Fifth Circuit Rules on Tornado Cash: OFAC's Sanctions Authority and Its Limits Over DeFi
R Tamara de Silva
Summary: In Van Loon v. Department of Treasury, the Fifth Circuit Court addressed whether the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) exceeded its authority by sanctioning Tornado Cash, a decentralized cryptocurrency mixing protocol, under the International Emergency Economic Powers Act (IEEPA). OFAC had targeted Tornado Cash for facilitating the laundering of illicit funds, including cryptocurrency tied to North Korean hackers. Central to the case was whether Tornado Cash’s immutable smart contracts, a type of autonomous blockchain-based software, constituted "property" that could be sanctioned under IEEPA.
On November 27, 2024, the court ruled in favor of the plaintiffs, finding that immutable smart contracts are not "property" under the plain meaning of the statute. It reasoned that property requires ownership and control, both of which are absent in the case of immutable smart contracts. These contracts, once deployed on the blockchain, operate autonomously and cannot be altered or controlled by any individual or entity, including their original developers.
Additionally, the court rejected OFAC’s argument that the smart contracts fell under the definition of "contracts of any nature" or "services of any nature" within the agency’s regulatory framework. It determined that immutable smart contracts lack the mutual obligations or human agency required to qualify as traditional contracts or services.
This decision emphasizes the limitations of existing statutory frameworks, such as IEEPA, in addressing decentralized technologies like blockchain. While the court acknowledged the national security concerns involved, it concluded that Congress, not the courts, must address these gaps in the law. The ruling clarifies the statutory boundaries of OFAC’s authority and sets a significant precedent for regulating emerging technologies in decentralized finance.
In late 2022, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, an open-source cryptocurrency mixing protocol, alleging its use in laundering illicit funds, including assets tied to North Korean cybercriminals. This designation barred any dealings with Tornado Cash’s property, including its smart contracts. Plaintiffs, including Tornado Cash users, challenged OFAC’s authority under the International Emergency Economic Powers Act (IEEPA). The Fifth Circuit reversed the district court’s decision, ruling that Tornado Cash’s immutable smart contracts are not "property" under the statute.
The decision can be read here.
Facts of the Case
Tornado Cash is a decentralized software project that uses "mixers,” which are smart contracts that pool and shuffle cryptocurrency deposits to enhance privacy. Some of these smart contracts are immutable, meaning they cannot be altered or controlled by their creators.
OFAC cited Tornado Cash for facilitating transactions tied to the Lazarus Group, a North Korean hacking organization, which reportedly used the platform to launder stolen cryptocurrency for financing weapons programs.
The plaintiffs argued that OFAC exceeded its authority because Tornado Cash’s immutable smart contracts are not "property" under IEEPA, and the sanctions unjustly blocked lawful uses of the software.
Mixers and Smart Contracts
Cryptocurrency mixers, like Tornado Cash, enhance privacy by pooling and anonymizing digital transactions. Users deposit cryptocurrency into a pool and later withdraw the same amount to a different wallet, severing the traceable link between addresses.
Smart contracts are self-executing code on blockchain networks. Immutable smart contracts, once deployed, cannot be altered or controlled, operating autonomously without human intervention.
To read more about how smart contracts and DeFi platforms are reshaping regulatory challenges, read- Comment Letter to the SEC: A Call for a Tailored Regulatory Framework for DeFi.
The Fifth Circuit's Property Determination in Van Loon v. Department of Treasury
An interesting aspect of the Fifth Circuit's decision is its analysis of whether Tornado Cash’s immutable smart contracts could be considered "property" under IEEPA. The court conducts a rigorous examination of the statutory definition of "property," incorporating both its plain meaning and OFAC’s regulatory definitions.
The Plain Meaning of Property
The court begins by grounding its analysis in the ordinary, contemporary meaning of "property" as it would have been understood when IEEPA was enacted in 1977. It defined "property" as something capable of ownership, typically involving a "bundle of rights," such as possession, use, and the ability to exclude others.
- Ownership as a Key Criterion:
Ownership involves control and the right to exclude others from access or use. Immutable smart contracts, by design, cannot be controlled or altered once deployed on the blockchain.
The Tornado Cash developers had relinquished control over the smart contracts during a "trusted setup ceremony," rendering them autonomous and unmodifiable. Consequently, no one, not even their creators, could exercise ownership rights over them.
- Historical Legal Definitions:
Drawing on precedents and authoritative sources, the court reiterated that "property" implies some form of dominion. It referenced Blackstone's seminal definition of property as the "sole and despotic dominion" one claims over something to the exclusion of others.
Property must be capable of being possessed, used, or transferred. Immutable smart contracts, which are merely autonomous lines of code, do not meet these criteria.
Immutable Smart Contracts Are Not Ownable
The court highlights the unique nature of immutable smart contracts. Once deployed on a blockchain, they cannot be deleted, altered, or controlled. This autonomy distinguishes them from traditional forms of property.
No Right to Exclude
Immutable smart contracts cannot exclude any party from using them. Anyone with an internet connection can access and interact with these smart contracts, making them fundamentally unlike ownable property.
No Control or Benefit
The developers of Tornado Cash do not derive fees or control outcomes from the immutable smart contracts. Any financial benefit from Tornado Cash’s ecosystem came from separate, mutable contracts (e.g., the relayer registry), not the immutable contracts at issue in this case.
For further insights, read our blog onChain Verification vs. Certified Financial Audit.
In Conclusion
The Fifth Circuit concludes that Tornado Cash’s immutable smart contracts fall outside the definition of "property" under IEEPA, thereby exceeding OFAC’s statutory authority. While acknowledging the national security concerns tied to cryptocurrency laundering, the court emphasized the limits of IEEPA’s language and deferred to Congress for potential legislative updates.
This decision sets a precedent for future cases involving blockchain and decentralized technologies. While many will view this decision as a step backwards in anti-money laundering regulation, the decision demonstrates the challenges of adapting traditional legal frameworks to DeFi. Decentralized finance, unlike the traditional centralized entities regulations were created are devoid of concepts like ownership, centralized control- and in many instances, a discernible human operator.
In time, regulators will likely need to address the unique case of DeFi. The Tornado Cash ruling illustrates this point well.
At De Silva Law Offices, we provide tailored legal advice on regulatory compliance, blockchain, and digital assets. Contact us today to schedule a consultation and let our experience empower your success in navigating legal challenges in the digital asset space.