Mixers

Dutch authorities have announced their arrest last week of a Tornado Cash developer in Amsterdam for his alleged involvement in concealing criminal financial flows and facilitating money laundering through his work on the crypto mixing service.

Tornado Cash, which is built on the Ethereum blockchain, allows users to conceal the sending and receiving addresses of transactions, thus concealing their identity. It has reportedly been widely used by criminals to launder stolen assets, but has also been used for legitimate purposes such as concealing the identities of Ukrainian citizens receiving donated crypto.

Dutch Investigators Say More Arrests May Follow

The Tornado Cash developer’s arrest was announced by the Dutch Fiscal Information and Investigation Service (FIOD) on August 12, two days after it took place. The FIOD said it couldn’t rule out further arrests in connection with the case.

FIOD’s interest in Tornado Cash began in June of this year when its Financial Advanced Cyber Team (FACT) launched a criminal investigation of the service. FACT claims that Tornado Cash has been widely used by hackers to launder vast quantities of stolen crypto assets including “funds stolen through hacks by a group believed to be associated with North Korea”.

FACT found evidence of high-value criminal cash flows through the mixer since it was launched in 2019:

Investigations showed that at least one billion dollars’ worth of cryptocurrencies of criminal origin passed through the mixer. It is suspected that persons behind this organisation have made large-scale profits from these transactions.
Dutch Fiscal Information and Investigation Service (FIOD)

Crypto Community Reacts With Dismay

This arrest comes after the US Treasury’s sanctioning of Tornado Cash last week for what it described as the crypto mixer’s repeated failures to impose effective controls to curtail illegal use of the service. Tornado Cash had previously attempted to weed out criminal users of the service by blocking sanctioned addresses, but the US authorities considered these efforts inadequate.

The crypto community has generally reacted negatively to this arrest, suggesting it represents an infringement of the developer’s right to freedom of speech and an attack on crypto users’ privacy:

This is correct, and the "code == speech" claim that many of us have been making for decades is now very very literal. As in, you literally just make words and sentences and the computer does things.

Guys they just arrested a Tornado Cash dev for (open source) speech. https://t.co/xOGxwHiBGd
— jonstokes.(eth|com) (@jonst0kes) August 12, 2022

They arrested the developer of tornado cash. 🚨

I repeat: a man was arrested for writing code that served as a public good for people to maintain their privacy online.

They put a man in jail because bad people used his open source code.

This cannot stand in any free society.
— RYAN SΞAN ADAMS – rsa.eth 🦇🔊 (@RyanSAdams) August 12, 2022

Other Twitter users have also pointed out the disparity between the treatment of the Tornado Cash developers and the creators of some high-profile crypto failures and rug pulls:

tornado cash dev arrested

do kwon at home tweeting
— ciniz.sudo 👁 (@screentimes) August 12, 2022

Write privacy preserving software, get arrested (tornado cash dev)

Rug pull millions of people for billions of dollars, chill in some legal haven (Su, Kyle, Do Kwon, Mashinsky)
— ₿itcoin Gandalf the Orange (@BTCGandalf) August 12, 2022

Tornado Cash, a mixing service that obscures crypto transaction information, has been sanctioned by the US Treasury, which claims the DeFi protocol is regularly used for money laundering to cover up cybercrime.

Treasury added Tornado Cash and 44 of its Ethereum and USDC wallet addresses to its Specially Designated Nationals list of embargoed entities typically used to prohibit people in the US from dealing with terrorists and authoritarian regimes.

According to Treasury, more than US$7 billion had been laundered via Tornado Cash, including some US$455 million of the US$625 million stolen by North Korean hacking group Lazarus in an exploit of the Ronin Network in March this year. Tornado Cash was also used to conceal the source of more than US$96 million in dirty money from June’s Harmony Bridge heist, Treasury said.

Protocol Fails to Balance Privacy and Compliance

Tornado Cash ‘mixes’ crypto transaction details to break the links in on-chain activity, in the interests of preserving users’ privacy. Deposits are made via one address and withdrawn by a different address, meaning transactions are harder to trace – and therefore appealing to criminals.

In April 2022, Tornado Cash moved to block access by addresses sanctioned by Treasury’s Office of Foreign Assets Control (OFAC) in an attempt to demonstrate compliance. More recently, the protocol transitioned to a fully open-source user interface to increase transparency by enabling contributors to suggest code improvements.

However, it’s clear Treasury did not feel the protocol was meeting its anti-money-laundering obligations, making it a threat to US national security.

Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks. Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them.
Brian E. Nelson, Treasury Under Secretary for Terrorism and Financial Intelligence

Treasury Issues Broader Warning

Treasury also had a warning for the broader crypto ecosystem: “As today’s action demonstrates, mixers should in general be considered as high-risk by virtual currency firms, which should only process transactions if they have appropriate controls in place to prevent mixers from being used to launder illicit proceeds.”