Author: ZHIXIONG PAN
Can immutable smart contracts be subject to sanctions? This is the central question faced by the United States Court of Appeals for the Fifth Circuit in the Tornado Cash case.
Yesterday, the court ruled that the U.S. Treasury's Office of Foreign Assets Control (OFAC) overstepped its authority in sanctioning Tornado Cash. This ruling is not only a victory for the plaintiffs but also sparks discussions about technological neutrality and legal boundaries.
The rise of blockchain technology has brought a revolution in privacy and decentralization, but it has also come with regulatory challenges. When the privacy tool Tornado Cash became the focus of money laundering controversy, the U.S. Treasury implemented severe sanctions against it.
However, the court's ruling pointed out that the immutable smart contracts of Tornado Cash do not meet the traditional legal definition of 'property.' These smart contracts are decentralized, self-executing, and uncontrollable codes that cannot be owned or used exclusively. Therefore, the action of listing them on the Specially Designated Nationals and Blocked Persons List (SDN List) is considered to have exceeded the legal authorization.
The impact of this ruling extends far beyond the case itself. It involves not only the legality of blockchain privacy tools but also significant issues regarding technological neutrality and legal adaptability. This court ruling points the way for future legislation and regulation—attributes of the technology itself need to be distinguished from the actions of malicious users to avoid overextending the powers of administrative agencies due to the neutrality of technology.
In fact, the judgment document in this case contains many details and content worth noting.
Who is the plaintiff?
These plaintiffs claim to be users of Tornado Cash, but they are also users of Ethereum and the crypto ecosystem. They come from security auditing teams, Coinbase, client developers, hardware wallets, etc., and are supported by the legal team of Coinbase. They are:
Joseph Van Loon (Auditware, former Apple)
Tyler Almeida (Coinbase)
Alexander Fisher (Angel Investor)
Preston Van Loon (Ethereum Core Developer and Offchain Labs / Arbitrum)
Kevin Vitale (GridPlus)
Nate Welch (former zkSync, Coinbase)
Who is the defendant?
The U.S. Department of the Treasury and Treasury Secretary Janet Yellen
The Office of Foreign Assets Control (OFAC) and OFAC Director Andrea M. Gacki
Why did the plaintiffs file a lawsuit?
The plaintiff sued the defendant, questioning its designation of Tornado Cash's immutable smart contracts as 'property' and the imposition of sanctions beyond the legal authorization, violating the International Emergency Economic Powers Act (IEEPA) and the Administrative Procedure Act (APA).
The plaintiffs argue that these contracts are autonomously operating decentralized codes that cannot be controlled or owned and therefore should not be subject to sanctions.
Which court made the ruling?
The United States Court of Appeals for the Fifth Circuit is equivalent to an intermediate court, which is the federal appellate court. Above it is the Supreme Court of the United States, which is at the top of the entire federal judicial system and is the final adjudicating body. Only a few cases can reach the Supreme Court through appeals or special permissions (such as a writ of certiorari).
What was the court's ruling?
The court ruled that the defendant (OFAC) violated the International Emergency Economic Powers Act (IEEPA) by sanctioning Tornado Cash because immutable smart contracts do not meet the definition of 'property'.
The court believes that these smart contracts are decentralized, self-executing, and uncontrollable codes that should not be subject to sanctions. At the same time, the court pointed out that although technology may be abused, administrative agencies do not have the authority to exceed legal provisions to expand the scope of sanctions. Ultimately, the court overturned the sanctions decision and called on legislative bodies to improve the legal gaps regarding emerging technologies.
Why did the plaintiff help initiate the lawsuit against Tornado Cash?
Although these six plaintiffs are not developers of Tornado Cash, they all state that they are users of Tornado Cash and express the need for Tornado Cash to enhance privacy for legitimate purposes.
For example, Tyler Almeida anonymously donated through Tornado Cash to support Ukraine, fearing retaliation from Russian hacker organizations if the transaction were tracked. Meanwhile, Kevin Vitale switched to using Tornado Cash to protect his privacy after discovering that someone had linked his cryptocurrency activities to his real address. Other individuals made similar claims.
