Federal Appeals Court Tosses OFAC Sanctions on Tornado Cash and Limits Federal Government’s Ability to Police Crypto Transactions

On November 26, 2024, the United States Court of Appeals for the Fifth Circuit issued a landmark decision holding that the Treasury Department’s Office of Foreign Assets Control (“OFAC”) exceeded its statutory authority by sanctioning immutable smart contracts created by Tornado Cash. While the decision leaves several legal issues open and is still subject to appeal by the Treasury Department, it has significant implications for the use of the International Emergency Economic Powers Act (“IEEPA”) to regulate certain decentralized finance (DeFi) technologies.

The case, Van Loon et al. v. Department of the Treasury, centered on whether Tornado Cash’s immutable smart contracts could be considered “property” under the IEEPA. Relying on the Supreme Court’s decision in Loper Bright Enterprises v. Raimondo, the Fifth Circuit held that OFAC was no longer entitled to “heightened deference” in its interpretation of the terms relevant to the case, and concluded that immutable smart contracts cannot be “property” under the IEEPA because they are not capable of being owned, controlled, or altered by any individual or entity. They are not “owned” by anyone, the court reasoned, in large part because possession and control typically inheres the right to exclude, and no one has the ability to exclude anyone else from using the smart contracts.

The Fifth Circuit’s ruling limits the government’s ability to regulate decentralized technologies through existing sanctions laws. However, the decision, which remains subject to appeal, has important limitations and does not signal the end of the US government’s jurisdiction or attempts to enforce US laws over cross-border digital asset transactions or the blockchain technology that enables them.

This Legal Update provides an overview of the case background, the court’s decision, and key takeaways for companies and individuals operating in the cryptocurrency and DeFi spaces.

Background

Developed in 2019, Tornado Cash is a decentralized, open-source software protocol that facilitates anonymous cryptocurrency transactions by obfuscating the origins and destinations of digital asset transfers. To do this, Tornado Cash uses “smart contracts,” software or computer programs that are uploaded onto the blockchain network. These smart contracts allow users to deposit cryptocurrency into “pools” operated by the smart contract software and withdraw it to new wallets, effectively breaking the public link between the sender and the recipient. While the protocol has legitimate uses for enhancing privacy, it has also been linked to illicit activities, including laundering funds for cybercriminals, most notoriously those working on behalf of the North Korean state.

Smart contracts come in two forms: “mutable” and “immutable.” A mutable smart contract is managed by some party or group and may be changed. An immutable smart contract, on the other hand, when deployed on a decentralized blockchain, cannot be altered, removed, or controlled once it is deployed on the blockchain. This means that neither the original developers nor any other party can change the code or functionality of these smart contracts after they have been made immutable. Immutable smart contracts operate automatically without any human intervention, are incapable of being owned, and remain accessible to anyone with an internet connection. Once certain conditions are met, immutable smart contracts execute their programmed tasks, such as transferring cryptocurrency assets, without the need for any human or external control, custody, or input over the cryptocurrency assets.

In August 2022, OFAC sanctioned Tornado Cash, adding it to the list of Specially Designated Nationals and Blocked Persons (the “SDN List”). OFAC based its designation on allegations that Tornado Cash had been used to launder more than $7 billion in cryptocurrency, including funds stolen by North Korea’s “Lazarus Group.”¹ In November 2022, OFAC updated its designation to include 53 Ethereum addresses associated with Tornado Cash’s smart contracts, including at least 20 “immutable” smart contracts. Because the OFAC sanctions apply on a strict liability basis and prohibited transactions directly or indirectly involving blocked persons or property, the designations created legal uncertainty and potential exposure for even innocent users who send cryptocurrency to the addresses associated with the “immutable” smart contracts. Six users of Tornado Cash, with the financial backing of Coinbase, challenged the sanctions, arguing that the immutable smart contracts were not “property” and thus fell outside OFAC’s authority under IEEPA.²

Court Decision

The Fifth Circuit’s decision focused on the definition of “property” under IEEPA. The court held that Tornado Cash’s immutable smart contracts do not qualify as property, because they are not capable of being owned, controlled, or altered by any individual or entity. The court emphasized that property, as understood in the context of IEEPA, must be something that can be owned and controlled. Tornado Cash’s “immutable” smart contracts, used to anonymize cryptocurrency transfers, operate autonomously and cannot be owned or controlled by anyone, including their original developers.

Furthermore, the court examined the implications of treating immutable smart contracts as property. It highlighted the potential for unintended consequences, such as the risk of liability for individuals who unknowingly interact with sanctioned smart contracts. The court pointed out that because the immutable smart contracts are accessible to anyone with an internet connection, it would be impossible to prevent their use by sanctioned entities. This lack of control and ownership further reinforced the court’s conclusion that the smart contracts do not qualify as property under IEEPA.

The court also rejected OFAC’s argument that its long-standing regulatory definition of “property” and “property interests”—which extend to “contracts of any nature whatsoever” as well as “services of any nature”—required a different outcome. The court found that as used in OFAC’s own regulations, both of these terms still presuppose the concept of ownership, which immutable smart contracts do not meet. In the court’s view, “the immutable smart contracts, which are nothing more than lines of code,” facilitate a service—namely, the mixing of cryptocurrencies to enhance privacy—but are not themselves services. The court also emphasized that Tornado Cash, as defined by OFAC, does not “own the right” to services provided by the immutable smart contracts, nor did it own the immutable smart contracts themselves, separate and apart from any rights or benefits of the services thereby performed. 

