Galaxy Digital: A Comprehensive Analysis of the Impact of the U.S. Treasury's Sanctions on Tornado Cash

Original Title: “OFAC Sanctions Tornado Cash: Issues & Implications”

Author: Galaxy Digital

Compiled by: Alpha Rabbit

Core Insights

• This is the first time that an on-chain smart contract has been directly sanctioned by OFAC.

• Although this sanction against Tornado Cash marks OFAC's first inclusion of a smart contract on the SDN list, OFAC has previously sanctioned other individuals and entities related to cryptocurrency (as well as associated cryptocurrency addresses).

• Simply pointing out that Tornado Cash obscures the source of funds is not enough; real sanctions require the identification of "money laundering." To establish money laundering, the obscured funds must originate from illegal activities, or the obscuring must be for unlawful purposes. The fact that most inflows to Tornado Cash come from DeFi applications and CEXs indicates that a significant number of ordinary users are using the protocol to enhance privacy, rather than for illegal reasons.

• Users of the most widely used Ethereum wallet, MetaMask, are now also prohibited from interacting with Tornado Cash (because MetaMask relies on Infura to interact with Ethereum; users who still want to use Tornado Cash must manually configure MetaMask's node settings to avoid Infura, ensuring that MetaMask can interact with Tornado Cash). However, doing so would expose them to liability for violating U.S. sanctions, and such manual configuration has a barrier to entry, severely limiting the number of Tornado Cash users.

• The TORN governance token will also struggle to operate, not only because the number of Relayers staking TORN tokens will decrease, but also because GitHub completely does not support any operations related to Tornado Cash.

• However, since Tornado Cash is a decentralized application deployed on Ethereum (an immutable blockchain), the application itself will continue to operate on the network unaffected and is virtually impossible to stop.

• When the transfer function is called on USDT or USDC, the smart contract queries an off-chain blacklist to ensure that both the sending and receiving addresses do not exist. If an address appears on the blacklist, the transaction will be blocked. While this authority may not grant the ability to blacklist individual tokens or seize tokens from specific addresses, it can affect blacklisted addresses.

• Some critics argue that MakerDAO and DAI face existential risks from PSM and USDC—if regulators may require a significant increase in blacklisting or freezing USDC, or if they enforce the establishment of a practical whitelist that suppresses the free transfer of USDC, then most of Maker's DAI debt will be unsupported, leading to insolvency of the system.

• A DeFi system based on centralized fiat-backed stablecoins may face significant issues. For years, many have believed that Circle and Tether could arbitrarily blacklist USDC and USDT addresses, rendering those coins useless. This week, the Tornado Cash incident has truly highlighted this old problem.

Background On Monday, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) added Ethereum addresses associated with Tornado Cash to its list of sanctioned entities. Why is this a landmark event? Because this is the first time the U.S. government has sanctioned a smart contract application. This sanction has sparked philosophical debates about online privacy, but the more immediate impact concerns the resilience of the Ethereum decentralized finance ecosystem.

Key Conclusions

• OFAC sanctioned 38 smart contract addresses related to Tornado Cash (an on-chain mixer).
• This is the first time OFAC has sanctioned a smart contract protocol.
• Ethereum node providers, wallets, and code repositories quickly prohibited access for Tornado Cash users, raising serious doubts about the decentralization of a widely used tech stack.
• Stablecoin issuers froze assets related to Tornado Cash, clearly indicating that tokens for which off-chain issuers are responsible represent a major vulnerability in the crypto ecosystem (especially DeFi).
• Given the reliance on USDC and USDT, it is evident that even decentralized stablecoins are fragile. The two largest decentralized stablecoins, DAI and FRAX, rely on USDC for over two-thirds of their backing.
• OFAC's actions also raise policy questions about internet privacy and how various levels of U.S. government agencies view privacy technologies differently.

Overview of OFAC On Monday, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) added the Ethereum-based privacy application Tornado Cash to its list of restricted entities. Specifically, OFAC added 38 Ethereum smart contract addresses associated with the Tornado Cash application to the Specially Designated Nationals (SDN) list, designating them as restricted entities, meaning that interactions with the Tornado Cash protocol or assets derived from it are deemed illegal.

Specifically, OFAC added 38 Ethereum addresses related to the Tornado Cash application to the SDN list, indicating that any entity interacting with the Tornado Cash application or assets derived from Tornado Cash is engaging in illegal activity.

This is the first time that an on-chain smart contract has been directly sanctioned by OFAC.

