Hacker News Reader

Comment by oceanstone | Hacker News Reader

Tornado needs TVL to effectively launder money for criminals. Forks without much TVL don't seem that dangerous

I take issue with the claim that tornado can “effectively launder money for criminals.” All it can do is leave you with an asset with a less-than-clear on chain history. If you want to cash out, you still have to explain how you wound up with 100 ETH or whatever.

Even if it does, who gives a shit? The interstate road crew happily builds the interstate, knowing money launderers use it without taking the slightest precaution to stop them. They cash their paycheck, knowing some of the money thrown in the 'mixer' of the treasury was the money of the money launderers paying their taxes that build the interstate.

The road crew is like the workers at an internet provider or maybe an isp, and the vast majority of the traffic is legal. That original analogy makes it seem like the verdict on tornado was already made, now we just need to grasp at arguments to support the pre-made conclusion. It backfires. Don’t shoot the messenger.

Exactly. I hate this false idea that TC launders your money.

Your TC money isn't any more laundered than a pile of cash you got by selling meth.

Laundering means making up some origin for such money (such as a business).

Kinda. Money laundering consists of placement, layering, and integration. There is a (very weak, imo) argument that TC can be a part of the “layering” process, but it certainly does not do all three.

North Korea laundered a billion dollars through Tornado https://markets.businessinsider.com/news/currencies/north-ko...

Money laundering is comprised of three parts: placement, layering, and integration. The government here is attacking the “layering” part of the process that tornado _may_ contribute to (the norks still have to explain how they ended up with a billion of ETH). But to truly be “money laundering” you have to have all three elements. The equivalent here would be banning casino chips or something.

> equivalent here would be banning casino chips or something

If someone pays for a house with casino chips, and you don’t do your diligence on why they chose that mode of settlement, you’re rightfully exposed to legal risk if they were in fact laundering money.

If that's true, then it can't launder money very well can it?

Definitely feels like a false narrative has been created by the fact they're able to point it out.

Like pointing at someone and accusing them of hiding, but the very fact you can point them out means it's either not actually happening or not happening very effectively.

Anyone can see what amount of money one address has put into Tornado Cash, so it’s no surprise that we can estimate how much money North Korea has put in. The whole reason they do put that money in, though, is so that they can have a different account take that money out, and have it not be clear where the money came from. For a sanctioned country, that output seems much more spendable.

It was very effective. The money went in, and no-one knows where it came out. BUt you can bet it went into thousands of clean, untainted wallets which were then used to cash out.

Yes, Tornado allows you to obtain ETH that is divorced from the original (potentially criminal) source. But exchanges and anyone with a block explorer can still see that your clean wallet received 100 ETH from the Tornado withdrawal address. Exchanges in America at least are supposed to consider accounts receiving funds from mixers as "high risk" and apply extra scrutiny/shut down accounts. There are exchanges in Hong Kong and most of the former Soviet Union that ignore these kind of rules but Tornado still doesn't really "clean" the money in the sense of giving you readily spendable money in a bank account. I guess it may be useful in the process of doing so.

It's extremely useful.

> Exchanges in America at least are supposed to consider accounts receiving funds from mixers as "high risk" and apply extra scrutiny/shut down accounts.

I believe there's a level (I think $3000) for the "travel rule"[1] to apply.

It's obviously easy to bounce the money through some "NFT sales" too if you want.

[1] https://www.fincen.gov/sites/default/files/advisory/advissu7...

> I take issue with the claim that tornado can “effectively launder money for criminals.” All it can do is leave you with an asset with a less-than-clear on chain history. If you want to cash out, you still have to explain how you wound up with 100 ETH or whatever.

ehhhhhhhh. you can play with asset prices and valuations to fix this.

you have a little clean money savings from your job right?

okay, great, with a little bit of dirty/flaggable money in a different address, launch an erc20 token and liquidity pool, add 100% of the erc20 to the liquidity pool.

now with your clean money, be an early buyer.

now with MORE of your dirty/flaggable money (other tornado cash notes withdrawn to different virgin addresses via the relayer), buy into the liquidity pool. this pumps the price of the token.

now with your clean money, sell. cash out, pay capital gains tax, move on. indistinguishable from any other crypto trader. bots and many others would have bought into the liquidity pool too as they have alerts.

everyone else can play amongst themselves in perpetuity, and it can't go below the initial price that you set when you launched the pool (in Uniswap V2 style liquidity pools, and just if you want to feel better about it). hey, maybe if it keeps running then your tornado cash funded addresses might be able to sell back into the liquidity pool again.

With this scheme you just dreamed up I wouldn’t even need Tornado.

you don't need, there is still benefit in unlinking the transaction history and normalizing that behavior.

virgin addresses funded by a third party relayer does that.

you don't want your $30,000,000 bridge heist funds to be buying a newly launched token. you want a bunch of unknown sources to be buying the newly launched token, various identities.

edit: actually I could see the crypto community finding it hilarious and "aping in" knowing that a large buyer is supporting. easier to blend in.

