The Tornado Cash Trial’s Mixed Verdict: Implications for Developer Liability

On August 6, 2025, following a four-week trial, a jury in the Southern District of New York delivered a mixed verdict in the criminal case against Tornado Cash co-founder Roman Storm. The jury convicted Storm of conspiring to operate an unlicensed money transmitting operation, but were deadlocked on the two more serious charges—conspiracy to commit money laundering and conspiracy to commit sanctions violations.

Despite the mistrial on the two charges, the conviction on the unlicensed money transmitting business charge demonstrates the importance of developers and operators of mixers and exchanges to engage legal counsel to determine if their entity falls into the definition of a money transmitting business, and how to get properly licensed by FinCEN and/or state authorities. It also highlights potential anti-money laundering risks to counterparties of mixers and exchanges.

In this Legal Update, we review this verdict and discuss the implications going forward for individuals and companies operating in the digital asset space.

Background

Tornado Cash: Roman Storm and his co-founders developed Tornado Cash in 2019 to provide financial privacy to digital asset users and their transactions. Tornado Cash operated as a digital asset intermediary and mixer on the Ethereum blockchain that allowed individuals to break the typically visible chain of custody and anonymize each crypto transaction. Tornado Cash users would deposit large amounts of digital assets into the application, where the funds would be pooled and mixed with other funds deposited into the application. At a later date, the user could withdraw their digital assets from a different crypto address. This process allowed digital asset holders to effectively anonymize the origin, recipient, and overall movement of their assets.

Mixers like Tornado Cash pose anti-money laundering and Know Your Customer (“KYC”) risks to counterparties as it makes it essentially impossible to know the originator or beneficiary information associated with the transactions.

Tornado Cash had a decentralized autonomous organization (DAO) that regularly made decisions for the platforms and whose voting powers were based on ownership of Tornado Cash tokens. Because the platform relied on immutable smart contracts to facilitate the mixing and moving of money, Tornado Cash itself never directly took custody of the users’ funds. Storm and his co-founders could profit from ownership of Tornado Cash tokens.

Exploitation by Criminals: In August 2022, the Office of Foreign Assets Control (OFAC) of the U.S. Department of Treasury (DOT) sanctioned Tornado Cash and added the platform to the Specially Designated Nationals and Blocked Persons (the “SDN List”), effectively making it illegal for U.S. residents and companies to send or receive assets through Tornado Cash. OFAC based the sanctions on allegations that Tornado Cash aided criminal actors to launder more than $7 billion in cryptocurrency. Most notably, OFAC alleged that North Korea’s state-funded hacking organization, the “Lazarus Group”, used the platform to launder $600 million that it stole by hacking Axie Infinity. In December 2024, the United States Court of Appeals for the Fifth Circuit issued a landmark decision, holding that OFAC exceeded its authority by sanctioning certain autonomous protocols on Tornado Cash. Despite the Fifth Circuit’s decision on sanctions, the DOJ pressed forward and charged Roman Storm¹ with three charges of conspiracy: (1) conspiracy to money launder; (2) conspiracy to operate an unlicensed money transmitting business; and (3) conspiracy to violate the IEEPA (referred to informally as conspiracy to violate sanctions).

Trial

The trial raised the important question of whether the creators and developers of decentralized privacy-preserving technologies can be held criminally liable for the illicit activities of third parties who use their software.

The parties seemed to agree on a few points: Storm did not launder funds himself; Storm became aware that Tornado Cash was being used by criminal actors for criminal activities; and Tornado Cash was, to a varying degree, also used for legitimate transactions. But the parties disagreed on whether Storm was a willing participant in the criminal conduct.

The government argued that despite knowing that Tornado Cash was being used by criminals as a channel to conceal their illegal gains, Storm continued to operate and promote the platform—effectively getting rich washing money for criminals. Prosecutors further claimed that Storm not only knew he was running a money laundering machine, but actively embraced the platform’s reputation as such, and chose to not implement strong safeguards to deter criminals. The government emphasized that Storm prioritized profit over public safety, the prevention of cyber-terrorism, and the protection of digital assets and their owners.

