Tornado Cash Co-Founder: The Partial Verdict, Delisting and Unresolved Counts

The Tornado Cash case produced a partial verdict: a jury convicted a co-founder of conspiring to operate an unlicensed money-transmitting business and deadlocked on the money-laundering and sanctions counts. Hacking victims asked the operators for help while their stolen funds moved through the service, according to the indictment. Prosecutors described operators who paid for infrastructure, promoted the service and kept it running after learning that it was moving criminal proceeds. The pools could not be changed, but the people around them kept running the business.

What Tornado Cash Did

Tornado Cash pooled cryptocurrency and let a depositor withdraw to a different wallet, obscuring the connection between the sending and receiving addresses. The Fifth Circuit’s account of the mixing process explains why that mattered on Ethereum: transactions appear on a public ledger, where connecting an address to a person can reveal that person’s other financial activity.

The pools were smart contracts, programs stored on the blockchain. A deposit generated a withdrawal credential, and the software released funds when the holder supplied that credential. The transfer could finish without a person approving it. More users in a pool made it harder to connect a particular deposit to a particular withdrawal.

In 2020, the developers gave up control over the pool contracts through a process that made them immutable. The court described the consequence plainly: the pools could no longer be changed, removed or controlled. A website, a relayer registry and an immutable pool are different parts of the service, even when users encounter them under the same name.

The Relayers and Governance Around the Pools

The immutable pools sat alongside a changeable relayer registry that collected fees on most relayed transactions for participating TORN token holders. The Fifth Circuit described a governance organization whose members could vote on certain optional features, but could not rewrite the pools.

Relayers paid the network transaction fee for a withdrawal and deducted that cost and a service fee. That spared a user from funding a fresh wallet from the original wallet and exposing the connection. Relayers had no custody over users’ Ether, and using one was optional.

FinCEN’s virtual-currency guidance distinguishes a provider of anonymizing software from a service that accepts and retransmits value. In Tornado Cash, prosecutors focused on the continuing operation of the business around the software.

What the Criminal Indictment Alleged

The criminal indictment alleged that the founders created Tornado Cash’s core features, paid for critical infrastructure, promoted the service and profited from its operation. The Justice Department’s August 23, 2023 charging announcement described charges of conspiracy to launder money, violate sanctions and operate an unlicensed money-transmitting business.

According to the indictment as described in that announcement, the founders received complaints and requests for help from hacking victims, knew about laundering transactions and continued operating without the know-your-customer or anti-money-laundering programs prosecutors said were required. The alleged failure followed information coming into the business from people whose money had been stolen.

The sanctions allegation concerned the Lazarus Group, a sanctioned North Korean cybercrime organization. Prosecutors alleged that the group used Tornado Cash in April and May 2022 to move hacking proceeds. They further alleged that the founders made a change they could announce publicly as sanctions compliance while agreeing in private chats that it would be ineffective. They allegedly continued helping the group transfer proceeds from a wallet that the Office of Foreign Assets Control had blocked.

Internal messages and responses to victims tell a part of the story the transaction history cannot.

The Tornado Cash Partial Verdict and Unresolved Counts

The Tornado Cash partial verdict on August 6, 2025 left a conviction for conspiring to operate an unlicensed money-transmitting business and unresolved counts for laundering and sanctions.

Before trial, prosecutors dropped the registration theory and kept the charge of knowingly moving criminal proceeds.

In its announcement of the conviction, the Justice Department said the criminal trial proved that the co-founder knew of transactions involving more than $1 billion in criminal proceeds and continued operating the service. It said the founders cashed out more than $12 million in profits from the business.

The announcement also said the co-founder continued transmitting hundreds of millions of dollars from the Ronin hack after the FBI publicly attributed it to the Lazarus Group.

Why Delisting Did Not End the Criminal Case

Treasury first sanctioned Tornado Cash in August 2022. Its later delisting followed a separate challenge to Treasury’s authority over the immutable contracts. On November 26, 2024, the Fifth Circuit held that the contracts at issue were not property that could be blocked under the International Emergency Economic Powers Act. Its reasoning turned on ownership and control: no one could change those contracts or exclude someone from using them.

The court identified a practical limit as well. The pools kept operating after designation, and the sanctioned actors could still use them. A prohibition on dealing with the software had not given anyone the ability to switch it off.

Treasury removed the Tornado Cash sanctions on March 21, 2025. The separate criminal case concerned the co-founder’s conduct, including the retained theory of knowingly transmitting criminal proceeds. The property ruling and delisting did not decide those criminal counts.

What the Public Ledger Leaves for Insiders

A public transaction history can show where cryptocurrency moved while leaving the business decisions out of view. Exchange ledgers, wallet-control records, screening decisions and internal escalations can supply different parts of that account. An employee may know which customer an exchange credited, who received a warning or why a control was changed.

The Hudson Institute’s 2021 report, Countering Global Kleptocracy: A New US Strategy for Fighting Authoritarian Corruption, explains the unusual evidentiary strength of a public ledger:

The report also explains that mixers complicate that tracing and that conversion into conventional currency remains important to criminals seeking to use their proceeds. For an insider at an exchange, that puts the customer account and the conversion records alongside the blockchain trail.

A 2024 Wharton Initiative on Financial Policy and Regulation paper, Anti-Money Laundering: Opportunities for Improvement, describes the overlap between the infrastructure used for anti-money-laundering controls and sanctions compliance. It notes that enforcement against mixers followed recognition of their abuse in cyberattacks and by sanctioned actors. That overlap helps explain why the same warning or control decision can matter to different inquiries.

A parallel criminal case against operators of Blender and Sinbad concerned an alleged continuing concealment business. The government’s charging account described services taking funds and fees, obscuring source and recipient, advertising the deletion of traces and operating a successor service. The useful comparison is the operating activity: accepting funds, earning fees and maintaining a service.

The Tornado Cash Retrial

The Tornado Cash retrial was scheduled for April 26, 2027 in the court’s August 2026 scheduling order.

Whistleblower Evidence and the Right Case

The Tornado Cash account makes internal knowledge valuable to understanding the business: victim complaints, infrastructure decisions and private discussions about controls can explain what transaction data alone leaves unanswered. Our whistleblower experts build your case around what the operators knew and the decisions you saw from inside the business.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That law concerns fraud against the government. Speak to our whistleblower experts about the program that fits your money-laundering or sanctions information.

You Saw the Decisions Around the Code

If you know who kept a crypto service running after warnings about stolen funds, bring that account to our whistleblower experts. We build the case with you, bring in money-laundering whistleblower lawyers who understand crypto operations and sanctions, and stay alongside you throughout the case.