Tornado Cash devs charged with laundering more than $1B
theverge.com
theverge.com
Doesn’t this directly implicate the investor as well?
It’s always frustrating to see founders punished and the money get away scot free when everyone knows they’re pressuring the founders to grow at all costs.
The USG can be legitimately accused of all kinds of gross excesses, but they can't be accused of not understanding the difference between these things. Pretending otherwise doesn't do any party any particular justice.
Tornado Cash was not designed to violate laws as per intent of the authors. Maybe it is your judgement of the design itself.
Whether or not it in fact does is something we may possibly find out (if the US plea-deal system doesn't prevent it). Even then, a guilty verdict might hinge on technicalities around the TORN token.
> As alleged, when it became clear that a sanctioned North Korean cybercrime organization was using the platform to launder hundreds of millions of dollars derived from cyber heists, Storm and Semenov turned a blind eye to the illicit activity and made public representations that they were compliant with sanctions laws.
Now, we don’t know how much evidence they have about that knowledge but federal prosecutors usually don’t bring cases like this speculatively. I would be surprised if they didn’t have specific example of them clearly being aware of that information and choosing not to act - for a relatively high-profile case they’re not going to want the embarrassment of losing.
EDIT: Tracking down the actual PDF has things like this:
> 59. ROMAN STORM, ROMAN SEMENOV, the defendants, and CC-1 were fully aware within days of the Ronin Network hack that the proceeds of the hack were in fact being deposited into the Tornado Cash service. For instance, on or about April 4, 2022, a reporter sent an email to an email address used by all three Tornado Cash founders asking for comment on the Ronin Network hack, in which the reporter included a link to a blockchain analytics website and stated that "it appears that these hackers are trying to use Tornado.cash to launder stolen funds."
> 67. ROMAN STORM and ROMAN SEMENOV, the defendants, and CC-1 well knew that the Tornado Cash service was continuing to launder proceeds of the Ronin Network hack held in the Lazarus Group's 0x098B716 Address. On or about April 30, 2022, SEMENOV sent a message to STORM and CC-1 through the Encrypted App with a link to a blockchain analysis showing that 15% of all of the deposits into the Tornado Cash service over the preceding three months had come from the Ronin Network hack. The analysis also showed that more than 90% of all the deposits into the Tornado Cash service for which a source could be identified during that same time period were attributable to criminal exploits.
https://www.justice.gov/media/1311391/dl
90% is a pretty large number, and that pattern of ongoing knowledge is significant, too. As an analogy, if I run a bike shop and some dude brings in a stolen bike, I’m not getting arrested but that’s not true if 90% of the bikes in my shop are from the same dodgy guys the cops are looking for.
Yeah, I'm sure the FBI needed to bring out their top detectives to find "evidence" that the Tornado Cash devs where not aware that criminals used their service. I guess they never googled themselves or talked to anyone ever.
This case isn't a dispute about the facts. It's a fight about if existing AML legislation can be stretched to include new types of financial actors on blockchains.
Most people here simply have no idea how Tornado Cash operated, don't care to ask themselves what the underlying principles should be, what kinds of obligations should be in miners, and would probably support the arrest of Vitalik Buterin on money laundering charges.
If you run an actual service without KYC/AML, uh, yeah, you are probably f'd.
If you have specific knowledge that a sanctioned-by-OFAC north korean hacking group is using your service to launder hundreds of millions and you do nothing, you are definitely screwed.
They might have hosted some user interface code; I don't know. They would have been able to shut down or modify anything they were actually hosting. They could have created alternative contracts, and maybe encouraged somebody to use them. But the basic already-running Tornado Cash contracts are immutable and unstoppable without shutting down all of Ethereum.
If anything, something like Monero or ZCash seems to have less cover, because if the developers of those release modified code, and if they succeed in actually getting the bulk of the users to use it, they really can change the way the whole chain works. Although if they tried to remove all anonymity, all that would probably happen would be that somebody would fork the project.
No, but the US could start arresting validators on AML charges, and no doubt, many people here would support this too.
> They might have hosted some user interface code; I don't know.
That's just a static website though talking only to your wallet app. Somewhat similar to the fight around whether the piratebay is culpable for copyright violations. Many geeks used to support the piratebay.
The TC interface is hosted on IPFS. Can IPFS gateway operators not blocking the content be arrested on AML charges?
They could go after people for accepting and building on top of other people's blocks with such transactions in them. But I suspect they'd prefer not to have to do that, because the more rarefied the "interactions" they try to enforce against, the more chance they have of courts telling them they're beyond their statutory authority, or conceivably even of authority they actually do have getting repealed.