The defense maintained that Tornado Cash was a privacy tool designed to meet a legitimate need within the digital asset community. They also contended that a majority of funds passing through Tornado Cash were not linked to criminal activity. Storm’s defense attacked the prosecution’s theory of intent by arguing that the prosecution could not prove the developers willfully aided or conspired with criminals to commit crime—simply building a neutral platform or tool and knowing that it could be used for both lawful and unlawful uses (much like a VPN, encrypted messaging app, or even a hammer), is not by itself criminal. Storm’s defense also claimed that he did implement safeguards, pointing to efforts by the developers to implement geo-blocking and their discussions on ways to block certain users.

The jury spent nearly a week deliberating. During deliberations, the jury sent questions to the Court asking for testimony, evidence, and to clarify and instruct on various niche parts of the law. The jurors could not come to a unanimous verdict on two of the three charges, resulting in a partial mistrial, but did convict Storm on one count of conspiracy to operate an unlicensed money transmitting business in connection with Tornado Cash.

The Verdict and Its Implications

The Tornado Cash Trial’s mixed verdict underscores the uncertainty for developers and operators of decentralized privacy-preserving platforms. There are, however, important inferences that can be drawn from the mixed verdict.

The verdict demonstrates that:

• Developers and operators should seek legal counsel in determining whether they are operating a money transmitting business and seek the appropriate licenses under FinCEN and/or state authorities; they should also consider engaging counsel in determining their potential anti-money laundering and KYC risks.

• The jury was unpersuaded by Storm’s argument that he lacked control over who engaged with the decentralized platform. This may reflect skepticism towards the highly technical aspects of cryptocurrency or an expectation that developers should find ways to exert oversight over their creations.

• Despite the technical complexity of cryptocurrency and decentralized technologies, jurors demonstrated a willingness and ability to engage deeply with the facts and legal issues, as reflected in both their thoughtful jury notes and extended deliberations, and their unwillingness to waver on the two deadlocked charges.

The final outcome remains in flux as both parties likely prepare to file post-trial motions, the government decides whether to retry the two deadlocked conspiracy counts, and the defense promises to appeal the singular conviction.

What to Expect in the Bigger Picture

• Prosecutorial Approach: It is unclear how prosecutors will interpret the mixed verdict. The verdict—or lack thereof—could give prosecutors pause when considering pursuing cases against crypto developers and operators who have merely created privacy-focused tools like mixers, especially in the absence of clear evidence of intent or direct facilitation of criminal activity. Still, we think it is likely that prosecutors will continue to bring similar cases, especially when they perceive a significant harm and the facilitation of dangerous criminal activity like the foreign hacking Lazarus Group.

• Impact on Crypto Developers and Digital Asset Community: The verdict provides no clear guidance on how the digital assets community should proceed. We could see a slight slowdown in innovation and development of anonymizing mixers while this case makes its way through post-trial briefing and the appellate process. This verdict will likely encourage developers to keep advocating for blockchain privacy; to date, developers, industry figures, and the public at large have raised $4.7 million for Storm’s defense, and the Ethereum Foundation has already pledged $500,000 to support Storm’s appeal. The mobilization around Storm’s criminal case underscores the strong support within the crypto community for privacy and developers’ freedom of speech through code.

• Regulatory and Policy Implications: We can expect that the Trump Administration will issue more concrete regulations and guidance on this issue. Before trial, the DOJ issued a multi-page report in April 2025 from the Deputy Attorney General titled “Ending Regulation by Prosecution.” The report states that “[DOJ] is not a digital assets regulator” and that DOJ “will no longer pursue litigation or enforcement actions that have the effect of superimposing regulatory frameworks on digital assets, while President [Donald] Trump’s actual regulators do this work outside the punitive criminal justice framework.” In particular, the report states that “[p]rosecutors will not charge regulatory violations in cases involving digital assets—including but not limited to unlicensed money transmitting.” While this development highlights a shift toward clearer boundaries between enforcement and regulation in digital assets, suggesting a shift toward a more balanced and predictable policy landscape, it also raises questions on how the DOJ will approach digital assets enforcement going forward. 

• Regulatory and Anti-Money Laundering Risks Remain: The biggest takeaway is that regardless of the regulatory shift under the current Administration, developers and operators of digital asset companies still have exposure to anti-money laundering, KYC and licensing risks, and should still consult with counsel on how best to address such risks through a vetted compliance program.

 

---

 

¹ The DOJ lodged similar criminal charges against co-founder Roman Semenov, who is currently wanted for his alleged involvement in Tornado Cash. Co-founder Alexey Pertsev was tried and convicted by a Dutch court in May 2024 for his role in Tornado Cash. Pertsev was sentenced to 64 months in Dutch prison.