Crypto mixing service Tornado Cash blacklisted by Treasury Department

The US Treasury Department on Monday sanctioned popular cryptocurrency mixer Tornado Cash, banning Americans from using a service the government said “launders the proceeds of cybercrime.”

“Despite public assurances to the contrary, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without fundamental measures to address the risks,” Treasury Secretary of State for Terrorism and financial intelligence. Brian Nelson said in a statement.

Crypto-asset mixers are designed to hide traces of funds by mixing someone’s tokens with a pool of other individuals’ assets on the platform. They go beyond traditional crypto platforms to further hide the identity of the people involved in transactions.

While Tornado Cash is used by some people simply as a legitimate way to protect their privacy, the government says it promotes illegal activity, including “facilitating robbery, ransomware, fraud and other cybercrime.”

“Virtual currency mixers that assist criminals are a threat to US national security,” the Treasury Department said.

Tornado was used in some high-profile crypto heists this year, including the $615 million theft of tokens from Ronin, a network backing the non-fungible token game Axie Infinity, and a $100 million attack on US startup Harmony. Both were linked by security researchers to the Lazarus Group, a North Korean state-sponsored hacking group.

Blockchain analytics firm Elliptic found that at least $1.5 billion in proceeds of crimes such as ransomware, hacks, and fraud have been laundered through Tornado Cash, and that as much as $100 million stolen from the Harmony Bridge in June was laundered through the service.

The US Treasury cited a much higher figure for Tornado Cash, saying it has been used to launder more than $7 billion in virtual currency since its launch in 2019. This figure refers to the total value of crypto assets that have been sent through Tornado Cash.

Some blockchain analysis tools have managed to “demix” crypto sent through Tornado to identify the source of the funds. Elliptic says it was able to trace crypto stolen from Harmony to several new ether wallets, for example.

The actions against Tornado Cash follow sanctions that were similarly imposed in May 2022 against another popular service, Blender.io.

“The United States will continue to pursue actions against mixers who launder virtual currency for criminals and those who aid them,” Antony J. Blinken, the secretary of state, said in a statement Monday.

The Office of Foreign Assets Control (OFAC), a watchdog that falls under the purview of the Treasury Department, has added Tornado Cash and its associated crypto wallet addresses to its “Specially Designated Nationals” list. Any person who interacts with these wallet addresses can now face criminal penalties, which is a cause for concern for some honest-to-goodness crypto holders.

“All transactions by US persons or within (or transit through) the US involving property or interests in property of designated or otherwise blocked persons are prohibited unless authorized by a general or specific license issued by OFAC, or exempted,” Treasury Department so.

However, enforcing such a move could be difficult for authorities and overly restrictive, according to the Coin Center, a non-profit organization focused on crypto regulation. That’s because there isn’t a single person or entity behind the use of Tornado Cash, an open source tool.

The action appears to be “sanctioning a tool that is neutral and can be put to good or bad use like any other technology,” Coin Center wrote.

— CNBC’s Dan Mangan and Dawn Kopecki contributed to this report.

SEE: Why federal charges over an alleged Ponzi scheme may be just the tip of the iceberg