Tornado Cash Immutable Contracts: The Code Nobody Could Switch Off

The Tornado Cash immutable contracts decision held that the software at issue was not property the Treasury Department could block under the International Emergency Economic Powers Act. In its November 26, 2024 opinion, the Fifth Circuit ruled that the Treasury Department’s Office of Foreign Assets Control had exceeded its authority because nobody could own or control those contracts. A pool that nobody can change and a registry that someone can update tell different stories about control.

How Tornado Cash Separated Deposits From Withdrawals

Tornado Cash pooled cryptocurrency so that a withdrawal became harder to connect to a particular deposit. The pool contracts ran on Ethereum, where transactions ordinarily reveal the sending address, receiving address and amount on a public ledger.

An address does not carry its user’s name. But once someone connects an address to a person, other transactions associated with that address become visible too. The opinion describes users seeking privacy for their spending, wealth and political donations, including a user who donated to Ukraine and wanted protection from hackers. The same mixing tools attracted cybercriminals moving stolen cryptocurrency, including the North Korea-linked Lazarus Group.

The court’s technical account explains the mechanism. Each pool accepted a particular type and amount of cryptocurrency. A depositor received a key or password allowing the holder to withdraw the same amount to another wallet. The code verified the password and processed the withdrawal automatically.

The privacy depended on other people using the pool. With only one depositor, the movement would be easy to follow. More people depositing and withdrawing made it harder to match a withdrawal to its source. The transactions still appeared on the blockchain. What the mixer obscured was the connection between them.

The Pools and the Relayers Had Different Controls

The immutable pools ran beyond anyone’s control, while other Tornado Cash components remained changeable. That split is the center of the case.

According to the opinion, developers initially retained the ability to update the pool contracts. In 2020, more than 1,100 users participated in a trusted setup ceremony that made at least twenty smart contracts, including the pools, irreversibly immutable. Nobody could alter, remove or take control of them afterward.

Governance still existed around those pools. Holders of the TORN token could lock their tokens into a mutable governance contract to vote on certain projects and optional features. The decentralized autonomous organization could not vote to change the immutable pool contracts.

Relayers addressed another privacy problem. A withdrawing wallet needed Ether to pay the network’s transaction fee, known as gas. Sending that Ether from the depositing wallet could reconnect the addresses the mixer was meant to separate. Relayers paid the gas from their own accounts and charged for the work. The opinion says they never took custody of users’ Ether.

A separate, mutable contract maintained the relayer registry. For most relayed transactions, that registry collected a fee from the relayer and paid it to token holders who had locked tokens into governance. Users could also interact with the pools without relayers. The optional fee system and the immutable pools were distinct pieces of the business.

What the Office of Foreign Assets Control Put on the Sanctions List

The Office of Foreign Assets Control put Tornado Cash’s website, smart contracts and a donation address on its sanctions list in August 2022, citing North Korea’s use of the service to launder stolen cryptocurrency. The agency later replaced that designation with one covering Ethereum addresses associated with the software.

Six users challenged Treasury’s authority. The district court initially sided with the government, treating the smart contracts as property that Treasury could block. The appeal changed that answer.

Why the Immutable Contracts Were Not Property

The Fifth Circuit held that property must be capable of ownership. Possession, control and the ability to exclude others mattered. The immutable pools offered none of those powers to their creators.

The Fifth Circuit said the targeted North Korean users could still retrieve assets through the immutable contracts even after designation. The code kept working. Adding it to a sanctions list did not create an operator who could turn it off.

Treasury also argued that its definition of property covered contracts and services. The court rejected both arguments for these pools. A contract needs parties who can agree with one another. A person interacting with the immutable code had no operator on the other side who could accept an offer or control the deposited Ether.

The district court had compared the arrangement to a vending machine. The appeals court pointed out the missing part of that comparison: a vending machine has an owner who can change its contents or unplug it. Nobody could unplug these pools.

The court also distinguished a tool that performs a service from the service itself. The code mixed deposits when a user prompted it. That did not make the code an owned service that Treasury could block. The court left any expansion of the law to Congress.

What the Ruling Changed

The users won on the immutable-contract property question. The Fifth Circuit reversed the district court.

The holding concerned the specified pools and the power to block property under the International Emergency Economic Powers Act.

Treasury later removed the Tornado Cash sanctions on March 21, 2025, after reviewing the legal and policy issues. That was a separate agency action following the court’s property ruling.

The Human Decisions Around the Code

In the separate criminal case, the Justice Department’s August 23, 2023 charging announcement described an indictment alleging that the founders publicly claimed sanctions compliance while agreeing in private chats that their change to the service would be ineffective.

Those allegations concern knowledge, communications and decisions around the service. The civil appeal concerned ownership of particular software. Someone who worked on the registry, infrastructure or compliance response may know which component a decision actually affected. That connection matters more than calling the whole project decentralized.

What a Crypto Insider Can Add

An insider can connect a visible transfer to the people, permissions and decisions behind it.

The Financial Crimes Enforcement Network’s guidance on virtual-currency business models distinguishes hosted wallets, where a provider controls customer value, from unhosted wallets used for a person’s own transactions. It also distinguishes an anonymizing service from a supplier of anonymizing software. A hosted wallet’s internal ledger may record transfers that do not appear individually on the blockchain. The operating model determines where the evidence lives.

Hudson Institute’s 2021 paper, Countering Global Kleptocracy: A New US Strategy for Fighting Authoritarian Corruption, explains the investigative value of identifying the person behind an address:

That finding gives an exchange employee’s knowledge a concrete purpose. Account records, wallet-control records and internal communications can connect a transaction to a customer and show what staff knew about it.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. For separate evidence of money laundering or sanctions evasion, our experts work with you to identify the whistleblower program that fits the conduct.

You Know Who Had Control

If you know who could change a mixer’s registry, operate its relayers or direct its governance, talk with our whistleblower experts. We work with you to build your strongest money laundering whistleblower case from your knowledge of the code, the money and the decisions. We bring in money laundering and sanctions whistleblower lawyers and stay beside you from the first conversation through the case.