> just dreamed up

Please.

"Explaining" is easy. You sold an NFT and they paid via Tornado.

The hiding is a real issue here.

Had to look that up. TVL = Total Value Locked. E.g. the code itself doesn't and can't make an effective mixer, a high volume of the money flowing through a specific mixer service is necessary.

A piece of code on GitHub has zero TVL. It's just a bunch of files. (I would assume the treasury department only gets involved when there is actual money involved. Sending money to a contract on the blockchain is finance. Just posting the code somewhere is speech.)

Obviously, the threat is deployed forks with high TVL

Is it? Given that the original code still exists on mainnet and cannot be taken down. I suppose the main use case of a high TVL fork would be for Americans who wanted to legally regain their privacy without risking a sanctioned contract interaction. Anyone who doesn't care can still use the original.

This is just so you can compile the UI locally, without worrying about using a potentially compromised mirror that will steal your funds.

For those of us with licenses from the US treasury for exemption from a specific sanctioned entity, this is still important.

That sounds like an opportunity for a sweetheart deal. Hey you can sell your locked assets, but only at firesale prices to this licensed entity.

Maybe, but you might be misunderstanding how that works as well as assumptions about crypto user stories.

there is a sanction on US persons from merely interacting with the deployed Tornado Cash contract, so there is a potential fine and prison sentence for just doing that. The license removes that liability.

the assets you receive out of Tornado Cash can be used the same as before. Exchanges may flag those funds arbitrarily, but other smart contracts and merchants do not. Many people stay directly on chain and pay for goods and services, and invest, without issue. Many people can derive real world benefits from things they purchase with their crypto, whether that thing is digital or physical. Its not about "cashing out", but if so, those people can still just deposit into some onchain lending service and cash out the borrowed funds, as exchanges themselves don't dig that deep and if that individual has the OFAC license it doesn't matter.

for those that choose to go to the treasury to get a license, they can always prove provenance of their tornado cash assets and prove they're clean, which is a key feature of tornado cash. so its not a good assumption that the treasury would target that person to make a deal, because there wouldn't be any liability at all, only the novelty of making the application for the license.

> The license removes that liability

As you evidently know, that's the defining characteristic of a license: it removes criminal or civil liability for an otherwise illicit act. For example a Barber's license permits a person to hold a knife to someone's throat without it being assault, modulo some additional conditions. So much for generalities.

To the specifics, you look to be quite well informed on this particular matter. Are you saying that someone that has assets in Tornado that they cannot otherwise cash out without violating sanctions can lawfully sell them to a licensee, but nobody else? Because if so that sounds like a wonderful buying opportunity for the licensee. Or is getting a license trivially easy, such that anyone with assets legally tied up can just go through a TSA pre level process to establish that they're not an international terrorist drug dealing child trafficker, or whatever activity these sanctions are meant to discourage?

My example is limited to

a) the person already having assets in Tornado Cash also being the licensee to withdraw assets from Tornado Cash. the assets they withdraw are as liquid as any other non-TC assets and do not have to go to a fellow licensee.

b) a person that wishes to continue depositing assets into Tornado Cash is also the person that is the licensee.

the only reason for the license is for interacting with the Tornado Cash smart contract - as by default that is currently a sanctions violation for US persons - it has nothing to do with whether another recipient is comfortable accepting those assets, and that isn't a limitation of liquidity at all.

Hope that makes sense. The license is just a bureaucratic nuance for people that dont want to gamble with liability. They can totally try to hide it and risk a sanctions violation charge.

TVL is not a property of the source code.

I wonder if it is possible to have a variation of Tornado where the TVL automatically moves to a new deployment at a new random address every N blocks, so that it's not as simple to have specific addresses sanctioned. I don't know Tornado very well and don't know if this would be possible.

I mean, you'd sanction that address and any other it deploys to. In addition, sanctions are transitive (by how much no one knows).

Not knowing anything about cryptocurrencies or running distributed systems on the wilds of the internet, I will ask a dumb question:

Is it possible to design an algorithm that comes to a consensus on what new address to use faster than the legal system can sanction them?

You could cascade the sanctions so any addresses touched by sanctioned addresses becomes sanctioned too; that leads you open to trolling and abuse where a sanctioned address sends money to celebrities to impact them. This could probably be dealt with by saying anyone who uses an obvious Tornado-style contract that's been sent money from XYZ address is illegal, so you don't end up with the trolling, but I don't know for sure how that'd work.

There are still big legitimate institutional entities doing crypto, right? At some point you must hit "7 degrees to Wells Fargo" or whatever, right?

Of course. It's a riskier implementation from a smart contract security standpoint, but entirely possible.

I mean couldn't I also argue TVL is speech like source code? Or does code have to be without value to be protected?

This is a fork of the code. It's not a new deployment.

Reply on news.ycombinator.com