In its press release, OFAC stated that the sanction against Tornado Cash is due to the application essentially assisting, sponsoring, or providing funding, material, or technical support for most or all of the network activities originating from outside the U.S., which could pose a significant threat to U.S. national security, foreign policy, or economic health or financial stability, leading to serious misuse of funds or economic resources, trade secrets, personal identification, or financial information, and allowing certain criminals to gain commercial or competitive advantages or private economic benefits.

The Office of Foreign Assets Control (OFAC) is part of the U.S. Department of the Treasury, primarily composed of lawyers and intelligence investigators. The office aims to support U.S. national security and foreign policy goals, with the mission of implementing sanctions in the economic and trade sectors. OFAC adds individuals and entities to the SDN list, prohibiting U.S. persons and entities from engaging in any "trade or financial transactions and other dealings" with them. Note that individuals who transact with those on the list may also face sanctions.

History of OFAC Sanctions on Cryptocurrency
Although this sanction against Tornado Cash marks OFAC's first inclusion of a smart contract on the SDN list, OFAC has previously sanctioned other individuals and entities related to cryptocurrency (as well as associated cryptocurrency addresses), as follows:
Sanctions against cryptocurrency addresses or entities involved in cryptocurrency (partial list):

• November 28, 2018: OFAC sanctioned BTC addresses belonging to Iranian nationals.
• August 21, 2019: OFAC sanctioned BTC and LTC addresses allegedly from China.
• March 2, 2020: OFAC sanctioned cryptocurrency addresses (mainly BTC) belonging to North Korea (Lazarus Group).
• September 10, 2020: OFAC sanctioned BTC, ETH, LTC, ZEC, and BSV addresses, claiming these addresses belonged to Russian nationals attempting to influence the U.S. presidential election.
• September 16, 2020: OFAC sanctioned BTC, ETH, XMR, LTC, ZEC, DASH, BTG, and ETC addresses, claiming they belonged to Russian hackers.
• April 15, 2021: OFAC sanctioned BTC, ETH, BCH, LTC, ZEC, DASH, and XVG addresses, claiming these addresses belonged to Russian nationals attempting to influence the U.S. presidential election.
• July 28, 2021: OFAC sanctioned BTC addresses allegedly belonging to Syrian nationals.
• September 21, 2021: OFAC added BTC, ETH, and USDT addresses, claiming these addresses belonged to a cryptocurrency exchange (SUEX) involved in laundering funds earned through ransomware.
• November 8, 2021: OFAC added BTC, ETH, LTC, DASH, XMR, XRP, BCH, and USDT addresses, claiming these addresses belonged to ransomware groups.
• April 5, 2022: OFAC added BTC, ETH, and USDT addresses, claiming these addresses belonged to the Estonian darknet Hydra Market.
• April 14, 2022: OFAC added an ETH address allegedly belonging to North Korea's Lazarus.
• May 6, 2022: OFAC added BTC addresses allegedly belonging to the Bitcoin mixing service Blender.io and sanctioned ETH addresses belonging to North Korean Lazarus Group hackers, which were related to the stolen funds from Axford and Axie Infinity's Ronin Bridge.
• April 20, 2022: OFAC added Russian BTC miners and the hosting service provider Bitriver and its 10 subsidiaries to the SDN list.
• August 8, 2022: OFAC added 45 ETH addresses related to Tornado Cash.

Who is Using Tornado Cash? Since the launch of Tornado Cash in 2019, it has been used by many entities, some of which have been identified as criminal organizations. A recent report from Chainalysis stated that 50% of the funds flowing into Tornado Cash come from decentralized finance (DeFi), 20% from centralized exchanges, and nearly 30% of the funds are associated with addresses of hackers attempting to launder money and sanctioned addresses. In another analysis, it was estimated that 35% of Tornado Cash's transaction volume comes from criminal organizations.

In its press release, OFAC stated that Tornado Cash has been used to "launder over $7 billion worth of virtual currency" since its launch. The cumulative total transaction volume through Tornado Cash is $7.6 billion, but according to the aforementioned data from Chainalysis and Nansen, the amount laundered from criminal organizations may be significantly lower.

Moreover, this article also discusses that simply pointing out the function of Tornado Cash in obscuring the source of funds is not enough; real sanctions require the identification of "money laundering." To establish money laundering, the obscured funds must originate from illegal activities, or the obscuring must be for unlawful purposes. The fact that most inflows to Tornado Cash come from DeFi applications and CEXs indicates that a significant number of ordinary users are using the protocol to enhance privacy, rather than for illegal reasons.

