Tornado Cash Crackdown Shows Limits of Regulating Cryptocurrency Servicesbit2main
The U.S. sanctioning of a prominent cryptocurrency platform this week exposed technical gaps in the government’s ability to prevent criminals, national adversaries and extremist groups from using the services to launder money and finance their operations, analysts said.
Among the central challenges: Cryptocurrency platforms are increasingly run by computer code distributed across computers around the world, rather than by individuals facilitating transactions, analysts said.
The Treasury Department on Monday imposed sanctions against Tornado Cash, a popular cryptocurrency platform known as a mixer because it blends funds from different users and redistributes them, obscuring their origin. The Treasury Department accused Tornado Cash of laundering billions of dollars in virtual currency, including $455 million allegedly stolen by North Korean hackers. As part of the penalties, officials blocked all property held by the exchange under U.S. jurisdiction and barred U.S. companies and individuals from transacting with it.
Analysts said the sanctions would hinder Tornado Cash’s growth by discouraging users and major cryptocurrency exchanges that are reluctant to trade on a blacklisted platform. This will reduce the amount of funds flowing in and out of Tornado Cash.
Circle Internet Financial Ltd., the issuer of a stablecoin that tracks the U.S. dollar, blocked the sanctioned wallet addresses after Monday’s announcement, effectively freezing the funds in those wallets.
“It is likely that nearly all responsible registered Virtual Asset Service Providers also took steps to block customers from transacting with these addresses, or face charges of willfully avoiding US sanctions compliance obligations,” Circle Chief Executive
wrote on Twitter.
But almost as soon as the sanctions were announced, some users began trying to exploit perceived shortcomings in the government’s effort. For example, funds can still be transferred out of cryptocurrency wallets on the platform, and its software code, used to initiate transactions, can be reproduced and relaunched elsewhere.
“It is difficult, if not impossible, to shut down Tornado Cash entirely,” said
co-founder of risk-management company Elliptic Enterprises Ltd., which analyzes illicit use of crypto services.
Tornado Cash’s developers designed the service to enable users to exchange cryptocurrency with little or no information about the parties, a contrast to traditional financial institutions that are typically required to collect details about their account holders. That appeals to users drawn to crypto for privacy and security—some Twitter users said this week they used Tornado Cash to send cash to support Ukrainians suffering from Russia’s invasion. But the lack of disclosure also creates opportunities for illicit transactions, Mr. Robinson said.
Tornado Cash’s code isn’t hosted by an individual or company, but lives on the Ethereum blockchain, a decentralized, global network of computers, where it automatically fulfills trades.
As a result, the U.S. and other governments have no individual or entity they can force to halt Tornado Cash’s operations. Even when
GitHub Inc. removed the latest copy of the platform’s code from its website after the sanctions announcement Monday, some users had already copied the files.
Tornado Cash’s developers have described it as a privacy app that doesn’t technically hold users’ deposits, because they are mixed with other funds. Its original developers say they no longer have control over the platform. Like many other decentralized financial projects, Tornado Cash is overseen by an online community of individuals who hold tokens that enable them to vote on changes in governance.
Crypto analysts also see other workarounds that fans of the platform are exploiting. The sanctions will prevent most centralized cryptocurrency exchanges from touching the platform, but people can create their own cryptocurrency accounts without touching a major exchange, allowing users to send funds to whomever they like. Owners of a wallet don’t need to consent to receive coins.
An anonymous user appears already to be sending small amounts of ether tokens from sanctioned Tornado Cash crypto wallet addresses to wallets that belong to prominent crypto figures including
Coinbase Global Inc.
mainstream celebrities and clothing brand Puma, according to blockchain data. A spokesman for Coinbase declined to comment.
A spokeswoman for Puma confirmed that the firm’s crypto wallet received a “small and unauthorized payment” of approximately 0.075 ether, equivalent to $137, from Tornado Cash.
“Puma has no business relationship with Tornado Cash and had no prior knowledge of the payment. This matter is currently under investigation,” the spokeswoman told The Wall Street Journal.
SHARE YOUR THOUGHTS
What steps should authorities take to better regulate new crypto platforms? Join the conversation below.
After years of cautious restraint by federal agencies, a series of actions in recent months have demonstrated the Biden administration’s desire to target the virtual currency ecosystem itself to disrupt the tools criminals use to steal or extort funds and then launder it into cash.
As the market grows and becomes increasingly mainstream, it has been used to facilitate lucrative criminal operations such as ransomware attacks and North Korea’s alleged heists of hundreds of millions of dollars in cryptocurrency. Proponents of crypto argue that such transactions are a small percentage of digital asset trading overall.
Eun Young Choi, the first director of the national cryptocurrency enforcement team created last year at the U.S. Justice Department, said at a recent conference in New York that investigators had improved their ability to track and prosecute cryptocurrency cases. A forthcoming review from the Justice Department, due in early September, is expected to detail current enforcement challenges for authorities and could offer regulatory or legislative changes to support enforcement.
The Justice Department declined to comment.
—Vicky Ge Huang contributed to this article.
Write to Caitlin Ostroff at email@example.com and Dustin Volz at firstname.lastname@example.org
Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8