I haven't looked into it in any detail, but I suspect their authority for the Tornado sanctions is actually pretty shaky. They can sanction any entity, but it's not clear, to me at least, that a smart contract is an "entity" in the sense intended by the legislation they're presently relying on for all of this. That means that after all the lawsuits shake out, they may have to ask for new legislation to give them authority. I suspect they'd eventually get that authority, but it's harder to sell it to legislators if anybody can say you've been overreaching.
Clarification on edit: Their authority for the sanctions against interacting with the smart contracts looks weak. I don't know about the company or the people; those may be fully within their authority, depending on what they were actually doing. But the smart contracts are the heart of the whole thing. And OFAC seems to be trying its best to muddy the distinction.
In practice, they are being charged with conspiracy, and the conspiracy is mostly about running the website with the UI, not about the smart contracts (as i read it). they seem to have been careful not to try to charge them for creating some ethereum contracts.
Conspiracy does not require that they could have done something later to stop the conspiracy from completing.
The crime of conspiracy was complete when they committed an overt act (towards the overall criminal act). Once that was done, you lose.
Here, the overt act cited is paying for the website :)
In this case, the thing to do is to withdraw before an overt act.
If you successfully withdraw, you are no longer chargeable with conspiracy, even if the act later completes.
The model instruction for the defense of withdrawal looks like this: "“(1) One of the defendants, (Defendant’s name), has raised the defense that he withdrew from the agreement before any overt act was committed. Withdrawal can be a defense to a conspiracy charge. But Defendant has the burden of proving to you that he did in fact withdraw.
(2) To prove this defense, Defendant must prove each and every one of the following things:
(A) First, that he completely withdrew from the agreement. A partial or temporary withdrawal is not enough.
(B) Second, that he took some affirmative step to renounce or defeat the purpose of the conspiracy. An affirmative step would include an act that is inconsistent with the purpose of the conspiracy and is communicated in a way that is reasonably likely to reach the other members. But some affirmative step is required. Just doing nothing, or just avoiding the other members of the group, would not be enough.
(C) Third, that he withdrew before any member of the group committed one of the overt acts described in the indictment. Once an overt act is committed, the crime of conspiracy is complete. And any withdrawal after that point is no defense to the conspiracy charge.
(3) If Defendant proves these three factors by a preponderance of the evidence, then you must find him not guilty. Preponderance of the evidence is defined as “more likely than not.” In other words, the defendant must convince you that the three factors are more likely true than not true."
So, for example, for the charge related to running the website, "stop paying for website, tell others this is not okay, cut off all support and help you can" seems likely have been enough to withdraw here, even if you couldn't stop others from using it because it's immutable.
Some of the developers probably even know about specific illegal acts by specific actors. And the illegal activity has been happening throughout the lifetimes of those systems, with plenty of overt acts during any given developer's personal involvement.
So if the Tornado Cash people were conspiring with their users to launder money, how are the Monero or ZCash people not conspiring with their users to launder money? What's the required threshold of coordination or participation? In both cases, you're basically looking at somebody sticking some software out there and letting other people use it.
It's possible that Tornado had more active participation in specific incidents, but if so, what aspects of that participation matter? If it's a matter of hosting the UI, well, many the Monero and ZCash developers probably also run nodes, so they're actively operating systems that are accepting and relaying obscured transactions, with no attempt to filter out illegal ones. And they can't exactly claim they're ignorant about that.
I'm not claiming Tornado Cash is or was not a conspiracy, but if it is, then it seems hard to say that Monero or ZCash isn't.
By the way, as far as I know charging money doesn't matter, and I'd put about zero weight on allegations about "running relayers", since there aren't any recognizable "relayers" in the system anyway. The government has a strong interest in ignoring how it actually works, and in muddying any potential distinctions between the automated actions of the smart contracts and the intentional actions of the developers. They've issued actual sanctions forbidding "any interaction with" the smart contracts themselves, and if they let those distinctions become significant, they run the risk of having to explain how the smart contracts are "entities" within their authority to sanction.
IANAL, and maybe DannyBee can correct me if I'm mistaken, but I think the answer to this is "Maybe they do and just haven't been charged yet." If there are a lot of independent people doing the same crime, they're not all going to be charged simultaneously. Each requires a separate investigation. Someone's going to be the first in line.
If the developers are running for a UI that helps, or paying for a UI that helps, or paying to run services that help get the money out, then i would say they may be on the hook for charges.