Of course, it is difficult to know exactly how many Tornado Cash interactions from DeFi and CEX are from innocent users rather than sanctioned addresses, but it is understood why users utilize Tornado Cash.

Some of the reasons include (according to Twitter @Rezajafery):

• To receive payments in cryptocurrency but not want employers to know all your financial details.
• To pay service fees in ETH but not want them to see everything you do on-chain.
• Having been doxxed and harassed online.
• Wanting to donate to polarizing causes.
• Wanting to send anonymous gifts.
• Feeling uncomfortable that people who know you might know too much about you.
• Believing that the mainstream adoption of crypto means everyone can access all this information (retailers, banks, potential employers), questioning whether they will use this information ethically.
• Ethereum co-founder Vitalik Buterin acknowledged using Tornado Cash for donations.

Tornado Cash Application Data

Since its launch in August 2019, Tornado Cash has achieved a cumulative TVL of $7.6 billion. Currently, Tornado Cash exists on 7 different networks, although 92% of the funds are held on Ethereum (92%) and 8% on the BNB chain.

Various Impacts of This Sanction

0. Impact on Tornado Cash The recent sanctions by the U.S. Treasury against Tornado Cash have led to all individuals and entities in the U.S. being prohibited from using the application, whether directly or indirectly through third-party services. Of course, this is not the first mixing service sanctioned by the U.S. Treasury; earlier this year, the Treasury sanctioned Blender.io, a mixing service operating on the Bitcoin blockchain. However, unlike Blender.io, Tornado Cash is a decentralized service that primarily operates through smart contracts on Ethereum. This means that although Tornado Cash, its official website, and on-chain addresses have been sanctioned, the protocol itself cannot be shut down. Users sending transactions to Tornado Cash will still be able to access mixing services.

This sanction has restricted access to Tornado Cash, and users not only cannot access the Tornado Cash website, but third-party node operators like Infura and Alchemy will also stop supporting Tornado Cash-related services. Furthermore, users of the most widely used Ethereum wallet, MetaMask, are now also prohibited from interacting with Tornado Cash (because MetaMask relies on Infura to interact with Ethereum; users who still want to use Tornado Cash must manually configure MetaMask's node settings to avoid Infura, ensuring that MetaMask can interact with Tornado Cash). However, doing so would expose them to liability for violating U.S. sanctions, and such manual configuration has a barrier to entry, severely limiting the number of Tornado Cash users.

It is worth noting that most users interact with Tornado Cash through third-party interfaces, such as the Tornado Cash official website, which has gone offline after being sanctioned. However, the Tornado Cash smart contracts still exist and can still be accessed on the Ethereum blockchain (because the state history of the blockchain cannot be altered), so users can still interact directly with Tornado Cash, but they can no longer access the front-end pages of the website.

Additionally, the sanctions against Tornado Cash also include all developers and code contributors associated with Tornado Cash. Although Tornado Cash can still be used on Ethereum, this sanction means that any further changes to the protocol through governance are illegal. Tornado Cash's GitHub has been deleted, and the GitHub account of founder Roman Semenov has reportedly been disabled. Therefore, while Tornado Cash itself continues to run on Ethereum, it may not be possible to modify its code or conduct new development.

Adding new Tornado Cash pools on different chains will be halted. Of course, it is also possible that anonymous individuals or groups may copy the Tornado Cash codebase for further development. However, the clear signal from the U.S. Treasury is that all such types of applications will be subject to U.S. sanctions, which may deter most engineers from participating in the development of "Tornado Cash."

Finally, while the core functionality of Tornado Cash will not be affected by U.S. sanctions, the additional privacy services provided to users through Tornado Cash will be halted.

What is the Relayer Registry

(The Relayer registry was passed with a 100% approval rate (about 35,000 TORN). Any user staking more than 300 TORN can become a Relayer. This proposal is set to be executed today around 17:50. The Ethereum privacy trading platform Tornado Cash released a governance proposal to update the rules related to Relayers to enhance the decentralization level of the protocol and further improve the holding efficiency of TORN. The proposal mainly states that any user staking more than 300 TORN will be able to become a Relayer and be added to the priority list. Each withdrawal through a Relayer requires a fee paid in TORN (currently at a rate of 0.3%), which will be stored in the StakingReward contract and distributed to TORN holders participating in governance.) Reference: BlockBeats

Relayers can pay network fees, allowing users to withdraw from Tornado Cash, thus preventing users' wallets or addresses from being easily linked to Tornado Cash. Due to the recent sanctions, Relayers withdrawing on behalf of users from Tornado Cash clearly violates U.S. law. Therefore, the role of Relayers may become completely unworkable, as most Relayers located in the U.S. will cease operations to comply with the sanctions. The TORN governance token will also struggle to operate, not only because the number of Relayers staking TORN tokens will decrease, but also because GitHub completely does not support any operations related to Tornado Cash.

