Tornado Cash Ban and the Free Speech Fight: A 2026 Explainer

Tornado Cash was a non-custodial mixer on Ethereum. It let a user deposit tokens into a shared pool of smart contracts and later withdraw them to a new address, breaking the visible link between sender and recipient on the public ledger. The software was open source, and its contracts were immutable once deployed, meaning no single party could change their rules or shut them down.

That design is the root of the dispute. Some users wanted financial privacy for ordinary reasons, such as keeping salary payments or donations from being tracked by anyone who viewed the chain. Others used the same tool to hide the origin of stolen or illicit funds. Because the contracts ran without a company behind them, the tool could not be recalled the way a centralized service could.

The key point for readers is that a mixer's technology is neutral, but its usage patterns are not. Regulators focused on the flows that passed through the pool, while developers stressed that the code did not hold or control user funds in the usual sense. Understanding this split between the software and the activity it enabled is necessary to follow every argument that comes after.

The US Treasury's Office of Foreign Assets Control added Tornado Cash, along with a set of its associated Ethereum addresses, to its Specially Designated Nationals list in August 2022. Listing an entity generally bars US persons from dealing with it, and it also prompts financial institutions and other companies to block related activity.

The action was unusual because it targeted a set of immutable smart contracts rather than a company, person or government. Software without an owner was not an obvious fit for the sanctions framework that had been built around named parties. Treasury said the tool had been used to launder large sums, and it cited the North Korean hacking group Lazarus Group as a user.

After the listing, several developer and privacy groups challenged the move. Their filings argued that the government had stretched its authority beyond what Congress intended and that the restrictions reached protected speech. The legal fight that followed was not only about one mixer. It asked whether sanctions law could reach code that no one controlled.

Readers who want the exact wording of the designation and the associated addresses should read OFAC's own publications rather than secondary summaries, since official notices are the authoritative source.

Government statements about Tornado Cash focused on money laundering, particularly the movement of funds linked to cyber theft. Reports about large hacks and the way stolen assets were broken into smaller amounts and routed through mixers shaped the official view that the service was a laundering channel.

A central concern was that a mixer can be used by criminal groups precisely because it removes the audit trail that investigators rely on. Law enforcement agencies had long raised similar concerns about privacy coins, cash and other tools that obscure transfers. Supporters of stronger controls argued that a service with no operator still needs to be restricted when it is used at scale for illicit ends.

Critics answered that most users of privacy tools are not criminals, and that a rule which treats the whole tool as a threat would sweep in a wide range of lawful activity. They also noted that the same transparency that helps investigators can expose ordinary users to tracking and profiling.

The disagreement therefore rests on two different questions. One is whether a tool with some illicit use should be restricted. The other is whether the government can restrict the tool directly, in a way that reaches the publication and use of the underlying code.

The free speech argument draws on a long line of US legal history. In the 1990s, courts considered whether source code was protected speech when the government restricted the export of encryption software. Those cases, including Bernstein v. Department of Justice, supported the view that code can express ideas and deserves First Amendment protection in some contexts.

Applied to Tornado Cash, the argument goes like this. The published source code explains how the protocol works. Developers and researchers discuss it, improve it and publish their views about its design. If the government blocks Americans from using the deployed contracts, the restriction cuts off engagement with the expression itself and burdens people who want to study or write about it.

The counter-argument is that a deployed smart contract is not just a text. Once it is running on a blockchain, it performs actions such as accepting deposits and sending funds. Courts have often treated conduct that performs a function differently from pure expression, even if the function is carried out by software.

The question of where that line falls is one of the most important parts of the Tornado Cash dispute, and it is not settled. Readers should separate the claim that code is speech from the narrower claim that a specific service is protected.

The government's position is that sanctions regulate the transactions a service performs, not the ideas it expresses. A mixer that processes transfers for sanctioned actors is, on this view, an economic instrument. Restricting its use is comparable to restricting a payment processor that handles prohibited funds, which courts have generally allowed.

Treasury and its supporters also argue that the immutability of the contracts does not put them beyond the reach of law. A tool that cannot be changed still has operators, users and infrastructure that the government can reach, such as the companies that host front ends or the people who promote the service.

The debate often turns on definitions. What counts as a publication? When does a deployed program become a service? Can a piece of software have legal personhood in the sense that matters to sanctions law? Different judges and commentators give different answers, and the answers depend on the statute and the precise factual record.

