News

U.S. officials took the rare step of de-listing, then re-listing, a cryptocurrency “mixer” Tuesday to more narrowly target the service’s use by North Korea, potentially signaling their intent to take action against other anonymity-enhancing services that fail to prevent financial crime.

The U.S. Treasury Department’s Office of Foreign Assets Control rescinded and replaced the controversial Aug. 8 designation of Tornado Cash, made under authority of an executive order that covers general threats to national security, with a new designation that cites both the original order and E.O. 13722, which targets North Korea specifically.

“OFAC did not take all of the complications into account when it did the first designation,” Peter Piatetsky, a former policy adviser for the agency, told ACAMS moneylaundering.com. Replacing instead of amending the designation may put the action on firmer legal ground, he said, forcing lawsuits against the original action to be revised.

Tuesday’s re-designation and the initial designation reference the North Korean-sponsored Lazarus Group’s use of Tornado Cash to launder hundreds of millions of dollars of Ethereum stolen from an online gaming platform in March.

Both also specifically target the mixer’s website and dozens of specific addresses on the cryptocurrency’s blockchain. Parties that transact through those addresses still expose themselves to fines and secondary sanctions from OFAC, while foreign financial institutions risk losing access to U.S. correspondent and payable-through accounts.

Basing the re-designation on an additional executive order constitutes the primary difference between the two measures and bolsters OFAC’s case against the mixer, said Douglas Jacobson, a trade and sanctions attorney based in Washington, D.C.

“Now they have double legal authorities rather than just one, which may have been more wobbly,” he said.

Related guidance issued by OFAC on Tuesday establishes that the agency can impose sanctions on a decentralized financial service—software, basically—for facilitating illicit finance, without necessarily doing the same to individuals who developed, operated and used the product.

Operating as a mixer on Ethereum’s blockchain, Tornado Cash consists of open-source software that relies on “zero-knowledge cryptography” to obscure the origin and destination of individual units of the cryptocurrency.

Proponents argue that the service provides users a degree of privacy that is not only reasonable, but also legally protected with other forms of payment.

On Oct. 12, Coin Center, a nonprofit that supports the cryptocurrency industry, argued in a civil complaint against OFAC’s initial designation of Tornado Cash that the agency overstepped in criminalizing “a tool that helps Americans maintain their privacy while using cryptocurrency and related assets.”

“Nothing they’ve announced changes our strategy in this lawsuit,” a member of Coin Center’s board of directors tweeted Tuesday.

Six individuals backed by Coinbase, the largest U.S. cryptocurrency trading platform, challenged OFAC on similar grounds in September, with one plaintiff claiming that he used Tornado Cash to obscure his donations to Ukraine out of concern that the transactions would otherwise potentially make him a target for pro-Kremlin hackers.

By narrowing the basis of the designation on Tuesday, OFAC may have strengthened its position in the court of public opinion.

“It’s a challenge, daring industry to consider if it really wants to dig in its heels and defend an entity that allowed North Korea to move half a billion dollars of illicit funds,” Yaya Fanusie, a former CIA analyst who now heads Washington D.C.-based consultancy Cryptocurrency AML Strategies, wrote in published analysis Tuesday.

Tuesday’s guidance notes that parties who used Tornado Cash before the Aug. 8 designation can apply for a special license to move their Ethereum, as may individuals who unwittingly received nominal amounts of ether coins that unknown parties routed through the mixer in a malevolent transaction known as “dusting.”

Copying Tornado Cash’s open-source code and visiting the service’s website are not prohibited, OFAC clarified in the guidance.

The Aug. 8 designation rendered Tornado Cash “radioactive” and transformed the service into a cautionary tale for other mixers, said Piatetsky, now chief executive of Castellum.AI in New York.

“OFAC has made it unusable, and that’s their goal.”

Contact Fred Williams at fwilliams@acams.org