The U.S. Treasury Department has officially removed Tornado Cash from its sanctions list, ending nearly three years of restrictions on the decentralized crypto privacy protocol. The decision, confirmed on March 21, 2025, follows a series of court rulings that challenged the legality of the original designation and represents a landmark victory for privacy advocates and open-source developers across the cryptocurrency ecosystem.
TL;DR
- The U.S. Treasury removed Tornado Cash and associated wallet addresses from the Specially Designated Nationals list
- Sanctions were originally imposed in August 2022 over allegations the protocol facilitated money laundering by North Korea’s Lazarus Group
- A November 2024 appeals court ruling found OFAC overstepped its authority in sanctioning the platform
- A U.S. District Court in Texas ordered the reversal of sanctions in January 2025
- The case sets a major legal precedent for the protection of decentralized protocols and open-source software
Origins of the Sanctions
Tornado Cash, a decentralized privacy protocol built on Ethereum, was sanctioned in August 2022 by the Treasury’s Office of Foreign Assets Control. The agency accused the platform of facilitating the laundering of more than $7 billion worth of virtual currency since its creation in 2019, with a significant portion allegedly linked to North Korea’s Lazarus Group. The hacking group was said to use stolen crypto assets to fund Pyongyang’s weapons of mass destruction programs.
The sanctions effectively prohibited U.S. persons from interacting with Tornado Cash, freezing all associated smart contract addresses on the Specially Designated Nationals list. The move sent shockwaves through the DeFi community, where the protocol had been widely used by individuals seeking financial privacy on public blockchains.
The Legal Battle
The sanctions immediately sparked a backlash within the crypto community, particularly among privacy advocates who argued that the Treasury was punishing open-source code rather than the specific bad actors who misused it. Several legal challenges were filed, including a prominent case brought by cryptocurrency exchange Coinbase, which funded a lawsuit on behalf of Tornado Cash users.
In November 2024, a federal appeals court ruled that OFAC had overstepped its statutory authority in sanctioning Tornado Cash. The court found that the agency could not sanction immutable smart contracts — code that, once deployed, cannot be altered or controlled by any individual or entity — under the International Emergency Economic Powers Act. This was followed by a January 2025 ruling from a U.S. District Court in Texas that formally ordered the reversal of the sanctions.
The Reversal and Its Significance
On Friday, March 21, the Treasury Department confirmed the removal of Tornado Cash and several associated digital wallet addresses from the SDN list. Treasury Secretary Scott Bessent acknowledged the importance of balancing innovation with security in a statement accompanying the decision.
“Digital assets present enormous opportunities for innovation and value creation for the American people,” Bessent said. “Securing the digital asset industry from abuse by North Korea and other illicit actors is essential to establishing U.S. leadership and ensuring that the American people can benefit from financial innovation and inclusion.”
The nuanced statement reflects the government’s attempt to acknowledge both the legitimate privacy concerns that drove the legal challenge and the ongoing national security risks associated with cryptocurrency-enabled money laundering.
Reactions Across the Industry
The reversal has been met with widespread celebration in the cryptocurrency community. Stefan George, co-founder of Gnosis, called the decision “a big win for open-source software and privacy,” while acknowledging the compliance challenges he personally faced as an early Tornado Cash user. Privacy advocates have framed the outcome as vindication for the principle of code neutrality — the idea that publishing software should not be treated as a criminal act, regardless of how others choose to use it.
The decision is also being viewed as a signal of how U.S. institutions may handle future crypto-related enforcement. Rather than targeting decentralized infrastructure, the precedent suggests that regulators may need to focus on the individuals and entities that misuse these tools rather than the tools themselves.
What This Means for DeFi and Privacy Protocols
The Tornado Cash case is likely to serve as a reference point in future legal and political debates about the boundaries of crypto regulation. As governments worldwide continue to grapple with the role of digital assets in financial sovereignty, surveillance, and crime prevention, the ruling provides a framework for distinguishing between infrastructure and intent.
For decentralized finance protocols, the takeaway is significant: open-source code deployed on public blockchains may enjoy greater legal protection than previously assumed. However, the case also highlights the risks that developers and users face during the often years-long legal battles that precede such outcomes. While Tornado Cash ultimately prevailed, the legal costs and uncertainty surrounding the case have had a chilling effect on privacy-focused development in the Ethereum ecosystem and beyond.
Why This Matters
The lifting of Tornado Cash sanctions is far more than a regulatory housekeeping item. It establishes a legal precedent that decentralized, immutable smart contracts cannot be sanctioned as if they were traditional financial institutions or individuals. This distinction between code and actor could reshape how regulators approach the entire DeFi ecosystem, from privacy mixers to decentralized exchanges and lending protocols. For the broader crypto market, which saw Bitcoin trading around $84,000 and Ethereum near $1,980 on March 22, 2025, the decision provides a measure of regulatory certainty that has been sorely lacking. The message from U.S. courts is clear: regulate behavior, not technology.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Always conduct your own research and consult a qualified financial advisor before making investment decisions.
three years of sanctions because OFAC decided immutable smart contracts were people. the appeals court got it right
the precedent here is massive. you cant sanction open source code any more than you can sanction math. texas court nailed it in january
^ calling it now, this opens the door for Tornado Cash V2 or clones to pop back up. the demand for on chain privacy hasnt gone away