News

A U.S. indictment against two founders of Tornado Cash, a “mixer” accused of handling hundreds of millions of dollars of illicit cryptocurrency, appears to call for a major expansion of anti-money laundering rules in the virtual assets industry, analysts told ACAMS moneylaundering.com.

Federal prosecutors in Manhattan unsealed the 37-page indictment Tuesday, Aug. 23, charging the two suspects—Roman Semenov, a Russian national living in Dubai, and Roman Storm, a resident of Auburn, Washington—with conspiring to launder money, operate an unlicensed money transmitting business and violate sanctions against North Korea.

The indictment came as no surprise, given that the mixer Semenov and Storm launched four years ago drew U.S. sanctions in August 2022, and again in November 2022 on national security grounds, after allegedly laundering $7 billion worth of Ethereum, including $455 million pilfered by the North Korea-linked Lazarus Group of hackers.

But prosecutors not only outlined their case against the two founders in the indictment. They asserted that individual “relayers” for Tornado Cash “engaged in the business of transferring funds” without a license.

“I think if the government is correct in its assertions here, it has implications for significantly more than crypto,” said Austin Campbell, managing partner of Zero Knowledge Consulting in New York.

If Tornado Cash’s network of relayers—individuals who, for an optional fee, made Ethereum routed through the mixer more untraceable for users—qualify as unlicensed money transmitters, then so might other parties that provide ancillary services to mainstream financial platforms.

Or so the logic goes.

“Does this mean anybody operating a blockchain … is now a money transmitter?” said Campbell, who also serves as an adjunct assistant professor at Columbia Business School. “My initial gut feeling is the government asked for 500 percent of what they think they’re going to get.”

‘Speechless’

Treasury’s Financial Crimes Enforcement Network defined “persons administering, exchanging or using virtual currencies” as money services businesses in 2013, requiring them to register with the bureau, obtain money-transmission licenses from state authorities and build anti-money laundering programs.

FinCEN classified mixers, tumblers and “suppliers of [anonymizing] software” as MSBs six years later, but stopped short of categorizing individuals who use their computing power to help anonymize transactions as such.

“Pleased to share that my client … is already out on bail,” Storm’s defense attorney Brian Klein, wrote on X, formerly Twitter, on Thursday, Aug. 24. “Although I remain very disappointed that the prosecutors charged him because he helped develop software—their novel legal theory has dangerous implications for all software developers.”

But transcripts of encrypted messages between Storm and Semenov suggest they did more than develop software: They also deliberately flouted know-your-customer and other anti-money laundering rules despite knowing that money launderers used their service.

According to the indictment, after Semenov asked Storm in a message dated Nov. 16, 2021, ” ‘would you like to install KYC on tornado?’, ” the latter responded, ” ‘I’m fucking speechless after such suggestions.’ ”

Emails and other messages referenced in the indictment further suggest the two suspects also refused appeals from cryptocurrency exchanges and other victims to seize and return hundreds of millions of dollars of Ethereum that hackers stole and deposited with Tornado Cash.

Evade and escape

In May 2020, Storm and Semenov announced they had eliminated their private keys for accessing the software used to run Tornado Cash, leaving the digital “smart contracts” that underpinned the platforms operations to function independently of their control.

They then established a “decentralized autonomous organization” comprised of themselves, relayers and investors to oversee the platform’s operations and make governance-related decisions.

But the two suspects, and a third individual identified elsewhere as Alexey Pertsev, a Russian national now awaiting trial in the Netherlands, retained 30 percent of the “TORN” tokens that conveyed voting rights in the DAO as well as a share of the user fees generated by the mixer.

“Tornado Cash (was) a business from which they sought to make, and did make, substantial profits,” prosecutors alleged in the indictment.

On Aug. 8, 2022, hours after U.S. officials blacklisted the mixer, Storm allegedly began transferring $7.8 million of U.S. dollar-pegged stablecoins from a wallet he controlled on Binance to three other wallets that he and his two co-founders held on the exchange.

Storm allegedly came into possession of the stablecoins by selling TORN tokens.

At first glance, the indictment against Tornado Cash appears to cast a broader legal net over the cryptocurrency sector, but, as with earlier cases against Helix, Bitcoin Fog and Blender.io, the Justice Department appears to have targeted financial crime, not financial privacy, said Ari Redbord, a former federal prosecutor for the District of Columbia.

“This is not necessarily an effort to go after mixers, but rather a coordinated effort to go after mixing services that facilitate illicit activity,” said Redbord, currently head of government affairs for TRM Labs in Washington, D.C.

Meanwhile, balancing a reasonable expectation of financial privacy with good faith efforts to combat illicit finance remains a work in progress.

“It seems pretty clear that mixers that operate like Tornado Cash are not long-term solutions to privacy on the blockchain,” said Yaya Fanusie, a former CIA analyst who now directs policy at the Crypto Council for Innovation in Washington, D.C. “Illicit actors are going to use anonymizing services.”

Recent advances in “zero-knowledge proof” technology, which, for example, could help confirm an individual’s non-blacklisted status without revealing his or her identity, have raised hopes that privacy rights and anti-money laundering rules can coexist within the cryptocurrency sphere.

Prosecutors in Manhattan unsealed their charges against Storm and Semenov six days after a federal judge in Austin, Texas, dismissed a challenge backed by Coinbase to revoke the Treasury Department’s sanctions against Tornado Cash.

The service, plaintiffs argued, is a “decentralized, open-source software project,” not a property subject to blacklisting.

Coinbase will further appeal against the sanctions, Paul Grewal, the company’s chief legal officer, announced on X on Thursday, Aug. 17.

Contact Fred Williams at fwilliams@acams.org