The story of the mixing protocol Tornado Cash is a textbook case of the tension between Web3 regulation and decentralization.

In August 2022, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) suddenly announced that Tornado Cash was added to the Specially Designated Nationals list, accusing the protocol of being involved in money laundering of over $7 billion since 2019, including the $96 million stolen in the Harmony Bridge hack. Subsequently, the website was shut down, and the GitHub account and developer identities were also removed. This move shocked the entire industry.

Law enforcement quickly followed up. In August, Dutch authorities arrested developer Alexey Pertsev, accusing him of concealing criminal funds through the protocol. By August 2023, the U.S. Department of Justice had also filed charges against Roman Storm and Roman Semenov, including conspiracy to commit money laundering, violating sanctions, and operating unlicensed money transmission businesses, claiming they helped transfer $1 billion, involving funds from North Korean hackers. Storm was arrested, while Semenov remains at large. In 2024, Pertsev was sentenced to 64 months in prison in the Netherlands.

The turning point came in November 2024. The Fifth Circuit Court of Appeals ruled that OFAC's sanctions against the protocol itself exceeded its authority—because immutable smart contracts cannot be considered "property" subject to sanctions. This ruling overturned the sanctions against the protocol, although enforcement against individuals continued. In March 2025, OFAC officially lifted the sanctions on the Tornado Cash protocol but continued to pursue individual developers.

In the same month, Roman Storm appeared for trial in the Southern District of New York. The jury's vote in August was split—charges of conspiracy to commit money laundering and sanctions violations resulted in a hung jury, invalidating some charges, but he was found guilty of operating an unlicensed money transmission business, facing up to 5 years in prison.

Interestingly, despite the sanctions and legal challenges, Tornado Cash has continued to operate due to its decentralized architecture. By 2026, the protocol processed $2.5 billion in transactions for the year. The Eleventh Circuit Court has pending similar cases that could further clarify regulatory boundaries. The long-lasting battle is far from over, but it has already begun to redefine what "unstoppable code" means for the entire industry.