On Wednesday, August 6, a Southern District of New York jury found Roman Storm, the founder of Tornado Cash, guilty of conspiracy to operate an unlicensed money-transmitting business in violation of Section 371 of Title 18 of the United States Code. Notably, the jury deadlocked, however, on the money laundering conspiracy and sanctions evasion conspiracy counts.
Background
Tornado Cash was launched in 2019 as a cryptocurrency "mixer," allowing users to deposit cryptocurrency into a common pool with other users and then withdraw assets later through smart contracts in a decentralized, open-source protocol. Once cryptocurrencies are withdrawn from the common pool, it is virtually impossible for anyone—including law enforcement—to track their origins. Tornado Cash collected a transaction fee each time a user deposited amounts into or withdrew them from the pool.
Storm was indicted in August 2023 for money laundering, conspiracy to operate an unlicensed money transmitter, and conspiracy to violate U.S. sanctions. Although Tornado Cash touted legitimate financial privacy, the government alleged that Tornado Cash helped criminal entities launder more than $1 billion, including hundreds of millions for a sanctioned North Korean group called the Lazarus Group. Storm pleaded not guilty to all charges.
Prosecutors argued that Storm has been told on numerous occasions between 2020 and 2022 that Tornado Cash was helping criminals hide dirty money and that Tornado Cash's emphasis on privacy was a "cover story." "The real money wasn't in protecting privacy for regular folks, it was in providing privacy for big-time crypto criminals," argued the prosecution. An FBI cryptocurrency tracing expert testified that about half of Tornado Cash's volume from 2020 to 2022 came from the criminal proceeds of 16 major hacks and scams. For example, the U.S. Department of Treasury sanctioned the Lazarus Group in 2019 and then strengthened such sanctions in April 2022 after the infamous March 2022 Ronin hack, after which Storm texted colleagues to say, "Guys, we are f***ing done for." OFAC had identified and designated the crypto wallet where the bulk of the Ronin funds were being held as "blocked property." Although this wallet was blocked on Tornado Cash and was not used to transact on Tornado Cash directly, prosecutors alleged that Storm and his accomplices knew it was easy to circumvent these controls by transferring funds to other wallets. Tornado Cash had itself been sanctioned under the Biden administration for its alleged support of North Korea, although the Treasury lifted these sanctions in March 2025.
The prosecution argued that Storm actively marketed Tornado Cash's laundering properties to criminals, showing images of promotional t-shirts with laundry machine icons on them. The prosecutor's case focused on presenting witnesses, mainly from the Federal Bureau of Investigation and the Internal Revenue Service, and hackers, who testified that Storm had the ability to modify Tornado Cash's code to prevent illicit use by criminals but chose not to.
Storm argued that he had not intended to help conceal illicit funds, even though Tornado Cash's privacy tools may have been useful to criminals. The company's software was designed to protect financial privacy. Once the software went live, it ran automatically beyond Storm's control, and developers could not alter or remove transactions.
Recent Headwinds Facing Cryptocurrency Prosecutions
The case survived multiple recent indications of the current administration's disapproval of cryptocurrency crackdowns. An April memo by Deputy Attorney General Todd Blanche on crypto enforcement called on federal prosecutors to avoid "regulation by prosecution" and focus on actors victimizing crypto investors. After the memo's release, prosecutors narrowed a conspiracy count against Storm, alleging an unlawful scheme to operate an unlicensed money-transmitting business. They then focused on the theory that Storm allegedly facilitated the transmission of "funds that are known to the defendant to have been derived from a criminal offense." The President's Working Group on Digital Asset Markets released a report on July 30, 2025 that encouraged securities and derivatives regulators "[a]bsent congressional action . . . to use their existing authorities to provide fulsome regulatory clarity that best keeps blockchain-based innovation within the United States."
Just before the verdict, SEC Commissioner Hester Peirce, the head of the SEC task force on crypto regulatory reform, stated that developers of open-source privacy software should not be responsible for the actions of the software's users. In an August 4 speech to the Science of Blockchain Conference, Peirce said, "technologies that have legitimate uses are better left in the permissionless, available-for-all-to-use category, even though doing so enables people to use them for bad purposes, because taking any other course would impinge fundamental liberties." The jury deliberated for four days. During deliberations, the jury submitted a note asking whether sanctions covered intermediary wallets used to transact on Tornado Cash; the jury was essentially told no.
Implications of the Verdict
The mixed verdict belies the difficulties in attaching criminal liability to cryptocurrency executives and companies for the criminal conduct of their users. This is likely because proving intent against cryptocurrency companies and executives, especially in connection with money laundering and sanctions evasion crimes, requires the prosecution to prove beyond a reasonable doubt that the defendant knowingly and intentionally engaged in money laundering or sanctions evasion conduct. On the other hand, proving mens rea on the money transmitting charge requires only that the defendant knowingly and intentionally failed to obtain a license as a money-transmitting business.
Nonetheless, the government's victory on the money-transmitting business charge sets an important precedent that Tornado Cash and similar decentralized finance companies cannot operate without the required licensing and are subject to the Bank Secrecy Act. Consequently, decentralized finance businesses should assess their user base, ensure they have the necessary licenses in the jurisdictions in which they operate, and institute systems necessary to comply with applicable anti-money laundering and sanctions regimes. The Blockchain Association noted that this verdict set a "dangerous precedent for open-source software developers" and urged Storm to appeal. Storm's fundraising campaign through the Free Roman Storm website had already raised about $3.2 million as of July 26, 2025, including donations from Ethereum co-founder Vitalik Buterin and the Ethereum Foundation.