Sanctioning the Code: The Mixer Crackdown and Its Unraveling
In August 2022, the US Treasury crossed a line no government had crossed before: it sanctioned a piece of software. Tornado Cash, an Ethereum mixer accused of laundering billions for North Korea's hackers, was blacklisted together with the smart contracts that made it run. Three years later, the sanctions are gone. The aftershocks are not.
The first targets: Blender and Sinbad
OFAC's opening move came in May 2022, when it designated Bitcoin mixer Blender.io for helping launder more than $20 million from the $620 million Axie Infinity heist. It was the first-ever sanctions action against a virtual currency mixer (Treasury press release). Under Secretary Brian Nelson framed it bluntly: mixers that assist state-sponsored thievery would not go unanswered. Pressure did not stop the laundering. It relocated it. In November 2023, Treasury sanctioned Sinbad.io, widely viewed by chain analysts as Blender's rebrand, after it processed funds stolen in the Horizon Bridge and Axie Infinity hacks (OFAC announcement). FBI and Dutch investigators seized its infrastructure the very same day.Sanctioning code itself
The Tornado Cash designation went further than anything before it. OFAC treated immutable smart contracts, self-executing code that nobody, not even their creators, could alter, as the property of a foreign entity. Suddenly, any American who transacted with those addresses was breaking the law. Critics called it a category error. The protocol had no employees, no bank account, and no headquarters, and its original developers had long since moved on. Yet exchanges delisted the TORN token, GitHub suspended contributor accounts, and users who had mixed their own funds watched them freeze in place.Van Loon: the courts push back
Six Tornado Cash users, bankrolled by Coinbase, took the fight to court. In November 2024, the Fifth Circuit ruled for them in Van Loon v. Treasury: immutable smart contracts cannot be owned by anyone, so they fall outside the "property" that Congress let OFAC block under IEEPA (the full opinion). It was a landmark rebuke delivered just months after the Supreme Court retired Chevron deference."Perhaps Congress will update IEEPA, enacted during the Carter Administration, to target modern technologies like crypto-mixing software. Until then, we hold that Tornado Cash's immutable smart contracts... are not the 'property' of a foreign national or entity." - Judge Don Willett, Fifth Circuit
The quiet retreat
On March 21, 2025, Treasury waived the white flag. Citing a review of the "novel legal and policy issues" raised by financial sanctions on evolving technology, it removed Tornado Cash from the SDN list outright (delisting announcement). Reuters reported that the move pre-empted a court order and largely mooted the Van Loon case. One thing stayed put: developer Roman Semenov remained sanctioned.Developers on trial
Delisting helped the code. It did nothing for the people. On August 6, 2025, a Manhattan jury convicted Tornado Cash co-founder Roman Storm of conspiring to operate an unlicensed money transmitting business while deadlocking on money laundering and sanctions charges (WIRED coverage). A week earlier, the two Samourai Wallet developers pleaded guilty to the same count, with heavier charges dropped. Prosecutors have settled on a workable theory: running a mixer is a crime of operation, not publication. Whether writing privacy-preserving code alone can ever be prosecuted remains unsettled, and Storm's team has already signaled an appeal. For open-source developers everywhere, the line is still drawn in pencil.What the mixer era leaves behind
Score the three-year experiment, and the ledger looks like this:- Tornado Cash: delisted, though redesignation questions linger.
- Semenov: still on the SDN list and beyond US reach.
- Storm: convicted on one count, awaiting sentencing and possible retrial.
- Blender and Sinbad: seized, with their operators never publicly identified.