Tornado Cash developers sentenced, is "Code is speech" dead?

Author: Nianqing, ChainCatcher

Yesterday, Alexey Pertsev, a 31-year-old Russian citizen and developer of Tornado Cash, was sentenced to 5 years and 4 months in prison in the Netherlands for laundering $2.2 billion on a cryptocurrency mixer platform. Pertsev had previously been detained for eight months. This time will be deducted from his sentence, leaving him with four and a half years remaining. Pertsev's lawyer will have 14 days to appeal the judge's decision.

The industry widely believes that this case is not only a watershed moment for DeFi regulation but will also change the course of crypto privacy, creating a "chilling effect" on the global open-source community. The conviction of open-source software developers marks a significant shift, indicating that Web3 smart contract developers will be subject to traditional legal frameworks.

The judge and prosecutor in Alexey Pertsev's case stated in their ruling that "the essence and function of Tornado Cash is a tool for criminals," and "Tornado Cash is not just a smart contract , it operates more like a company."

In August of last year, Tornado Cash co-founders Roman Storm and Roman Semenov were charged with conspiracy to commit money laundering and one count of conspiracy to violate the International Emergency Economic Powers Act, both of which carry a maximum sentence of 20 years in prison. Additionally, the two were charged with conspiracy to operate an unlicensed money transfer business, which carries a maximum sentence of 5 years in prison.

Currently, Roman Storm has been arrested in Washington State, USA, while Roman Semenov remains at large. Furthermore, Roman Storm's trial is scheduled for September 23. The ruling against Alexey Pertsev will directly impact the outcome of Storm's trial.

It is worth mentioning that after Pertsev was sentenced yesterday, the crypto community continued to transfer funds to the "Free Alexey & Roman" donation fund on Juicebox, with comments such as "privacy is not a crime," "code is speech," "defend freedom," and "XX stands with privacy and open-source public goods" to support the developers of Tornado Cash and the "spirit of crypto."

Tornado Cash Case Timeline

Tornado Cash was launched in August 2019, with three founders: Roman Storm, Roman Semenov, and Alexey Pertsev. The main founding team consisted of zkSNARK researchers, and Alexey Pertsev was also a core member of the security auditing company Peppersec.

Below is the complete timeline of events related to the Tornado Cash case (compiled from DL News, with additions and modifications by ChainCatcher):

2019

August 6: Tornado Cash goes live, allowing users to "send Ethereum cryptocurrency 100% anonymously."

September 13: The U.S. Office of Foreign Assets Control (OFAC) imposes sanctions on North Korean cyber organizations, including the Lazarus Group.

2020

May 10: Tornado Cash completes its "trusted setup ceremony," burning the management rights of all deposit pools and updating its smart contracts. The Tornado Cash protocol becomes permanently autonomous code not controlled by any party, which Tornado Cash calls "the largest trusted setup ceremony in the world," with 1,114 participants.

June 4: Tornado Cash developers deploy an optional compliance tool for users to disclose their transaction history when needed.

September 25: Hackers steal $275 million worth of cryptocurrency from KuCoin exchange. This is one of the largest hacking incidents connected to Tornado Cash.

2022

March 23: The Axie Infinity Ronin sidechain bridge suffers a loss of approximately $625 million due to a hacking attack. This is one of the largest cryptocurrency hacks to date, with criminals laundering money through Tornado Cash.

May 6: OFAC sanctions the first virtual currency mixer, Blender, used by North Korean cybercriminal groups.

June 24: The Lazarus Group attacks the Harmony Horizon bridge, with nearly $100 million worth of stolen cryptocurrency transferred through Tornado Cash. According to Dutch prosecutors, this is another significant hacking incident that utilized Tornado Cash for money laundering.

August 8: OFAC sanctions Tornado Cash for being used to launder $7 billion.

August 9: The Tornado Cash website is shut down, the project code repository is removed from GitHub, and co-founder Roman Semenov's GitHub account is suspended.

August 10: Alexey Pertsev is arrested in the Netherlands and imprisoned without public charges.

October 12: The nonprofit organization Coin Center, which focuses on cryptocurrency policy issues, sues OFAC over the Tornado Cash sanctions.

November 22: Dutch prosecutors disclose the charges for the first time during a court hearing.

2023

April 20: Alexey Pertsev is released pending trial.

August 23: The U.S. Department of Justice charges Tornado Cash developer Roman Storm and sanctions developer Roman Semenov.

August 25: Tornado Cash co-founder Roman Storm is released on bail.

December 7: Binance delists the native token TORN of Tornado Cash.

2024

March 25-26: Alexey Pertsev undergoes a two-day trial in the city of Heerenveen, Netherlands.

April 5: The American Trade Association submits a brief to the court in defense of Roman Storm, addressing each of the charges against him.

May 14: Alexey Pertsev is sentenced to 64 months in prison for money laundering.

September 23: Roman Storm will stand trial in the United States.

Controversies and Focus of the Trial: The Identity Boundaries of Smart Contract Developers

The focus of the Tornado Cash case trial is whether current anti-money laundering laws apply to blockchain/crypto financial platforms.

During the trial, Pertsev's defense attorney, Keith Cheng, stated that no one, including Tornado Cash developers, can prevent others from using open-source smart contract code. A contributor to a smart contract is a decentralized organization, not a single responsible entity like a traditional company.

