Following a US District Court's unfavourable judgment against Tornado Cash earlier this month, US prosecutors announced a fresh indictment charging two Tornado Cash co-founders for their roles in operating Tornado Cash, a cryptocurrency mixer that allowed its customers to engage in untraceable transfers of cryptocurrency.
Roman Storm and Roman Semenov, the principal co-founders who developed and operated Tornado Cash since its public launch, have been charged with three counts of crimes, including:
conspiracy to commit money laundering,
conspiracy to commit sanctions violations, and
conspiracy to operate an unlicensed money transmitting business.
The US prosecutors that brought charges include the US Attorney's office for the South District of New York. The prosecutors said the charges:
arise from the defendants’ alleged creation, operation, and promotion of Tornado Cash.
and alleged that the cryptocurrency mixer:
facilitated more than $1 billion in money laundering transactions and laundered hundreds of millions of dollars for the Lazarus Group, the sanctioned North Korean cybercrime organization.
Operation of the Cryptocurrency Mixer
Storm and Semenov are alleged to have liability including because they were involved in Tornado Cash as they:
created the core features of the Tornado Cash service, paid for critical infrastructure to operate the Tornado Cash service, promoted the Tornado Cash service, and made millions of dollars in profits from operating the Tornado Cash service.
The prosecutors alleged that the founders knowledge of Tornado Cash being misused for illegal activities should be reason to hold the founders liable, due to the lack of KYC or AML/CTF programs in Tornado Cash. The prosecutors further allege that the founders had actual knowledge of money laundering and received complaints and requests for help from victims of hacking and other cybercrimes but declined to assist or take steps to prevent that use of the product.
North Korean Cybercrime Involvement
The indictment further claims that the Tornado Cash service played a pivotal role in laundering hundreds of millions of dollars in hacking proceeds for the Lazarus Group. Storm and Semenov are alleged to have allowed the group to launder criminal proceeds through their platform - and that a change was made in the service so that the founders could make a public announcement about being compliant with sanctions laws, but it is alleged they had knowledge the change would be ineffective.
The Future of Cryptocurrency and DAO Enforcement
The indictment of Storm and Semenov marks a significant step in the legal battle against cryptocurrency-related crime but also is being cast as a similar prosecution to the battle in the 1990s over exporting of encryption algorithms, which led to a T-Shirt being sold which could, in theory, lead to the wearer being prosecuted (no one actually went to jail):
A new shirt is now available for sale with the Tornado Cash code, highlighting that the code can be deployed and Tornado Cash recreated if anyone wished to do so:
This case has been attacked as criminalisation of computer code, and highlights the determination of US law enforcement agencies to seek to prosecute those who exploit cryptocurrencies for illegal activities and demonstrates the increasing cooperation between domestic and international agencies in pursuing criminals who use digital assets for financial gain.
Storm was arrested on 23 August in Washington and presented in the US District Court for the Western District of Washington, while Semenov remains at large. Alexey Pertsev, another developer of Tornado Cash, is facing ongoing prosecution by the Dutch authority for violating Dutch law for allegedly concealing or disguising the origin and movement of funds.
This case also sheds light on US prosecutors' views on potential legal liabilities of developers and operators for automated software and Decentralised Autonomous Organizations (i.e. DAOs), particularly as it impacts those who create interfaces for smart contract in blockchain systems.