US Government Amps Up Inevitable Clash With Crypto Privacy in Tornado Cash Blacklisting

Nikhilesh De is CoinDesk's managing editor for global policy and regulation. He owns marginal amounts of bitcoin and ether.

Jesse Hamilton is CoinDesk's deputy managing editor for global policy and regulation. He doesn't hold any crypto.

The instant Satoshi Nakamoto’s Bitcoin white paper came out in 2008, it was certain there'd be a clash between cryptocurrency's privacy ethos and conventional banking regulations designed to ensure money moving through the financial system isn't coming from, or going toward, something illegal.

Step by step, bank overseers have widened their enforcement territory to include digital assets. In one sense, crypto was their dream financial system, with the path of most transactions auditable on a public ledger, albeit with the identities of senders and receivers hidden behind alphanumeric addresses that looked like they’d been typed by a cat crawling on a keyboard. If the users bought or cashed out their crypto at regulated exchanges, governments could subpoena those companies for their real-world identities.

Crypto enthusiasts responded with new ways to obfuscate the origins and destinations of transactions. Tornado Cash, for instance, mixes its users' coins together so the actions of individuals are hard to track.

When the U.S. Treasury Department blacklisted Tornado Cash on Monday, banning all Americans from using the service, regulators dramatically escalated that battle as they seek to squash the free-wheeling (if imperfect) anonymity of crypto. The U.S. said Tornado Cash has been used to launder more than $7 billion. That includes $455 million stolen by Lazarus Group, the North Korean hacking group, and at least $7.8 million from this month’s Nomad exploit.

"The crypto space talks about wanting to go mainstream and be a new financial system," said Yaya Fanusie, an adjunct senior fellow at the Center for a New American Security who also consults on crypto money-laundering safeguards and is a former CIA analyst. "If you want to play in the big leagues, you're going to have to play with big regulation. Mixers are by themselves not illegal nor illicit. What's illicit is how a tool is used."

Everyone from traditional finance knows the drill: Financial firms are required to figure out who their customers are and take steps to prevent money laundering and sanctions evasion. Opening a bank or brokerage account? You've got to have an ID. Over in crypto, meanwhile, anonymity is a tent pole of the culture, so the drive to create something like Tornado Cash is no surprise.

Read more: What Is KYC and Why Does It Matter For Crypto?

A co-founder of Tornado Cash told CoinDesk earlier this year that the technology was basically unstoppable. The developers behind Tornado Cash had little control over what users did through it, Roman Semenov said in an interview published in January. "There is not much we can do in terms of helping investigations because the team doesn't have much control over the protocol," he said.

But U.S. financial regulators are trying to prove Semenov wrong through the action announced Monday – though the code that runs the project is publicly available, so in theory someone else could start a clone or just use different Ethereum addresses than the ones the Treasury Department blacklisted. Tornado Cash was added to the Specially Designated Nationals list, meaning Americans face criminal penalties if they interact with Tornado Cash or Ethereum addresses tied to the protocol. Among other uses, the SDN list is one of the tools the U.S. government has used to punish Russia.

The crackdown does raise a question that's long swirled around crypto: Paper money is anonymous, just like crypto, so why are attempts to cover tracks in crypto being singled out? A natural retort is that money laundering and sanctions evasion are what's being targeted here, just as they would be with real U.S. dollar bills.

"Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks," Undersecretary of the Treasury Department's Terrorism and Financial Intelligence agency Brian E. Nelson said in a statement Monday.

But that's not likely to quiet the calls of crypto enthusiasts who want to retain user privacy. Coin Center, a crypto think tank, blasted the action taken against Tornado Coin.

"It is not any specific bad actor who is being sanctioned, but instead it is all Americans who may wish to use this automated tool in order to protect their own privacy while transacting online who are having their liberty curtailed without the benefit of any due process," it wrote in the aftermath of the announcement.

Read more: The Privacy Boom Is Going to Change Everything