In summary, U.S. sanctions against Tornado Cash primarily affect user access to the protocol, collaborative code development, and certain protocol functionalities, such as the distributed relayer network. This will make it more difficult for ordinary users to participate in any of these activities. However, since Tornado Cash is a decentralized application deployed on Ethereum (an immutable blockchain), the application itself will continue to operate on the network unaffected and is virtually impossible to stop.

1. Vulnerabilities Exposed by Stablecoins

First, the law stipulates that fiat-backed stablecoin issuers must comply with KYC/AML and transaction monitoring activities. To comply with these laws, fiat-backed stablecoin issuers can maintain a blacklist of blocked addresses or prevent specific addresses from interacting with their stablecoins, thereby maintaining control over the management of stablecoins.

For example, when the transfer function is called on USDT or USDC, the smart contract queries an off-chain blacklist to ensure that both the sending and receiving addresses do not exist. If an address appears on the blacklist, the transaction will be blocked. While this authority may not grant the ability to blacklist individual tokens or seize tokens from specific addresses, it can affect blacklisted addresses. Circle confirmed in a blog post released on Tuesday that it is complying with the Treasury's latest sanctions against Tornado Cash, blocking 38 addresses that collectively hold $149,000 in USDC (an average of $3,921 per address) accessed from Circle Accounts.

While complying with the Treasury's orders, Circle does not agree with the forced implementation of the blacklist function in its open-source protocol, arguing that "being forced to use this function to shut down all USDC access protocols in the entire open-source project is problematic." In the past, Circle has stated that all sanctioned digital assets are intended to comply with OFAC sanctions and court orders, adding that "blocking is not something Circle does unilaterally or arbitrarily; it is an obligation to follow relevant authorities."

However, this power to block arbitrary transactions reflects the limitations of fiat-backed stablecoins, particularly in terms of on-chain interactions like DeFi applications, where users are almost completely in the dark about decisions regarding blacklisted addresses, and everything is opaque. This situation is entirely contrary to the ideal of open and transparent governance processes in crypto networks, where decision-making power is handed over to the community.

Fiat-backed stablecoin holders can only trust that centralized stablecoin issuers themselves do not have issues, behave well, and will not abuse their power. In fact, we can clearly see the dangers of granting such blacklist powers to centralized companies, which could easily be abused by these commercially driven companies.

2. Broader Implications

Because stablecoins are crucial for the normal operation of both on-chain and off-chain crypto markets, fiat-backed (or custodial/regulatory) stablecoins account for 92% of today's $155 billion stablecoin market. There is also the issue that many crypto-supported or "non-custodial" stablecoins rely on fiat-backed stablecoins, such as the significant reliance of DAI and FRAX on USDC. According to DaiStats, as of July 31, USDC supports more than half of DAI. Including USDC-related LPs, this indirect support accounts for about two-thirds. FRAX, a stablecoin using a partially collateralized/algorithmic stabilization mechanism, is over 90% backed by USDC.

According to DaiStats, as of July 31, USDC directly accounts for more than half of DAI's support, and when including USDC-related LPs, the indirect support accounts for about two-thirds. FRAX is a stablecoin using a partially collateralized/algorithmic stabilization mechanism, supported by over 90% USDC.

• Decentralized stablecoins that rely on regulated stablecoins like USDC may face increased scrutiny. Since Maker accepts centralized stablecoins as collateral deposits, the risks associated with centralized stablecoins freezing assets or potential scrutiny extend to DAI.

• Some critics argue that MakerDAO and DAI face existential risks from PSM and USDC—if regulators may require a significant increase in blacklisting or freezing USDC, or if they enforce the establishment of a practical whitelist that suppresses the free transfer of USDC, then most of Maker's DAI debt will be unsupported, leading to insolvency of the system.

In other words, MakerDAO was created to serve as a decentralized stablecoin system, relying on centrally issued assets as collateral, which undermines the established purpose and core value proposition of the system.

