Written by: ZHIXIONG PAN
Can immutable smart contracts become targets of sanctions? This is the core issue faced by the United States Court of Appeals for the Fifth Circuit in the Tornado Cash case.
Yesterday the court ruled that the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) acted beyond its authority in sanctioning Tornado Cash. This ruling is not only a victory for the plaintiffs but also sparks discussions about technological neutrality and legal boundaries.
The rise of blockchain technology has brought a revolution in privacy and decentralization, but it also comes with regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversies, the U.S. Treasury imposed severe sanctions on it.
However, the court's ruling pointed out that the immutable smart contracts of Tornado Cash do not meet the traditional legal definition of 'property.' These smart contracts are decentralized, self-executing, and uncontrollable codes, which cannot be owned or exclusively used. Therefore, the act of including them in the Specially Designated Nationals and Blocked Persons List (SDN List) is deemed to exceed the legally authorized scope.
The impact of this ruling goes far beyond the specific case itself. It not only involves the legality of blockchain privacy tools but also addresses significant issues of technological neutrality and legal adaptability. This ruling from the court points the way for future legislation and regulation—distinguishing the attributes of technology from the actions of malicious users, to avoid overly expanding the powers of administrative agencies due to technological neutrality.
In fact, the ruling document of this case contains many details and content worth noting.
Who are the plaintiffs?
These plaintiffs claim to be users of Tornado Cash, but they are also users of Ethereum and the crypto ecosystem. They come from security audit teams, Coinbase, client developers, hardware wallets, etc., and are supported by the legal team of Coinbase. They are:
Joseph Van Loon (Auditware, former Apple)
Tyler Almeida (Coinbase)
Alexander Fisher (Angel Investor)
Preston Van Loon (Ethereum Core Developer and Offchain Labs / Arbitrum)
Kevin Vitale (GridPlus)
Nate Welch (former zkSync, Coinbase)
Who is the defendant?
The U.S. Department of the Treasury and Secretary Janet Yellen
The Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki
Why did the plaintiffs file a lawsuit?
The plaintiffs filed a lawsuit against the defendant, questioning its listing of Tornado Cash's immutable smart contracts as 'property' and imposing sanctions beyond the legal authority, violating the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA).
The plaintiffs believe that these contracts are self-operating decentralized codes that cannot be controlled or owned, and therefore should not become targets of sanctions.
Which court made the ruling?
The United States Court of Appeals for the Fifth Circuit is equivalent to an intermediate court, which is the federal appellate court. Above it is the Supreme Court of the United States, which is at the top of the entire federal judicial system and serves as the final arbiter. Only a few cases can enter the Supreme Court through appeal or special permission (such as a writ of certiorari).
What was the court's ruling?
The court ruled that the defendant (OFAC) acted beyond its authority in sanctioning Tornado Cash under the International Emergency Economic Powers Act (IEEPA), because immutable smart contracts do not meet the definition of 'property.'
The court held that these smart contracts are decentralized, self-executing, and uncontrollable codes, and should not be included as targets of sanctions. Meanwhile, the court pointed out that although the technology may be abused, administrative agencies do not have the authority to expand the scope of sanctions beyond the law. Ultimately, the court overturned the sanction decision and called on the legislature to address the legal gaps for emerging technologies.
Why do the plaintiffs want to help Tornado Cash file a lawsuit?
These six plaintiffs, while not developers of Tornado Cash, all state that they are users of Tornado Cash and express the need for Tornado Cash to enhance privacy and be used legally.
For example, Tyler Almeida anonymously donated to Ukraine through Tornado Cash, fearing retaliation from Russian hacker groups if the transaction was traced. Kevin Vitale turned to Tornado Cash to protect his privacy after discovering that someone had linked his cryptocurrency activities to his actual address. Several others made similar statements.
Immutable is the key word; how to define it?
In this case, there were many discussions, definitions, and summaries regarding the word immutable, which essentially recognized the uniqueness of decentralized systems and smart contracts as a new technology. The court also acknowledged that the uniqueness of decentralized technology poses unique challenges to the current legal system.
The court's final ruling is:
Because these immutable smart contracts are not 'property' under the word's common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
Because these immutable smart contracts do not constitute 'property' in either the ordinary sense or under OFAC definitions, we determine that OFAC exceeded its statutory authority.
It also added that
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can 'exclude' anyone from using the Tornado Cash pool smart contracts.
The immutable smart contracts involved in this case are not property because they cannot be owned.
Therefore, no one can 'exclude' others from using the rights of Tornado Cash smart contracts.
The court defined immutable smart contracts as:
A mutable smart contract is one which is managed by some party or group and may be changed.
An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.
A mutable smart contract is one managed by certain individuals or groups and can be changed.
Immutable smart contracts cannot be altered or removed from the blockchain. It is important to note that mutable smart contracts can be changed to an immutable state. But this is an irreversible process; once a smart contract becomes immutable, no one can regain control over it.
But what if hackers are really using Tornado Cash for money laundering? There's no answer for now.
The North Korean hacker group Lazarus Group stole nearly $1 billion in cryptocurrency through hacking and needed to use mixers to hide the source of funds for money laundering. Therefore, OFAC accused Tornado Cash's mixing function of being used for money laundering, asserting that Lazarus Group laundered more than 65% of their activities through mixers in 2021, with Tornado Cash being one of the main tools.
Thus, Tornado Cash was indirectly linked to the money laundering activities of the Lazarus Group and was also placed on the sanctions list.
The court also acknowledged that although the Lazarus Group used Tornado Cash, this should not serve as a legitimate basis for sanctioning the entire protocol. Because immutable smart contracts do not belong to the traditional notion of 'property' or 'service,' the entire protocol cannot be sanctioned due to the abuse by certain users (such as the Lazarus Group).
Therefore, OFAC's actions exceeded the legal authority. The court called for addressing the issue by updating the laws rather than expanding the current sanctions framework.
The legislative time of IEEPA was in 1977, long before the modern internet.
Previously, OFAC's main legal basis for sanctioning Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also stated, 'The legislative time of IEEPA was in 1977, long before the invention of the modern internet.'
IEEPA grants the U.S. President the power to impose economic sanctions on foreign-related 'property' when national security, economic, or foreign policy is under 'unusual and extraordinary threat.' OFAC regards Tornado Cash as an 'entity' and lists its smart contracts as tools related to cybercriminal organizations such as North Korea's Lazarus Group.
But the court emphasized that it is the responsibility of Congress to amend laws to meet the challenges of new technologies, rather than for the judiciary to fill gaps through broad legal interpretations. The court rejected the Treasury’s attempt to expand administrative powers through judicial procedures.
Finally
The significance of this ruling lies not only in the legality of the privacy tools behind Tornado Cash but also in establishing clear legal boundaries for the entire blockchain industry and the development of decentralized technology. The uniqueness of immutable smart contracts is deeply discussed in this case, and the court's ruling provides important judicial support for the legitimate use of similar technologies in the future.
At the same time, this also poses new challenges for regulatory agencies: how to effectively curb potential illegal uses while protecting technological innovation and privacy.
After all, this is a very attractive technology, and these two sentences in the ruling document illustrate the uniqueness of this technology well:
Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, "those immutable smart contracts remain accessible to anyone with an internet connection."
In simple terms, regardless of whether OFAC lists Tornado Cash on its sanctions list, these immutable smart contracts will continue to operate.
Even with the sanctions in effect, "these immutable smart contracts remain accessible to anyone with an internet connection."