Author: ZHIXIONG PAN
Can immutable smart contracts become targets of sanctions? This is the core question faced by the United States Court of Appeals for the Fifth Circuit in the Tornado Cash case.
Yesterday, the court ruled that the U.S. Treasury's Office of Foreign Assets Control (OFAC) overstepped its authority in sanctioning Tornado Cash. This ruling is not only a victory for the plaintiffs but also sparks a discussion about technological neutrality and legal boundaries.
The rise of blockchain technology has brought about a revolution in privacy and decentralization but also comes with regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversies, the U.S. Treasury imposed severe sanctions against it.
However, the court's ruling pointed out that the immutable smart contracts of Tornado Cash do not meet the traditional legal definition of 'property.' These smart contracts are decentralized, self-executing, and uncontrollable code that cannot be owned or used exclusively. Therefore, the act of listing them on the Specially Designated Nationals and Blocked Persons List (SDN List) is considered to exceed the legal authorization.
The impact of this ruling goes far beyond the case itself. It not only involves the legality of blockchain privacy tools but also concerns significant issues of technological neutrality and legal adaptability. This court ruling points the way for future legislation and regulation—distinguishing the attributes of the technology itself from the actions of malicious users, avoiding the excessive expansion of administrative power due to the neutrality of technology.
In fact, the ruling document of this case contains many details and content worthy of attention.
Who are the plaintiffs?
These plaintiffs claim to be users of Tornado Cash, but they are also users of Ethereum and the cryptocurrency ecosystem. They come from security audit teams, Coinbase, client developers, hardware wallets, etc., and are supported by Coinbase's legal team. They are:
Joseph Van Loon (Auditware, former Apple)
Tyler Almeida (Coinbase)
Alexander Fisher (angel investor)
Preston Van Loon (Ethereum core developer and Offchain Labs / Arbitrum)
Kevin Vitale (GridPlus)
Nate Welch (former zkSync, Coinbase)
Who is the defendant?
The U.S. Department of the Treasury and U.S. Treasury Secretary Janet Yellen
The Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki
Why did the plaintiffs file a lawsuit?
The plaintiffs filed a lawsuit against the defendant, questioning its authority to classify the immutable smart contracts of Tornado Cash as 'property' and impose sanctions beyond its legal authorization, violating the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA).
The plaintiffs argue that these contracts are autonomously operating decentralized code that cannot be controlled or owned and therefore should not be targets of sanctions.
Which court made the ruling?
The United States Court of Appeals for the Fifth Circuit is equivalent to an intermediate court, that is, a federal appellate court. Above it is the Supreme Court of the United States, which is at the top of the federal judicial system and is the final decision-making body. Only a few cases can be appealed to or enter the Supreme Court through special permission (such as a writ of certiorari).
What was the court's ruling?
The court ruled that the defendant (OFAC) violated the International Emergency Economic Powers Act (IEEPA) in sanctioning Tornado Cash, because the immutable smart contracts do not meet the definition of 'property.'
The court believed that these smart contracts are decentralized, self-executing, and uncontrollable code, and should not be listed as targets of sanctions. Meanwhile, the court pointed out that although the technology could be misused, administrative agencies do not have the authority to exceed the law to expand the scope of sanctions. Ultimately, the court overturned the sanction decision and called on legislative bodies to address the legal gaps regarding emerging technologies.
Why do the plaintiffs want to help Tornado Cash initiate a lawsuit?
Although these six plaintiffs are not developers of Tornado Cash, they all stated that they are users of Tornado Cash, and they expressed the need for Tornado Cash to enhance privacy for legal purposes.
For example, Tyler Almeida anonymously donated to Ukraine through Tornado Cash, fearing retribution from Russian hacker organizations if the transaction were tracked. Kevin Vitale switched to using Tornado Cash to protect his privacy after discovering that someone had linked his cryptocurrency activities to his actual address. Several others expressed similar sentiments.
Immutable is the core keyword, how to define it?
In this case, there has been much discussion, definition, and summary around the term immutable, acknowledging the uniqueness of decentralized systems and smart contracts as a new technology. The court also recognized that this uniqueness of decentralized technology poses unique challenges to the existing legal system.
The court's final ruling is:
Because these immutable smart contracts are not 'property' under the word’s common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
Because these immutable smart contracts do not constitute 'property' in either the ordinary sense or under OFAC's definitions, we hold that OFAC exceeded its statutory authority.
It also added that,
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can 'exclude' anyone from using the Tornado Cash pool smart contracts.
The immutable smart contracts involved in this case are not property because they cannot be owned.
Therefore, no one can 'exclude' others from using Tornado Cash smart contracts.
And the court's definition of immutable smart contracts is:
A mutable smart contract is one which is managed by some party or group and may be changed. An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it. A mutable smart contract is managed by certain individuals or groups and can be changed. An immutable smart contract cannot be altered or removed from the blockchain. It is important to note that a mutable smart contract can be changed to an immutable state. But this is an irreversible process; once a smart contract becomes immutable, no one can reclaim control over it.
But what if hackers are really using Tornado Cash for money laundering? There is currently no solution.
The North Korean hacker group Lazarus Group stole nearly $1 billion worth of cryptocurrency through hacking and needed to use mixers to hide the source of funds and complete money laundering. Thus, OFAC accused Tornado Cash's mixing function of being used for money laundering, claiming that the Lazarus Group laundered over 65% through mixers in 2021, with Tornado Cash being one of the main tools.
Therefore, Tornado Cash was indirectly linked to the money laundering activities of the Lazarus Group and was thus included in the sanctions list.
The court also recognized that although the Lazarus Group used Tornado Cash, this should not serve as a legitimate basis for sanctioning the entire protocol. Since immutable smart contracts do not belong to the traditional definitions of 'property' or 'service,' the entire protocol cannot be sanctioned merely due to the abuse by certain users (such as the Lazarus Group).
Thus, OFAC's actions exceeded the scope of legal authority. The court called for addressing these issues through updating laws, rather than expanding the existing sanctions framework.
The IEEPA was enacted in 1977, long before the modern internet.
Previously, OFAC's main legal basis for sanctioning Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also stated, 'The IEEPA was enacted in 1977, long before the invention of the modern internet.'
The IEEPA grants the U.S. President the authority to impose economic sanctions on foreign 'property' when national security, economic, or foreign policy is under 'unusual and extraordinary threat.' OFAC regarded Tornado Cash as an 'entity' and classified its smart contracts as tools related to cybercriminal organizations such as the North Korean Lazarus Group.
However, the court emphasized that it is the responsibility of Congress to amend laws to address the challenges posed by new technologies, rather than judicial institutions expanding legal interpretations to fill gaps. The court rejected the Treasury's attempt to broaden administrative authority through judicial proceedings.
Finally
The significance of this ruling is not only about the legality of the privacy tools behind Tornado Cash but, more importantly, it delineates clear legal boundaries for the entire blockchain industry and the development of decentralized technology. The uniqueness of immutable smart contracts was deeply discussed in this case, and the court's ruling provides important judicial support for the legitimate use of similar technologies in the future.
At the same time, this also poses new challenges for regulators: how to effectively curb potential illegal uses while protecting technological innovation and privacy.
After all, this is a very attractive technology, and these two sentences in the ruling document illustrate the uniqueness of this technology well:
Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, 'those immutable smart contracts remain accessible to anyone with an internet connection.'
In simple terms, regardless of whether OFAC includes Tornado Cash on the sanctions list, these immutable smart contracts will continue to operate.
Even if the sanctions take effect, 'these immutable smart contracts remain open to anyone with an internet connection.'