These all have to be knowing, btw. If you just donate somewhere and they do something bad with it, not your issue. If you donate somewhere, knowing they will do something bad with it, that's different :)
You are correct that charging money or not doesn't really matter, it just gets used to show they profited from the illegal enterprise overall.
As for further lines, if all they did was write some Ethereum contracts and let them loose, I doubt someone would come after them. If they are making it easy by building UI/services around it, without any KYC/AML, and then the UI/services get used to launder money, then yes, they are likely on the hook.
I also doubt the government wants to start a case about interaction with smart contracts - it would be very muddy and possibly set bad precedent, at least right now. They would rather take cases like the one you see here, where someone did something more than make an ethereum contract, and the facts don't look great, and prosecute those.
Maybe sometime later if they win a bunch like this they will go after more complex cases around smart contracts, but you generally want to ease courts into this sort of thing if you want the best chances. It's not always possible, mind you.
If you look at early decisions in new fields where someone threw a really complex and hairy technology case at a court, the decisions are sometimes weird/strange. The courts do their best (and often hire special masters with expertise in the area and ....), but the legal system is a deliberately iterative one, and often takes iterations over years to get things to a stable point.
I also find it insane that they had investors (who somehow remain unnamed and uncharged???).
It’s possible to deploy a smart contract with no way to modify it, meaning it’s literally impossible to shutdown (without shutting down the entire network). This is rare, most dev teams retain admin keys and compose the smart contact components from additional layers of abstraction to allow for updates. But those admin keys typically also allow the possessor to abscond with all funds locked in the contracts (a rugpull).
My understanding is Tornado Cash eventually added a limited form of KYC to the frontend web UI. That’s simply a convenient interface to use the smart contract though, and it’s possible to interact with the smart contact directly (where there’s no KYC).
Security tools, encrypted messaging, jailbreaking tools, VPNs, file hosting tools, anonymity tools...etc.
The complaint itself cites 'writing instructions on how to use a VPN' as evidence that the developers were knowingly doing something criminal. A VPN!
You might hate crypto and believe that open source private money is different than open source private messaging. But that is not what the government's ability to jail these developers hinges on. Any argument prosecutors are making here could be made (and in many countries has been made) about any of the tools I list above. To cheer this on is to throw the past 40 years of legal advocacy around privacy, encryption, and anticensorship tools in the trash.
As far as I can tell these people created a business to profit off of money laundering, and they were helping teach people how to hide their identity.
Some people used their tool for money laundering, just as some people have surely used encrypted messaging and VPNs for theft, terrorism, child abuse, and other crimes.
The point is that online privacy always has significant legitimate, non-criminal use cases, and developers can have legitimate, non-criminal (noble, even) reasons for building for those use cases.
And the larger point is that, if we want to have tools that give us any meaningful online privacy, we must stand up for the developers that build such tools when they are (inevitably, perennially) accused of aiding criminals and terrorists.
But regardless of intentions, not following KYC/AML rules is illegal.
KYC/AML rules are of questionable legitimacy themselves, IMHO.
With less and less of society allowing to pay in anonymous currency (i.e. cold hard cash), either because it's dropped for "security" (i.e. shop owners don't want to pay for security to make sure the cash ain't stolen) or because of legal requirements (see e.g. Italy limiting cash transactions to 5.000€ in value, or Germany requiring a notification if you pay more than 10.000€ in value for a car), and many people moving to card payments due to convenience, there will be no way to escape the dragnet of governmental and private surveillance as all bank accounts are identifiable per KYC/AML regulations and virtually all banks report all account holders to Equifax and the other credit bureaus so to find out where a person banks is only a subpoena or a hack away. Oh, and completely forget about hiding legal but still sensitive payments: sex work of all kinds, political engagement, everything becomes yet another line in a trove of data lakes.
And that doesn't even touch the subject of card processing fees. Mastercard and Visa are rent-seekers of the worst kind, and no one seems to be willing to break them up or cap their fees, with PayPal close behind. Instead, everyone looks away when they cave to Evangelical pressure campaigns and drop sex workers left and right.
KYC/AML regulations deserve to be torn apart, and the people deserve privacy in their lives. Or, alternatively, we should force elected officials to open up their bank accounts to the public. If we can't have privacy, they certainly don't deserve it either.
But that's not what the law is, and law enforcement agencies as well as the court system only deal with what the law actually is.
You can (and should!) agitate and work towards changing the law to be more in line with what you think is right. That's the sort of change that is entirely possible in our system. But until then, the law is what the law is.
Making a crowbar isn't illegal. Buying a crowbar isn't illegal. Emailing your buddy and talking about how you're going to bust up a person and their shop because they aren't paying you protection money, then making or buying the crowbars? That could be evidence of an overt act in furtherance of a criminal conspiracy.
