Three ways the Tornado Cash case can go from here

A version of this story appeared in our The Guidance newsletter on December 2. Sign up here.

A court victory won by six Tornado Cash users last week excited crypto privacy advocates.

Their longstanding argument that code or software cannot be sanctioned was vindicated by a US appellate court.

But what happens next?

What’s next anon?

There are several possibilities. For starters, the US Treasury Department’s Office of Foreign Assets Control, or OFAC, can’t be happy that the sanctions of Tornado Cash were found unlawful.

The agency had acted, it said, out of concern for national security, and invoking that issue usually wins broad acceptance from jurists and lawmakers.

With an appellate court directing a lower court to dismiss key portions of the sanctions, the government may ask an “en banc” group of judges in the Fifth Circuit Court of Appeals to rehear the case in the hope it’ll get a favourable ruling.

Or the agency could appeal directly to the US Supreme Court, which will have the final word if it accepts the case.

Even though President-elect Donald Trump picked three of the court’s nine justices during his first term, there’s no telling how they might fall on the Constitutional issues at play in this case.

“These national security issues don’t neatly cut down party lines,” Bill Hughes, senior counsel at Consensys, told DL News.

“Trump and those around him view embracing crypto as an important national policy, but note that when he first spoke about this stuff, he said, ‘I want to make sure it’s safe.’”

It is worth noting that the three-judge appellate panel highlighted how Tornado Cash’s smart contracts laundered $455 million in illicit money for Lazarus Group, the North Korea-linked hacking outfit, as part of an effort to fund the pariah nation’s nuclear weapons programme.

In finding the 47-year-old national security law underpinning sanctions ill-suited to be applied to smart contracts, the judges also suggested that Congress could pass a new statute that covers blockchain-based technologies like Tornado Cash.

More hacks

What would that law look like?

“The new laws around privacy tech would allow US citizens to build and use systems that don’t create centralised honeypots of personal data through KYC requirements,” Ameen Soleimani, prominent Ethereum developer and Tornado Cash advocate, told DL News. KYC refers to know-your-customer practices.

Whether Congress does take up such a bill next year is unclear.

Whatever happens on Capitol Hill usually takes a lot of time.

“China and Iran probably need to hack a bunch more US financial institutions and release everyone’s financial data a few more times before the US government realises the best thing it can do to protect its own people is to help us protect ourselves,” Soleimani said.

Immutability for the win

Even though the next steps are uncertain, there’s no denying the upside for crypto — immutability won the day.

“These judges didn’t celebrate crypto or the ideas behind it because it’s decentralised,” Christian Zimmerman, partner and chief legal officer at venture firm Greenfield Capital, told DL News.

“If this wasn’t an immutable contract, if somebody had the admin keys, then this ruling would be completely different.”

Indeed, the court ruled that the smart contracts enabling the privacy protocol were not property.

No one owns or controls them, and no admin keys exist to let developers change the contracts.

So OFAC erred by adding Tornado Cash to its sanctions list in 2022, the appellate court in Texas found.

“The simple distinction is build a tool, not a service,” said Hughes.

Liam Kelly is a Berlin-based DL News correspondent. Got a tip? Email at liam@dlnews.com.