Tornado Cash Trial Reveals Fault Lines in Crypto Privacy and US Regulation
Jury convicts Tornado Cash founder of operating unlicensed money business, deadlocks on major laundering charges.
A Manhattan jury has issued a mixed verdict in the closely watched trial of Roman Storm, co-founder of Tornado Cash, a decentralized cryptocurrency mixer accused of facilitating massive money laundering, including for North Korean hackers. The outcome underscores deep tensions between blockchain-based privacy tools and regulatory expectations in the U.S. financial system.
Storm was found guilty of operating an unlicensed money-transmitting business, a lesser charge, while the jury failed to reach a consensus on the more severe accusations: conspiracy to commit money laundering and violations of U.S. sanctions laws. Prosecutors will decide in the coming weeks whether to retry Storm on those counts. He remains free on a $2 million bail while awaiting sentencing.
Tornado Cash offered a novel take on privacy in cryptocurrency by allowing users to mix Ethereum deposits into anonymous pools, later retrieving them through new wallets with obfuscated transaction trails. The system relied on smart contracts and "relayers" that paid transaction fees on behalf of users, masking links between sender and recipient wallets. While Tornado Cash marketed this as a privacy-enhancing feature, federal prosecutors saw it as a tool for systematic money laundering.
According to U.S. authorities, the Lazarus Group—a North Korean state-sponsored hacking collective—used Tornado Cash to launder hundreds of millions of dollars in stolen crypto. the platform is suspected of facilitating over $1 billion in illicit transactions. Internal communications from Tornado developers acknowledged awareness of potential misuse, yet the service remained operational without implementing know-your-customer (KYC) or anti-money laundering (AML) controls.
Storm’s defense team argued that Tornado Cash was designed to be non-custodial and operated autonomously via smart contracts. They emphasized his limited control over users and pointed to internal messages in which he condemned the North Korean hackers: “I’m glad those f*ckers are detected,” he reportedly wrote. Defense lawyers also cited Storm’s attempts to assist crypto exchanges in tracing stolen funds using blockchain tools.
Storm distinguished Tornado from other mixers like Helix by highlighting its open-source nature, lack of dark web promotion, and technical design that prevented the platform from handling user funds directly. He even sought legal advice to ensure Tornado's operations were compliant, a fact reinforced by reassuring messages from venture capital backers.
Yet, the prosecution maintained that ignoring AML obligations, even under the banner of decentralization, amounted to criminal negligence. The case reflects the growing resolve of U.S. regulators to enforce financial laws in the crypto space, regardless of whether services claim technological neutrality.
The mixed outcome may offer a temporary reprieve to decentralized privacy advocates, but it also signals intensified scrutiny. As similar cases against crypto mixers proceed, the Tornado Cash verdict sets a pivotal precedent in how courts interpret responsibility in decentralized finance.