> And the only thing I would add is a few other scenarios. The third scenario: A person says to themselves "I'm going to go out and buy a crowbar to [...]" and then I go out and buy a crowbar. Still not a crime because there's no conspiracy, i.e. an agreement with another person.
> [...] And then there's the fourth scenario: A person says to themselves "I'm going to go out and buy a crowbar to [...]", buys the crowbar, and and then actually starts hitting people [...] Now there's still no conspiracy, but you've taken a substantial step towards the crime and and likely completed the crime and you're guilty of the initial crime.
See page 24
Not "they created a tool and it got misused" but instead "these specific criminally sanctioned folks are using our tool to launder 600 million dollars, and we know, should we do something about that?"
Their messages back up that they know it was being used in a specific instance, by criminals, to launder money, and they did nothing.
Sorry, no sympathy. I'm with you that we need to ensure tools are available, and i'm even okay arguing about KYC/etc.
But when you have specific, actual, knowledge that a criminal actor is using your tool to launder money, and you do nothing, sorry, that's just aiding and abetting.
If you create parts for a bomb and hand them to someone else, knowing they are likely to use it as a bomb, and they in fact do, you are as guilty of conspiracy as the actual bomber.
Your crime was complete when you gave them the parts, which is an overt act (some act in furtherance of the conspiracy).
(Unlike the typical gun analogies that get brought up in response, i'm choosing something that does not have a legitimate purpose and is in fact illegal to create as-is)
If you create a thing in the US that is required to comply with KYC/AML and don't, and someone users it to launder, and you know they use it to launder, you are still guilty even if you couldn't stop them from using it.
Again, your crime is complete at the point you complete an overt act .
You have to withdraw from the conspiracy before then.
Here, the government is charging them for the website, mainly, not the smart contracts
I’m a privacy advocate, who thinks kyc laws have gone too far. But if you knowingly break a law you can’t cite the unjustness of that law unless you are engaged in an act of civil disobedience. Profits will suffer is not civil disobedience.
Will you support the UK if they ask for the extradition of Signal developers, on the basis that say Signal will continue to have UK users accessing their service?
Where are your values?
You can - by not being inside the US, doing proper KYC and rejecting US customers.
Looking forward to doing KYC on my Signal account then.
They're being charged with operating a service. Which they may very well have done. It sounds like they were at least running the front end user interface stuff, and that might be enough.
But what makes it interesting is that the real core parts of the whole system were (and still are) autonomous. Those contracts could (and still can) be used without them doing anything at all. So they were not operating those. And it's not so obvious that there is any settled law that applies to those core contracts.
Do you have a link and paragraph number for this quote? I searched in the press release [0] and OCR'd the indictment [1] and can't find any match to any part of that quote ("VPN", "writing", or "instructions"). I also can't find any match for that quote anywhere on Google.
[0] https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-c...
As if the modus oparendi of sketchy crypto sites wasn't shouting off the rooftops "You can't use this site cause we detected a US IP we don't do business with US citizens. BTW, here's how to use a VPN!"
Crypto wants to be taken serious as a financial tool. Okay, fine. This also means you have to follow the same rule as anyone else.
Don't like these rules? Fine, you're allowed to – we have a democratic process for changing that so go vote, lobby, etc. Remember the 2008 banking crisis? There are reasons these regulations exist.
Banks get fined for these types of things all the time too: https://duckduckgo.com/?t=ffab&q=bank+fined+money+laundering... – crypto isn't being singled out here.
If you knowingly ignore the laws for personal profit you can expect consequences like this. Cryptopeople want to live in some sort of magical fantasy world where they both want to interact with real money and the financial markets when it suits them, but also pretend specific laws and rules for it don't apply to them when they're inconvenient. All while they're lining their pockets of course. Maybe this world has unicorns and dragons and teletubbies too.
Since TC is still running with both guys in jail, they clearly weren't "running it" - but the Ethereum node operators are. Should they be arrested? Are you answering this question as a laywer, or as citizen engaged in the democratic process telling me what you feel the law should be?
Ethereum is a protocol and a tool, which Tornado used it to knowingly profit from illegal transactions. Ethereum is somewhat akin (not identical) to USD, and Tornado somewhat akin to a bank operating with USD outside of the law.
I was unaware I need to get a university law degree before commenting here.
Many people are arguing that Ethereum node operators should be on the hook when they facilitate Tornado Cash transactions through their participation on the network. I'm glad we can count on your support should such arguments ever be pursued legally. Thank you.