For readers, the practical takeaway is that the government's authority and the scope of free speech protection are both contested. The outcome of the case depended on which framework a court chose to apply, not only on whether the software was technically interesting.

A federal district court considered the challenge in 2023 and held that the sanctions were a permissible response to the use of the tool for illicit transactions, rejecting the claim that they violated the First Amendment. The plaintiffs appealed, and the case moved up through the courts.

In late 2024, the Fifth Circuit Court of Appeals issued a decision in the case brought by Van Loon and others. The appeals court found that the immutable smart contracts were not property in the sense the sanctions statute covered, and it held that the Treasury had exceeded its authority in designating them. That ruling was a major win for the challengers on the statutory question, although the broader constitutional arguments were treated differently.

Separately, the developer Roman Storm faced criminal charges over his role in building the software. Courts addressed motions that argued the First Amendment should bar the prosecution. A federal judge rejected the request to dismiss the charges on that basis, leaving the question for trial. Later in 2025, a jury reached a partial verdict in that case.

Because these proceedings are fast moving and involve appeals, readers should check the court dockets and reliable legal reporting for the current posture of each matter.

The dispute matters beyond one protocol because it affects how developers think about publishing software that can move money. If building a tool can create liability for its users, some teams may decide not to build privacy features at all. That outcome would change the design of financial software and shift privacy decisions to a small number of large intermediaries.

For ordinary users, the case highlights a practical gap. Many people assume that using a public, open-source application is always lawful. In reality, a service can become restricted after it is listed, and a transaction that was legal yesterday can create compliance issues today. Exchanges, banks and wallet providers may freeze or refuse related funds once a listing is in place.

The case also raises questions about who is responsible when code runs without an operator. Some people argue that responsibility should fall on the individuals who deploy or promote a tool. Others argue that enforcement should focus on the actors who profit from or direct illicit flows, rather than on the code.

None of these questions has a simple answer, and reasonable people disagree. What is clear is that legal risk is part of the design and use of decentralized software, and that it deserves attention from anyone who builds or uses it.

Because the outcome is still developing, the best approach is to verify facts yourself rather than rely on a snapshot. Start with OFAC's sanctions search tool, which lists current designations and removals along with the official notices behind them. Check the date of every notice and compare it with the most recent update you can find.

Next, look at the court records. Public dockets show filings, opinions and verdicts in the cases involving the sanctions and the criminal matter. Pay attention to whether a decision is a trial court ruling, an appellate decision or a final judgment, since each carries different weight.

Finally, read reporting from established legal publications and from policy groups on different sides of the debate. A good summary will explain what each court actually decided and what remains open. Be cautious with social media posts that claim a final resolution without citing a primary source.

If you are making a decision that depends on the outcome, such as a business or development plan, speak to a lawyer who practices sanctions and financial crime law in your jurisdiction.

The Tornado Cash dispute has attracted scams that exploit confusion about the sanctions. Criminals may claim they can recover funds sent to a mixer for a fee, or they may offer a token airdrop tied to the name. Some pose as lawyers, support staff or government investigators and ask for seed phrases, private keys or payment to close a supposed case.

Use these defensive habits. Never share a seed phrase or private key with anyone, including people claiming to represent a company or agency. Official bodies do not request those secrets. Treat unsolicited messages about recovery or compensation as suspicious, and do not click links in them.

Before you interact with any contract, check its address against an official source and read what permissions you are granting. Revoke token approvals you no longer need using a reputable approval management tool. Keep your wallet software updated and consider a hardware wallet for significant holdings.

If you believe you have sent funds to a scam, act quickly. Contact the platform or exchange involved, report the incident to the appropriate authority in your country, and document the transaction hashes. Be aware that recovery services that ask for upfront payment are a common second scam.

The Tornado Cash ban has become a test of how far governments can reach software that runs without a manager, and how far free speech protections extend to code that does things. Reasonable people disagree on the answers. Supporters of the sanctions see a necessary tool against laundering. Critics see a restriction that reaches far beyond its purpose.

For readers, the most useful steps are to understand the legal terms, follow the official sources, and keep personal security habits strong. Know that the case is ongoing, that rulings have differed by court and issue, and that the current status of any listing can change. Keep records of your own transactions and seek professional advice before taking any action with legal consequences.

If you want to track on-chain activity or protocol data while you follow a story like this, independent data sites and block explorers can help you check how funds move, though they do not replace legal advice or official notices. Always confirm what a dashboard measures before drawing conclusions from it.