"Crypto mixers" exist because of a peculiar feature of cryptocurrencies—most are fully traceable using their public blockchain ledgers. To provide more privacy to crypto account owners, a mixer will let people toss their crypto into a large pool, where it is "mixed" with other people's crypto. At a later date, each crypto owner can choose to withdraw their money from the pool into a new, anonymous wallet, thus making the movement of the crypto harder to track.
Of course, the obfuscation doesn't work well if the blockchain shows 1,231.7 BTC entering a mixer and 1,231.7 BTC being withdrawn to a new wallet. So mixers will take steps to disguise the transactions. Tornado Cash, which operated on the Ethereum blockchain, mandated that users could only deposit money into its pools in 0.1, 1, 10, and 100 ETH increments, making it far harder to spot specific amounts entering and leaving the mixer.
Tornado Cash also used a complex system of "relayers" to pay the Ethereum "gas fees" charged for transactions on the network; without doing this, it would be clear which old account was paying to "mix" money into which new account. The whole process relied on the use of irrevocable "smart contracts," all of which sounds rather technically daunting, but Tornado put a nice user interface atop the details that made the service far easier to use than it might sound.
To some crypto backers, all of this sounds like "privacy." Older Americans are getting robbed at gunpoint in their own homes by thieves who know they have substantial crypto assets; in France, people are getting fingers cut off or abducted from the streets of Paris. Much safer not to have your crypto assets tied to your name in any way. Besides, your bank balance and investment accounts aren't public, right?
And the founders weren't involved in any transactions. They simply wrote some code, and if people used it for things it shouldn't be used for, whose fault was that? No one sues the phone company when a scammer calls their number.
The US government did not see things this way. To the government, public-facing privacy was all well and good—but financial institutions can't simply turn a blind eye to who their customers are and what they are doing. They must, at least for internal use, "know your customer" (KYC) and comply with anti-money laundering (AML) rules. To the government, everything Tornado was up to looked a lot like money laundering. (You can read the full indictment here.)
There was, for instance, the fact that the service was literally being used for money laundering by a sanctioned adversary. According to the government, the North Korean hackers of the Lazarus Group laundered hundreds of millions of dollars through Tornado Cash. In total, the feds suspected that the Tornado service had abetted more than $1 billion in laundered money, making it one of the go-to global money-laundering systems.
In 2023, the federal government arrested one of the Tornado Cash founders, Roman Storm, in the Seattle area. (The other two founders are not in the US.) The government showed internal text messages making it clear that Tornado Cash developers knew about money laundering on their service, but they built it in such a way that they would profit from fees and could do nothing to help victims. (One such victim was a crypto exchange, which in 2021 had a portion of its assets stolen and laundered through Tornado; when contacted about the stolen property, Tornado said it could not help them.)
The government also introduced evidence showing that the Tornado founders were fully aware of "know your customer" and "anti-money laundering" rules but decided not to implement them.
But Storm fought back. In a trial in Manhattan over the last few weeks, his defense team has introduced text messages showing that Storm was glad to have the North Koreans identified. As he put it, "I’m glad those f*ckers are detected." They contend that Storm tried to help the crypto exchange recover its money by pointing them to blockchain analysis tools; he could not do more because it simply wasn't possible with the Tornado system, which was built for anonymity. As for regulatory compliance, Storm's defense introduced chats in which he talked about making sure Tornado Cash was "legal" so that "people wouldn’t think that it’s some kind of damned mixer. So that the reputation would be clean."
(Storm apparently does not see Tornado as a "mixer" because of its technical infrastructure and the use of smart contracts, which create a "non-custodial" system in which Tornado itself does not technically accept or control the money. Also, because Tornado doesn't advertise on the dark web, as did the Helix mixer, which was shut down a few years ago.)
Storm's venture capitalist backers also assured him at one point that, in their view, Tornado was operating legally.
Mixed verdict
The trial wrapped up last week, and the jury in Storm's case has deliberated for multiple days, struggling to reach a consensus on the main charges. Today, they announced that they were deadlocked on the two largest—money laundering and violating sanctions on North Korea. (Prosecutors will decide later if they plan to re-try Storm on those charges.)
But they did find Storm guilty on a lesser charge of operating an unlicensed money transmitting business. He will be sentenced soon and is out on a $2 million bail until then.
The government continues to pressure crypto mixers. The team behind the mixer Samourai Wallet was arrested in 2024 and last week agreed to plead guilty to some of the charges in their case.
But the Tornado Cash saga shows that, at least when the services are built and run and advertised in a certain way, juries are not always convinced about maximal government claims.
Google would like you to study with Gemini instead of cheat with it