"How to become an Arms Trafficker
Become an Arms-Trafficker in one easy step with this great way to register your protest of ITAR by Vince Cate. Just click to submit the form and join in the protest. Lots of excellent links. Have you exported RSA today? Includes an option to email a protest letter to US president." [0]
So? All that means is that there were people who thought that was a just fight and don't think that this is a just fight.
> God forbid people break the law to protest bad laws.
That's a legitimate form of protest and I won't condemn it. But when you break a law out of protest, you are still subject to arrest and prosecution for doing that. And often, that's the result you actively want because it brings attention to your cause and gives you a platform to argue the injustice in court.
That said, it doesn't look to me like the accused here were engaging in civil disobedience. It looks like they were pursuing profit.
Tornado Cash devs blocked known OFAC sanctioned addresses or associated addresses from interacting with the service yet they are still being put on the hook for people hiding their identity to attempt to bypass those sanctions.
Put another way: it's still a crime to kick puppies, even if you only indirectly kick puppies through your newly-invented fully-automatic Puppy Kicker 3000.
Edit: to refine the analogy: it doesn't stop being a Puppy Kicker 3000 just because you add a screening phase that eliminates puppies designated by the American Kennel Club.
Take a million dollars and buy something with it. Even just depositing 10k in a bank account gets reported to the feds, and possibly investigated (And using lower amounts is illegal under structuring.)
That's setting aside the instances of civil asset forfeiture where money is seized because driving with large amounts of cash is assumed to be the product of a crime.
So yeah, whether it's a good policy or not, it definitely seems to be the view.
Should the original developers face additional charges for that?
What if the original developers only published the contracts but never deployed them on Ethereum, leaving that up to someone else to do? Is it the author or the deployer or the user who is liable?
I mean, someone has to be liable if it didn't exist before and then it did, but if it's the author and not the deployer, you could be charged for code you wrote entirely offline and published to GitHub (if someone else later deploys it and it sees use).
The answer to all of your questions is the same. When you run this code to facilitate money laundering the deployer gets in trouble and that's how it should be I can't imagine how else it could work.
The code is absolutely free speech, the application of it is not. I can sell you a book that says how to circumvent financial controls, I can even give a talk about circumventing financial controls, what I can't do is fly to North Korea to talk about it.
The people charged are the subset of the Tornado Cash devs who ran the service, not for solely developing some code.
In this case, there actually are safe harbor laws in place that protect banks from being prosecuted in exactly this way as long as they correctly implement KYC/AML protocols. Tornado didn't feel they wanted to do this, so quite deliberately and publicly flaunted the law that would have protected them. And this is what happens.
What's the "precedent" being set exactly here? Follow the law like your competitors do and you won't get fingered as an accomplice?
Freedom of speech in the US is not, and never has been, absolute. There is all sorts of speech that is illegal to engage in.
> That is a serious question, how come he was able to get away?
He was absolutely investigated for ITAR violations, but the government elected not to press charges in the end. I forget why they made that decision, but I think it was a combination of the book being published only in the US at the time (which was undeniably legal) plus the huge amount of pressure -- especially public ridicule -- from the hacker community about the ridiculousness of the ITAR regulations.
If they had just written some software and told people how to operate it anonymously, they could not be prosecuted under these laws.
> Tornado Cash operated without know-your-customer (KYC) or anti-money laundering (AML) programs as required by US law, the document alleges. It also did not register with FinCEN as a money-transmitting business, the indictment says. Semenov and Storm also created a document called “Tips to Remain Anonymous,” which advised customers to consider using Tor or a VPN, delete data from their web browsers, and leave their money in Tornado for longer periods of time to better anonymize their transactions. They also advised users to employ different IP addresses for deposit and withdrawal.
As a bonus, the investors wouldn't fund a compliant version:
> Storm suggested creating a version of Tornado with KYC / AML enabled, but Tornado’s unnamed venture capital investors were dismissive, saying, “I just don’t know if anyone will actually want this.” The investor added, “It would be unlikely as a fund that we’d use a ‘compliant mixer.’”
I'd say these investors are as complicit in whatever conspiracy the devs are being charged with as well.
For some reason too much time spent working with machines clouds the judgement of how law and the court work.
Let me fix that for you …
Storm and Semenov in fact knew that they were helping criminals conceal the fruits of their crimes.”
Good news! It's not.
It's legally not, though. That may be the fundamental disconnect in the two viewpoints here.
And they’re building, and they’ll keep building, and a more open financial system will be built.
It might take decades but it will happen.
But hey, by now it's obvious totalitarianism is coming back and is probably here to stay.