CertiK noted that earlier this year, the U.S. Treasury Department made a groundbreaking decision to lift sanctions on Tornado Cash, an Ethereum-based cryptocurrency mixing service that had been a lightning rod for controversy since its sanctioning in 2022.
Originally blacklisted by the Office of Foreign Assets Control (OFAC) for allegedly facilitating over $7 billion in money laundering, including funds tied to North Korean cyberattacks, Tornado Cash’s delisting marks a pivotal shift in the regulatory landscape for decentralized finance (DeFi).
A key update explores how Tornado Cash operates, the history of its sanctions, and the evolving patterns of its usage since the restrictions were lifted, drawing insights from CertiK’s recent analysis.
Tornado Cash, launched in 2019, is a decentralized, non-custodial privacy protocol designed to enhance transaction anonymity on the Ethereum blockchain.
By pooling and mixing user funds through smart contracts, it obscures the link between sender and recipient addresses, making it difficult to trace cryptocurrency movements.
This feature has made it popular among privacy advocates, but it also attracted scrutiny for enabling illicit activities.
In August 2022, OFAC sanctioned Tornado Cash, citing its role in laundering over $1 billion, including $455 million stolen by the North Korean-linked Lazarus Group.
The sanctions, which marked the first time open-source software was added to the Specially Designated Nationals (SDN) list, barred U.S. persons from interacting with the protocol and froze associated Ethereum addresses.
Despite the sanctions, Tornado Cash’s immutable smart contracts remained operational on-chain, as their decentralized and open-source nature made them impossible to “switch off.”
Usage plummeted by nearly 85%, with only privacy enthusiasts willing to risk legal repercussions and illicit actors undeterred by sanctions continuing to engage with the platform.
However, a November 2024 ruling by the U.S. Fifth Circuit Court of Appeals changed the game.
The court found that OFAC had overstepped its authority under the International Emergency Economic Powers Act (IEEPA) by sanctioning Tornado Cash’s immutable smart contracts, which it deemed not to be “property.”
This legal victory, backed by Coinbase and privacy advocates, led to the Treasury’s decision to lift sanctions on March 21, 2025, removing over 100 Ethereum addresses from the SDN list.
The lifting of sanctions triggered an immediate market response.
Tornado Cash’s native token, TORN, surged from $8 to approximately $15, reflecting optimism about the protocol’s renewed accessibility.
CertiK’s analysis reveals a significant shift in usage patterns post-delisting. During the sanction period, the platform primarily served two groups: technically savvy privacy advocates and illicit actors.
With legal barriers removed, Tornado Cash is now seeing an influx of risk-averse legitimate users seeking enhanced transaction privacy for purposes like secure donations or protecting financial data.
Notably, the protocol’s use in exploits has decreased quarter-over-quarter, suggesting a move away from its association with large-scale illicit activities.
However, the Treasury Department has emphasized that it will continue to monitor transactions for potential links to malicious actors, particularly those tied to North Korea’s hacking campaigns.
This ongoing scrutiny underscores the delicate balance between fostering financial innovation and preventing abuse in the DeFi space.
Blockchain analytics firms like Chainalysis highlight that, despite mixing, funds can often be traced pre- and post-mix, mitigating some risks of untraceable illicit activity.
The lifting of sanctions acknowledges the limitations of targeting decentralized code and shifts focus toward individual actors, as evidenced by ongoing legal actions against Tornado Cash co-founders Roman Storm, Roman Semenov, and Alexey Pertsev, who face charges related to money laundering.
The delisting of Tornado Cash represents a win for privacy advocates and DeFi innovation, but it also poses challenges for compliance.
Businesses must now adopt more sophisticated methods to identify illicit transactions without relying solely on platform bans.
As CertiK notes, tools like SkyTrace can help track suspicious wallet activity, ensuring compliance with regulatory expectations.
The Tornado Cash incident / scenario highlights the complexities of regulating decentralized technologies, where code operates autonomously, and traditional sanctions may fall short.
As the crypto landscape evolves, regulators and industry players must navigate this tension to balance privacy, innovation, and security.