to a business.

New California Law Requires Open Payments Notice to Patients

By Ming Chuang McDermott Will & Emery November 16 , 2022

On September 29, 2022, California Governor Gavin Newsom signed Assembly Bill 1278, which requires physicians and their employers to provide patients with notices about the Open Payments database starting January 1, 2023.

Featured Stories