How the Tornado Cash ruling is a victory for crypto

A ruling that finds immutable code falls outside the definition of property is a common-sense win for the industry

Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.

The following is a guest article from Matthew Niemerg, co-founder of Aleph Zero.

The Fifth Circuit Court of Appeals handed down a landmark ruling yesterday that could fundamentally reshape how cryptocurrency protocols are regulated. In Van Loon v. Department of Treasury, the court found that the Treasury Department’s Office of Foreign Assets Control (OFAC) exceeded its authority when it sanctioned Tornado Cash’s immutable smart contracts.

The ruling hinges on a deceptively simple question: can computer code that cannot be modified or controlled be considered “property”? The appellate court’s answer was an emphatic no.

Tornado Cash is a cryptocurrency anonymizing service that helps preserve privacy by pooling users’ digital assets together, making transactions harder to trace. In 2022, OFAC sanctioned it after North Korean hackers allegedly used it to launder over $455 million in stolen funds. But the court found that since Tornado Cash’s core protocols are “immutable” – meaning they cannot be changed or controlled by anyone – they don’t qualify as property that can be sanctioned under existing law.

A Watershed Moment for Crypto

“Because these immutable smart contracts are unchangeable and unremovable, they remain available for anyone to use,” wrote Judge Don Willett, noting that even under sanctions, “the targeted North Korean wrongdoers are not actually blocked from retrieving their assets.”

This represents a watershed moment for the cryptocurrency industry. For the first time, a federal appeals court has acknowledged that certain decentralized protocols operate entirely as something completely different from traditional property or businesses. Since no one “owns” the protocols underlying email or the web, these autonomous smart contracts exist independent of any controlling entity.

The implications are significant. The ruling effectively creates a safe harbor for truly decentralized protocols that cannot be modified or controlled. While OFAC can still sanction individuals and companies, it cannot sanction the underlying code itself – at least under current law.

Balancing Privacy and Security

However, the court explicitly left the door open for Congress to update the 1977 International Emergency Economic Powers Act (IEEPA) to address modern technologies. “Perhaps Congress will update IEEPA, enacted during the Carter Administration, to target modern technologies like crypto-mixing software,” the ruling noted. “Until then, we hold that Tornado Cash’s immutable smart contracts…cannot be blocked under IEEPA.”

This highlights the broader challenge of regulating privacy-preserving technologies that can be used for both legitimate and illegitimate purposes. As the court record shows, Tornado Cash was used by individuals seeking to protect their privacy when donating to Ukrainian war efforts and avoid harassment. But it was also exploited by bad actors for money laundering.

The crypto industry still has work to do in preventing illicit use while preserving privacy rights. Some proposed approaches include allowing users to voluntarily prove the legitimacy of their funds, or implementing “anonymity revoking” systems that could unmask users only under specific circumstances with proper oversight.

The Path Forward

Judge Willett acknowledged the government’s concerns about illicit finance as “undeniably legitimate.” But he emphasized that courts must apply the law as written, not “tinker with it.” The ruling concludes:

“Mending a statute’s blind spots or smoothing its disruptive effects falls outside our lane.”

This balanced approach – recognizing both the importance of preventing criminal activity and the need to protect privacy-enhancing innovation – points the way forward. Rather than trying to force new technologies into old regulatory frameworks, legislators need to craft updated laws that understand the unique nature of decentralized systems while addressing legitimate security concerns.

For now though, this ruling represents a victory for technological innovation and a recognition that not everything in the digital age fits neatly into traditional legal categories of property and ownership. The challenge ahead is building a regulatory framework as sophisticated as the technology it aims to govern.