Download a printer-friendly .pdf of this alert.
Traditionally, U.S. courts have been deferential to the executive branch of the U.S. government with respect to sanctions and other national security matters. However, a recent Court of Appeals decision highlights that the Treasury Department’s ability to designate parties subject to sanctions is not limitless. This development may embolden further challenges to U.S. sanctions especially in instances where the government’s statutory authority may be called into question. Whether such challenges will be successful is another matter. Also, the Treasury Department has indicated that it remains open to exploring other enforcement tools in its utility belt to address national security risk.
Introduction. The U.S. Department of the Treasury announced on March 21, 2025 that it had withdrawn sanctions imposed on Tornado Cash, an open source, non-custodial cryptocurrency mixer that obscures information on the origin and destination of digital asset transactions. This move occurred following a Fifth Circuit Court of Appeals ruling in November 2024 that held that the Office of Foreign Assets Control (OFAC) of the Treasury Department had exceeded its statutory authority under the International Emergency Economic Powers Act (IEEPA).
Statutory Authority. IEEPA is one of the key laws that underpin the U.S. sanctions regime. This statute authorizes the President to impose sanctions on foreign persons that pose a threat to U.S. national security. As a result of such sanctions, U.S. persons are (i) obligated to freeze the assets, including property and services, in their possession in which a sanctioned person has an interest and (ii) prohibited from engaging in transactions with those foreign persons.
Sanctions Designation. OFAC had previously designated Tornado Cash on its Specially Designated Nationals and Blocked Person (SDN) List in August 2022. Initially, OFAC created entries in its SDN List for website tornado.cash, 37 Tornado Cash smart contracts, and an address that was used to accept donations. OFAC then later replaced those designations with new SDN listings that included 53 Ethereum addresses associated with Tornado Cash software. As a result of these designations, those “listed parties” became the subject of comprehensive sanctions that blocked or froze their assets and prohibited U.S. persons from using Tornado Cash’s crypto tumbler services among other matters.
North Korea Factor. OFAC sanctioned Tornado Cash because of allegations that North Korean hackers and other cybercriminals used Tornado Cash’s services to launder over $7 billion in stolen virtual currency. According to OFAC, Tornado Cash’s open-source software, which consists of self-executing smart contracts on the Ethereum blockchain, was “property” and “services” in which a foreign person or entity had an “interest” and thus could be blocked under IEEPA.
Crypto Mixing. Tornado Cash’s crypto-mixing smart contracts offer privacy by anonymizing digital transactions and immutability because its software code is unownable, uncontrollable, and unchangeable by anyone. A group of Tornado Cash users, supported by Coinbase Global Inc., challenged OFAC’s designations in a Texas federal court, arguing that immutable smart contracts were not property, services, or contracts, and that Tornado Cash was not a foreign person or entity within the meaning of IEEPA. The district court upheld OFAC’s designation in 2023, but the Fifth Circuit reversed the decision in 2024, finding that immutable smart contracts were not capable of being owned or controlled by anyone and therefore did not fall within the scope of IEEPA.
Property Under IEEPA. According to the Fifth Circuit the plain meaning of “property” under IEEPA requires that it be capable of being owned, and that the immutable smart contracts did not meet that criterion. The court noted that smart contracts were created by a group of developers who voluntarily relinquished their control over the code by making it immutable and unchangeable. The court also rejected OFAC’s arguments that smart contracts were analogous to patents or copyrights, which are intangible property, or that Tornado Cash had an interest in the smart contracts because it profited from them. The court found no evidence that Tornado Cash received any fees from the immutable smart contracts or that it had any rights or benefits from them.
Smart Contracts. The court also ruled that the immutable smart contracts were not contracts or services under OFAC’s regulatory definitions. The court explained that contracts require an agreement between two or more parties, and that the immutable smart contracts had only one party in play: the software code. The court also distinguished immutable smart contracts from services, which involve human effort or skill, and said that the smart contracts were more like tools that are used in performing a service. The court concluded that OFAC had overstepped its congressionally defined authority by sanctioning the immutable smart contracts and remanded the case to the district court with instructions to grant the plaintiffs’ motion for partial summary judgment based on the Administrative Procedure Act.
A Novel Issue. Following the Fifth Circuit's ruling, the Treasury Department filed a notice of mootness in the district court, stating that it had removed Tornado Cash from the SDN list and that the case was no longer a live controversy. The Treasury Department also issued a press release, citing its review of the novel legal and policy issues raised by the use of sanctions against evolving technology and legal environments. The Treasury Department said it remained deeply concerned about the state-sponsored hacking and money laundering campaign by North Korea and other illicit actors, and that it would continue to monitor and disrupt any transactions that may benefit them. The Treasury Department also emphasized the importance of securing the digital asset industry from abuse and fostering U.S. leadership and innovation in the field.
Intersection of Crypto and Sanctions. The Treasury Department’s reversal of sanctions on Tornado Cash marks a significant development in the regulation of cryptocurrency and blockchain technology, as well as the scope of OFAC’s sanctioning authority. The Fifth Circuit’s ruling limits OFAC’s ability to target decentralized and open-source software that is not owned or controlled by any person or entity, and that may have legitimate and lawful uses for privacy and security. The ruling also highlights the challenges that OFAC faces in applying its existing definitions and regulations to new and emerging technologies; those items may not fit neatly into traditional categories of property, services, or contracts covered by IEEPA, which was enacted in the 1970’s during the Carter Administration. Technological developments since that time have evolved beyond the reach of IEEPA and raise a question as to whether Congress will amend that law in the future to address these concerns.
Risk Remains. The Fifth Circuit’s ruling and the Treasury Department’s removal of Tornado Cash from the SDN List does not mean that rogue foreign actors that use mixing services to launder cryptocurrency can completely avoid U.S. sanctions under IEEPA or otherwise. It also does not mean that cryptocurrency mixing services are free from some type of regulatory oversight or compliance obligations. OFAC has indicated that it will continue to scrutinize the use of mixers and other anonymity-enhancing technologies for illicit purposes and that it expects the virtual currency industry to implement appropriate anti-money laundering and anti-terrorist financing measures to prevent sanctioned persons and other illicit actors from exploiting virtual currency.
Daanish Hamid is a partner with PLG’s Washington, D.C. office. He is a member of the firm’s International Trade and White Collar Practice Groups. He focuses on investigations, regulatory compliance, and commercial transactions. He advises clients on the Foreign Corrupt Practices Act (FCPA), OFAC/economic sanctions, anti-money laundering restrictions, and national security filings with the Committee on Foreign Investment in the United States (CFIUS). He can be reached at dhamid@potomaclaw.com or 202-827-5614.
ATTORNEY ADVERTISING: This update is provided for informational purposes only and does not constitute legal advice. You should seek professional legal counsel before taking any action.