Notably, the view espoused by the Fifth Circuit reflects a stark departure from OFAC’s long-standing practice of the agency prohibiting the provision or receipt of services to or from a sanctions target in a manner that is neither dependent on “ownership” of the service nor the existence of a contract.³ Moreover, based on the court’s determination with respect to the “property’ issue, the Fifth Circuit declined to address “whether Tornado Cash qualifies as an ‘entity’ or whether it has an ‘interest’ in the immutable smart contracts,” thereby leaving both issues open.

Judge Don Willett, writing for the panel, acknowledged the government’s legitimate concerns about cybercrime and the use of cryptocurrency by malicious actors. However, he emphasized that addressing these issues requires congressional action to update IEEPA, which was enacted in 1977, long before the advent of blockchain technology. The court declined to expand executive authority to encompass decentralized technologies such as Tornado Cash, stating that such an expansion would amount to judicial lawmaking. The court’s decision also highlighted the real-world downsides of certain uncontrollable technologies falling outside of OFAC’s sanctioning authority. The court remanded the case to the district court with instructions to grant the plaintiffs’ motion for partial summary judgment based on the Administrative Procedure Act.

Takeaways

Overall, the Fifth Circuit’s decision in Van Loon et al. v. Department of the Treasury highlights the ongoing need to balance continued enforcement interest in addressing the risks of illicit activity and sanctions evasion in the cryptocurrency sector with the private sector’s legitimate interests in privacy and innovation. The ruling underscores an important issue regarding the limits of IEEPA authority (and possibly other forms of regulation) by addressing the unique characteristics of certain decentralized autonomous technologies and the need for regulatory clarity in this rapidly evolving space.

But this decision also has important limitations:

• The reasoning of the decision does not extend to any mutable smart contracts — i.e. contracts still under the control of humans or organizations consisting of humans. This is a potentially broad caveat related to a fact-specific categorization of smart contracts—a caveat that may be the subject of future actions or court proceedings.
• The decision also does not eliminate the potential for sanctions or criminal liability for individuals who use cryptocurrency, mixers, or other innovations to evade sanctions or lauder money. For instance, Van Loon leaves in place the sanctions against the founders of Tornado Cash.
• Apart from immutable smart contracts, the case leaves intact the broader sanctions framework prohibiting transactions and dealings involving sanctions targets more generally (including prohibitions on dealings involving sanctioned mixers, cryptocurrency exchanges, etc.). Until OFAC takes action to remove a designation, parties should assume all relevant prohibitions remain intact to ensure compliance. 
• This case may be appealed by the Treasury Department. Notably, a parallel challenge to OFAC’s Tornado Cash designation is pending in the Eleventh Circuit, in which the district court upheld OFAC’s authority.⁴ A potential circuit split may draw the Supreme Court’s attention.

For companies operating in the cryptocurrency and DeFi sectors, this decision provides a measure of legal clarity and protection against the broad application of sanctions laws and other forms of regulation to autonomous, immutable, and decentralized protocols. It is important that market participants bear in mind both the case and its limitations in considering the structure of their proposed transactions to ensure compliance.

As always, it is important to remain vigilant.

Companies should continue to monitor developments in both the regulatory and legislative arenas. The ruling may prompt OFAC to seek legislative action to explicitly address its authority in this space and consider updates to IEEPA or other relevant laws to better address the complexities of regulating decentralized technologies. Additionally, companies should be prepared for potential new regulatory frameworks that could emerge as a result of this decision. In either case, those actions may limit the ability to rely on this opinion as guidance.

Overall, the Fifth Circuit’s ruling represents a pivotal moment in the ongoing debate over the regulation of decentralized technologies. The decision reinforces the importance of clear and updated legal frameworks to address the unique challenges posed by these innovations while balancing the need for privacy and security in the digital age.

¹ “Lazarus Group” refers to a notorious hacking team sponsored by the government of North Korea, according to the Department of Justice and multiple cybersecurity experts.

² OFAC also sanctioned Tornado Cash’s mutable smart contracts, which remained subject to human control. The plaintiffs in this case did not challenge those sanctions under its “property” theory; therefore those mutable smart contract Ethereum addresses remain subject to OFAC sanctions. And despite the favorable ruling for Tornado Cash in this case, its founders, Roman Storm and Roman Semenov, continue to face serious legal challenges. They were charged in August 2023 with money laundering and sanctions violations related to their roles in operating Tornado Cash, which has been accused of laundering over $1 billion in criminal proceeds. The legal proceedings against them are ongoing.

³ Apart from the agency’s regulatory definition, Executive Order 13692 (under which Tornado Cash was originally designated) contains separate prohibitions on the “provision of funds, goods or services by, to or for the benefit of” and the “receipt of any contribution or provision of funds, goods, or services from” any person designated under that Order.

⁴ See Coin Center, et al. v. Secretary, U.S. Department of the Treasury, et al., No. 23-13698 (11th Cir. filed Nov. 7, 2023).