Immutable is the core keyword, how to define it?
In this case, there were many discussions, definitions, and summaries around the word immutable, which recognized the uniqueness of decentralized systems and smart contracts as new technologies. The court also acknowledged that this uniqueness of decentralized technology poses unique challenges to the existing legal system.
The court's final ruling is:
Because these immutable smart contracts are not 'property' under the word's common, ordinary meaning or under OFAC definitions, we hold that OFAC exceeded its statutory authority.
Because these immutable smart contracts do not constitute 'property' in either the common, ordinary sense or under OFAC's definitions, we find that OFAC exceeded its statutory authority.
It was also added that
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned.
And as a result, no one can 'exclude' anyone from using the Tornado Cash pool smart contracts.
The immutable smart contracts involved in this case are not property because they cannot be owned.
Therefore, no one can 'exclude' others from using the Tornado Cash smart contracts.
The court's definition of immutable smart contracts is:
A mutable smart contract is one which is managed by some party or group and may be changed.
An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.
A mutable smart contract is one that is managed by some individuals or groups and can be changed.
Immutable smart contracts, on the other hand, cannot be altered or removed from the blockchain. It is important to note that mutable smart contracts can be changed to an immutable state. But this is an irreversible process; once a smart contract becomes immutable, no one can reclaim control over it.
But what if hackers are really using Tornado Cash for money laundering? There's currently no solution.
North Korea's hacker organization, the Lazarus Group, stole nearly $1 billion in cryptocurrency through hacking and needed to use mixers to hide the source of funds to complete money laundering. Therefore, OFAC accused Tornado Cash's mixing function of being used for money laundering, claiming that the Lazarus Group laundered more than 65% of its funds through mixers in 2021, with Tornado Cash being one of the main tools.
Therefore, Tornado Cash has been indirectly linked to the money laundering activities of the Lazarus Group and has been placed on the sanctions list.
The court also acknowledged that although the Lazarus Group used Tornado Cash, this should not be a legitimate basis for sanctioning the entire protocol. Because immutable smart contracts do not belong to the traditional definitions of 'property' or 'services', the entire protocol cannot be sanctioned due to the abuse by certain users (such as the Lazarus Group).
Therefore, OFAC's actions exceeded its legal authorization. The court called for updating the law rather than expanding the current sanctions framework to address the issue.
The IEEPA was enacted in 1977, long before the modern internet.
Prior to this, OFAC's main legal basis for sanctioning Tornado Cash was the International Emergency Economic Powers Act (IEEPA), but the court also stated, 'The IEEPA was enacted in 1977, long before the invention of the modern internet.'
IEEPA grants the U.S. President the authority to sanction foreign-related 'property' when national security, economic, or foreign policy is under 'unusual and extraordinary threat.' OFAC views Tornado Cash as an 'entity' and its smart contracts as tools related to cybercriminal organizations like North Korea's Lazarus Group.
However, the court emphasized that it is Congress's responsibility to amend laws to address the challenges posed by new technologies, rather than the judiciary expanding legal interpretations to fill gaps. The court rejected the Treasury's attempt to expand administrative authority through judicial proceedings.
Finally
The significance of this ruling lies not only in the legality of the privacy tools behind Tornado Cash but also in defining clear legal boundaries for the development of the entire blockchain industry and decentralized technologies. The uniqueness of immutable smart contracts is discussed in depth in this case, and the court's ruling provides important judicial support for the legitimate use of similar technologies in the future.
At the same time, this also poses new challenges for regulatory agencies: how to effectively curb its potential illegal uses while protecting technological innovation and privacy.
After all, this is a very attractive technology, and these two sentences in the judgment document illustrate the uniqueness of the technology well:
Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.
Even with the sanctions in place, 'those immutable smart contracts remain accessible to anyone with an internet connection.'
In simple terms, regardless of whether OFAC lists Tornado Cash on the sanctions list, these immutable smart contracts will continue to operate.
Even with the sanctions in place, 'these immutable smart contracts remain accessible to anyone with an internet connection.'