• Non-custodial stablecoins/DeFi protocols aim to reduce reliance on USDC to avoid the risk of USDC being blacklisted. Informal discussions have already emerged in Maker regarding potential emergency measures to force a reduction in USDC deposits. In the most extreme cases, these measures include negative interest rates on USDC deposits, implementing Maker's emergency shutdown function to enable only debt repayment, or updating Maker contracts to enable blacklisting of DAI so that the protocol can comply with sanctions and avoid being blacklisted itself.
• There will be an increased demand for decentralized stablecoins. While crypto networks and protocols may be permanent, relying on regulated stablecoins like USDC may also face regulatory scrutiny. Non-custodial stablecoins/DeFi protocols need to reduce reliance on USDC to avoid the risks associated with USDC blacklisting. Discussions have emerged in Maker's Discord regarding emergency measures to address reliance on USDC. In the most extreme cases, how to deal with negative interest rates on USDC deposits, how to implement Maker's emergency shutdown function, or update Maker contracts to enable blacklisting of DAI to comply with sanctions and avoid the risk of being blacklisted.

The demand for decentralized stablecoins will increase, although the cryptocurrency networks and protocols of decentralized stablecoins are decentralized, if the underlying assets are centralized fiat-backed stablecoins, it can still be problematic. In fact, this technology can also be used to restrict fiat-backed stablecoins from transferring to any unwhitelisted addresses.

If such restrictions are implemented, most stablecoin activities may flow to more decentralized emerging stablecoins. Since the Treasury sanctioned Tornado Cash, there has been a noticeable market demand for stablecoins fully backed by decentralized assets (such as ETH and WBTC) and their related governance tokens, including Liquity USD (LUSD trading above $1.05 due to increased demand, LQTY up over 30%) and Magic Internet Money (MIM trading at $1.01; SPELL up 40%), contrasting sharply with the poor performance of Maker (MKR -10%) and Frax (FXS -11%) governance tokens.

3. Impact on Access and Building on Ethereum

Regarding the recent sanctions against Tornado Cash and their impact on the entire ecosystem, there are several important considerations:

The Lazarus Group, an official hacking organization of a certain country, used Tornado Cash to launder over $455 million worth of cryptocurrency, which is widely believed to be one of the reasons for the sanctions. Although ordinary legitimate users also use the application to enhance their privacy in on-chain transactions. Therefore, if the U.S. Treasury's actions this week are deemed to be for national security reasons, will other unauthorized applications on Ethereum face the same type of scrutiny from the U.S. government? Especially if they involve decentralized finance applications used by hackers for lending and trading? Will these applications also be sanctioned?

Many Ethereum applications are decentralized, so how will the impact of U.S. sanctions on Tornado Cash affect access to other decentralized software on Ethereum? Users who currently rely on centralized infrastructure providers like Infura and Alchemy to access Tornado Cash can no longer use Tornado Cash.

This raises a more concerning question: if users lack the infrastructure to connect to the Ethereum blockchain and are overly reliant on Infura and Alchemy, will they face scrutiny or sanctions in the future beyond Tornado Cash?

Since 2018, the excessive reliance on Infura has been a continuous concern for Ethereum core developers. Attempts to mitigate this issue have primarily focused on making it easier for ordinary users to run Ethereum nodes.

However, these attempts are still in progress, and excessive reliance on centralized nodes remains a widespread issue on Ethereum.

Another centralized entity that may undermine Ethereum applications is GitHub.

As mentioned earlier in this report, the development of Tornado Cash as a protocol has primarily been conducted and shared through GitHub. Since the implementation of sanctions, all Tornado Cash repositories have been deleted, and contributor accounts have been banned.

Note that this is not different from 2019, when developers from Iran, Crimea, and other sanctioned countries were also banned from using the GitHub development platform. This highlights the potential issues of relying on centralized platforms for the development of decentralized applications and protocols on Ethereum.

As emphasized in previous Ethereum developer calls, there have been concerns that the development process for upgrading client software relies on GitHub, which could one day become unreliable due to reasons beyond the control of core developers.

This has sparked discussions about the need to transition Ethereum's core development steps and code to other open-source platforms—essentially alternatives to GitHub.

In summary, the sanctions against Tornado Cash highlight the issues of dependency on centralized platforms for Ethereum and various protocol technologies, underscoring the urgent need to accelerate decentralization, particularly in running node infrastructure and storing code repositories, to mitigate the impact of additional sanctions on other Ethereum dapps and Ethereum itself.

