Tornado Cash is one of the most famous, and most controversial, tools in crypto. To some it is a basic privacy tool; to others, a laundering machine for hackers. Its story raises a question that still has no final answer: can you be held responsible for code that other people misuse?
The problem it solves
Blockchains like Ethereum are public. Anyone who knows your address can see your balance and every payment you’ve ever made. Pay someone once from your main wallet, and they can follow your entire financial history.
Tornado Cash was built to break that link. It is a mixer: a pool where many users’ coins are blended together, so it becomes very hard to tell which deposit belongs to which withdrawal.
How it works
- Deposit. You send a fixed amount (for example 1 ETH) into a Tornado Cash smart contract and receive a secret “note”, a kind of receipt only you know.
- Wait. Your coins sit in the pool together with deposits from many other users.
- Withdraw. Later, you use your note to withdraw 1 ETH to a brand-new address. A cryptographic technique called a zero-knowledge proof lets you prove you made a deposit without revealing which one.
The result: on the blockchain, there is no visible connection between the old address and the new one. The bigger the pool and the longer you wait, the stronger the privacy.
Two details made Tornado Cash different from older mixers:
- No company holds the money. The coins sit in smart contracts, not with an operator.
- The core contracts can’t be changed or switched off. Once deployed, they run on Ethereum on their own, and nobody, including the founders, can stop them.
A short history
- 2019: launched by developers Roman Semenov, Roman Storm and Alexey Pertsev.
- 2020: the core contracts are made immutable. Over the following months, control of the project passes to holders of the new TORN governance token.
- 2022: Tornado Cash is used to launder proceeds of major hacks, most notably by North Korea’s Lazarus Group after the roughly $600 million Ronin bridge theft.
- August 2022: the U.S. Treasury sanctions Tornado Cash, saying it had been used to launder more than $7 billion since 2019. Using it becomes illegal for Americans. Days later, Alexey Pertsev is arrested in the Netherlands.
- May 2023: an attacker briefly takes over Tornado Cash’s governance with a malicious proposal: a reminder that “decentralized” systems have their own weak points.
- August 2023: U.S. prosecutors charge Roman Storm and Roman Semenov. Semenov has not been arrested.
- May 2024: a Dutch court convicts Pertsev of money laundering and sentences him to 64 months in prison. He appeals.
- November 2024: a U.S. appeals court rules that the Treasury went too far: immutable smart contracts are not “property” that can be sanctioned.
- February 2025: Pertsev is released under electronic monitoring while he prepares his appeal.
- March 2025: the Treasury lifts the sanctions on Tornado Cash.
- August 2025: a New York jury finds Roman Storm guilty of conspiring to run an unlicensed money-transmitting business, but cannot agree on the more serious money laundering and sanctions charges.
Where things stand now
The sanctions are gone, but the legal fight is not over:
- Roman Storm (U.S.): his retrial on the money laundering and sanctions charges, each with a maximum of 20 years, has been set for April 26, 2027. A judge is still weighing his request to overturn the conviction he already received.
- Alexey Pertsev (Netherlands): his appeal against the 2024 conviction was still under way at the time of writing.
The Tornado Cash contracts themselves never stopped. Because no one can switch them off, they have kept running on Ethereum throughout the entire saga.
The big debate: privacy or crime?
The case for Tornado Cash:
- Financial privacy is normal. Your bank doesn’t publish your salary and purchases online.
- Most users weren’t criminals. People used it to protect donations, salaries and savings from public view, and from thieves looking for wealthy targets.
- Writing code is a form of speech. If developers can go to prison for how strangers use open-source software, building any privacy tool becomes risky.
The case against it:
- Billions in stolen and illicit funds passed through it, including money from North Korean hackers.
- Prosecutors argue the founders knew about the criminal use, profited from the project, and chose not to stop it.
- Tools that make tracing impossible also make it impossible to recover victims’ money.
Courts in the U.S. and the Netherlands are now deciding where that line lies. Their rulings will shape what developers can safely build, far beyond Tornado Cash.
What it means for you
- Using a mixer can still cause trouble. Even without sanctions, many exchanges flag or freeze funds that recently passed through a mixer. You may be asked to explain where your money came from.
- Privacy laws differ by country. Check the rules where you live before using any privacy tool.
- Simple habits help. Using separate wallets for different purposes, and not sharing your main address publicly, already gives you a lot of everyday privacy.
This article is for information only. It is not legal or financial advice.