After Roman Storm and Roman Semenov were charged by the U.S. last August, Coin Center (a nonprofit organization focused on cryptocurrency policy issues, engaged in research and education policy development, and advocating for reasonable regulatory approaches to crypto technology) published a statement of support, arguing that the latest charges against Tornado Cash contradict the Financial Crimes Enforcement Network (FinCEN) documents.

Their core argument is that Tornado Cash developers merely provided "pure software development or communication services" and did not engage in "business representing the public in transferring funds." Judicial authorities should not confuse "service providers" with "fund transferers." The only control Tornado Cash has over the smart contract is changing the cryptographic logic related to privacy functions, and it does not have any actual ability to view or move user funds.

In early April of this year, Coin Center submitted a friend of the court brief in the ongoing criminal case against Roman Storm in the Southern District of New York, expressing hope that the court would remove the prosecution's vague and biased descriptions of Tornado Cash. Open-source software developers cannot control the actions of others who happen to use their tools, and the release of Tornado Cash code is explicitly protected by the U.S. Constitution. Additionally, Coin Center argued that the prosecution's statements and verdict in this case "affect the interests of those engaged solely in open-source software development, code release, and speech," calling for the protection of the right to freely develop and release software in the United States.

Roman Storm's lawyer also mentioned in documents submitted to the U.S. District Court for the Southern District of New York at the end of March that Tornado Cash, as a non-custodial smart contract, allows users full control over their assets without relying on any service provider or third-party custodians. Programming falls under the category of free speech and is therefore protected by the First Amendment of the U.S. Constitution.

However, during the trial on the 14th, the court rejected this viewpoint, stating that no technological innovation can supersede the legal obligation to prevent platforms from helping criminals and sanctioned entities conceal the sources of stolen assets. Prosecutor Martine Boerlage ultimately characterized Tornado Cash as "not just a smart contract; it operates like a company."

The U.S. Department of Justice reiterated that its indictment is unrelated to whether the computer code of Tornado Cash constitutes free speech or is protected by the First Amendment. The defendant is not being prosecuted for releasing computer code but for using it to facilitate a profitable illegal business.

The Department of Justice further explained that banks use computer code to process financial transactions. If that code performs the functions of a legally defined money transmitter, then the code is not merely free speech but must be ensured to operate in a manner that does not violate money transmission laws. Tornado Cash is part code, part speech, and part business; overall, it is a human creation. Storm did not merely release code; he operated a business and made operational decisions over the years. The Tornado Cash protocol is not equivalent to the Tornado Cash business. Just because Tornado Cash has some open-source code does not mean that Roman Storm, as the owner of the Tornado Cash business, is involved in all actions related to that code being constitutionally protected.

Petitions, Protests, and Donations

Cryptocurrency lawyer David Lesperance has stated that, legally speaking, Alexey Pertsev's case is more significant for the future of DeFi than simple fraud cases against SBF and Do Kwon or Zhao Changpeng's failure to establish the required anti-money laundering protocols. Because the Tornado Cash case is highly representative, the three founders have received various forms of support.

The crypto community, especially the developer community, has strongly protested Pertsev's arrest. In addition to various petitions and expressions of support on social media, posters supporting Alexey Pertsev were distributed outside the Dutch court.

In August 2022, some anonymous crypto users even protested through "poisoning" attacks, sending small amounts of ETH to the addresses of well-known crypto figures via Tornado Cash to express their dissatisfaction with this round of U.S. sanctions. Notable KOLs such as Shen Yu, Sun Yuchen, Coinbase CEO Brian Armstrong, and artist Beeple were "poisoned."

Additionally, on January 22 of this year, members of the crypto community launched a donation campaign called "Free Alexey & Roman" on the crowdfunding platform Juicebox, serving as a legal defense fund to help Tornado Cash co-founder Roman Storm and developer Alexey Pertsev avoid legal penalties. As of the time of writing, the fund has received 834 donations, totaling 548.49 ETH, approximately $1.6 million. Ethereum co-founder Vitalik and Kraken co-founder Jesse Powell have also contributed to the fund.

It is worth noting that after Pertsev was sentenced yesterday, the number of donations suddenly increased, with comments such as "privacy is not a crime," "code is speech," "defend freedom," and "XX stands with privacy and open-source public goods" to support the developers of Tornado Cash and the "spirit of crypto."

The Other Side of the Coin

Despite Pertsev himself emphasizing that he is just a programmer with no criminal intent, he expressed "disappointment" that criminals used Tornado Cash to conceal illegal gains, but he felt powerless to stop it.

During the questioning of Pertsev about whether he took criminal behavior seriously enough, the judge referenced chat records between Pertsev and co-developers Roman Storm and Roman Semenov, where Pertsev responded with "haha" to news of the $625 million hack of the Axie Infinity Ronin Bridge. However, Pertsev stated that this did not mean he found it amusing, but rather it was a habitual expression of surprise.

Additionally, an objective fact is that Tornado Cash remains the largest crypto mixer since being sanctioned. Hackers and protocol attackers continue to use this tool for money laundering.

On one hand, the ruling against Tornado Cash developers will threaten the future of technological development and privacy. On the other hand, the reality is that, from a legal perspective, technology cannot be neutral; it is inevitably built upon relationships between people.