4. Long-term Implications

Money Laundering vs. Privacy

While the role of the Office of Foreign Assets Control (OFAC) is still focused on protecting and promoting U.S. national security and foreign policy through financial intelligence and law enforcement, rather than focusing on privacy, the sanctions against Tornado Cash have raised fundamental questions about financial privacy and internet privacy. Criminals and illicit entities have begun using Tornado Cash to launder money earned through illegal activities, but as discussed earlier, individuals, charities, activists, and others are also using Tornado Cash.

It is important to note that obscuring the source of funds (e.g., anonymous donations) is not illegal in itself, while "money laundering," which is the process of converting illegally obtained funds into cash, is illegal. According to U.S. codes and relevant anti-money laundering laws, transporting, transmitting, or transferring funds outside the U.S. is also considered illegal money laundering. However, the act of obscuring financial transactions or fund transfers is not illegal unless it is done to conceal illegal activities or to introduce illegally obtained funds into the legitimate financial transaction system. There are many other reasons individuals or entities may seek to maintain financial privacy, especially in a transparent on-chain environment where privacy needs are not inherently illegal.

OFAC and the U.S. Department of Justice and FinCEN

OFAC and DOJ and FinCEN

Moreover, the approval of decentralized, non-custodial applications (a type of tool) seems to be a new foundation for OFAC. Our review of the Tornado Cash contracts confirms the prevailing view in the DeFi ecosystem: Tornado Cash cannot freeze user funds, prohibit interactions with its application, or upgrade its application for this purpose. This is in stark contrast to other cryptocurrency mixing services approved by OFAC, such as Blender.io, which operates and controls in a custodial manner.

Furthermore, OFAC's current sanctioning of a decentralized application and tool like Tornado Cash is a new frontier. The DeFi ecosystem has long operated in a decentralized manner, and Tornado Cash itself lacks the ability to freeze user funds, prohibit interactions with its application, or enforce sanctions through upgrades to its application. This is very different from OFAC's earlier decision to sanction Blender.io, which is operated and controlled in a custodial manner.

It is noteworthy that OFAC has not sanctioned the software developers who founded Tornado Cash, nor has it sanctioned members of the DAO controlling the Tornado Cash treasury. Of course, the lack of sanctions against developers may be because OFAC has not determined whether they are foreign nationals, and OFAC can operate under the framework proposed by the U.S. Department of Justice. Unlike the Treasury, the U.S. Department of Justice stated in a report in October 2020 that, according to FinCEN, anonymizing service providers and some anonymous cryptocurrency issuers are considered money transmitters, whereas individuals or entities that merely provide anonymizing software are not. (According to FinCEN, anonymizing service providers and some AEC issuers are money transmitters, whereas an individual or entity that merely provides anonymizing software is not.)

Note: FinCEN is a subordinate agency of the U.S. Treasury known as the Financial Crimes Enforcement Network, whose members are officials responsible for combating financial crime within the U.S. Treasury.

According to the U.S. Department of Justice (DoJ), which cites FinCEN, the agency is also investigating financial crimes within the Treasury, and OFAC may view Tornado Cash as an "anonymizing service provider" rather than merely "anonymizing software." Of course, OFAC has not provided any detailed analysis on this, and we can only speculate; we cannot know for certain to what extent they are basing this distinction for the sanctions. However, given Tornado Cash's decentralized, non-custodial nature and its structural inability to comply with sanctions, if OFAC follows similar guidelines as the U.S. Department of Justice and FinCEN, it seems to consider Tornado Cash as an anonymizing service provider rather than anonymizing software.

Another more likely explanation is that OFAC is more focused on the application of Tornado Cash—regardless of how Tornado Cash is characterized, one undeniable fact is that Tornado Cash is frequently used by the Lazarus Group and other criminals. OFAC may have different standards from FinCEN, and OFAC sanctions do not need to be particularly related to compliance issues with the Bank Secrecy Act.

The Biggest Vulnerability: The DeFi Ecosystem

The effects of OFAC sanctions are evident, particularly as sanctions can be implemented against DeFi protocols, but the larger issue is that DeFi systems based on centralized fiat-backed stablecoins may face significant problems. For years, many have believed that Circle and Tether could arbitrarily blacklist USDC and USDT addresses, rendering those coins useless.

This week, the Tornado Cash incident has truly highlighted this old problem.

However, regarding the current situation, U.S. regulators and policymakers are likely assessing new rules for stablecoin issuers, which may easily include prohibiting the secondary transfer of issued tokens to blacklisted addresses, and continuous monitoring will be necessary.