The US ban on the crypto mixer is a bombshell for the decentralized internet. The decision by US authorities has privacy and confidentiality advocates worried.
August is usually a pretty quiet month, even for cryptocurrency users. But this year, the US Treasury wanted otherwise. At the beginning of August, the OFAC (Office of Foreign Assets Control), dependent on the Treasury, purely and simply prohibited the use of Tornado Cash for any American national or resident, companies included. From now on, using Tornado Cash is de facto considered a crime in the United States. The reason: Tornado Cash is used to anonymize transactions, and therefore prevent its users from being identified.
This radical decision was followed by several others no less strong: arrest in the Netherlands of the creator of Tornado Cash, removal of the open source code from GitHub and the creator’s account, blocking of addresses that have passed through Tornado Cash. For nearly a month now, the proponents of security at all costs and those of the protection of privacy have been clashing, with common ground close to the impossible.
What is Tornado Cash and Cryptocurrency Mixers?
Putting aside blockchains designed to anonymize transactions like Monero (XMR), transactions on the blockchain are pseudonyms. Thus, it suffices to identify the person or the company behind a public address to trace all of its transactions. A few criminal cases, including the famous Silk Road, named after this website selling illegal products paid for in BTC, have been solved in part thanks to the traceability of transactions.
In order to complicate the identification of the person behind a public address, cryptocurrency mixers have started to be used. Tornado Cash is the most famous of them. Its operation resembles that of an exchange platform. Everyone can deposit cryptocurrencies in the mixer, using their classic public address. In exchange, the mixer certifies that you have deposited so many cryptos and that you can come and withdraw them at any time.
However, to fully understand the usefulness of Tornado Cash, we must take the image of the kitchen mixer. You put carrots and cabbage inside, you mix it all up and the result doesn’t really identify where the carrots or the cabbage are. For a cryptocurrency mixer, it’s the same thing. Tornado Cash will process multiple deposits from multiple public addresses and mix users’ cryptocurrencies.
When you request the withdrawal of your cryptos from Tornado Cash, it then becomes very difficult to link this outgoing transaction to the incoming transaction, because it is no longer clear who owns the withdrawn cryptocurrencies. This type of mixer, the most common, is called CoinJoin.
The interest of Tornado Cash was quickly understood by the criminals, because it greatly complicates the work of the investigators. It would be useless to deny that this is the first perceived interest of the mixer. As a result, Tornado Cash was quickly targeted by the authorities, especially the Americans.
After a long investigation, the Treasury cracked down and therefore purely and simply prohibited the use of Tornado Cash on American territory. According to the Treasury, over $7 billion have been laundered by the famed mixer since its inception in 2019. Among those $7 billion is the $620 million from the Lazarus Group, a North Korean government-backed hacker network. Additionally, many hackers who have stolen cryptocurrency have used Tornado Cash to cover their tracks as much as possible.
The other issue is that the illicit use of Tornado Cash has been trending up year-to-date. According to a Chainalysis studyreferenced in work on crime in cryptocurrencies, the share of illegality in Tornado Cash would be 23% in 2022, compared to 12% in 2021. The second quarter of this year saw $600 million in illicit transactions transit by Tornado Cash, more in three months than for the two years 2019 and 2020 combined.
The condemnation of a neutral technology
The use of Tornado Cash for illicit purposes is not questioned. However, the method used to counter this use is causing a lot of talk in the Web3 community and more generally among privacy advocates.
Indeed, the US Treasury has not only sanctioned Tornado Cash, but anyone who has used this blender for any reason. If we take the figures from Chainalysis, 77% of Tornado Cash users have nothing to reproach themselves for, a figure not taken into account by OFAC.
Thus, Circle, issuer of USDC and EUROC stablecoins, has decided to block all addresses that have deposited USDC on Tornado Cash, thus complying with the decision of the authorities. Ethermine, main mining pool on Ethereum, refuses to validate transactions from addresses that have passed through Tornado Cash.
Alexey Pertsev, creator of the Tornado Cash code, was even arrested in the Netherlands and the open source code was removed from GitHub. Yet, neither Pertsev nor the code instigated anyone to use Tornado Cash for illicit purposes. In other words, because it has been used for illegal purposes, a neutral technology is condemned and the main developer of the code, open source, is considered co-responsible.
A worrying setback
Beyond this legal aspect, many point to threats to confidentiality and privacy. Indeed, among the non-illicit uses of Tornado Cash, some people simply want to maintain some privacy. For example, one may simply want to hide the real value of his wallet, rather than revealing it to anyone who knows our public address.
Tornado Cash was also used for transactions considered risky. For example, Vitalik Buterin, co-founder of Ethereum, has declared using Tornado Cash to donate to Ukraine. The objective was then to protect the recipients of the cryptocurrencies.