A crypto mixer is not a bank or a wallet. It is a set of smart contracts that breaks the link between the address that sends a deposit and the address that receives a withdrawal, so the sender and receiver are not the same person.
Every deposit and withdrawal is a public transaction, so crypto mixers work by breaking the transaction graph rather than hiding the transactions themselves. That is why a crypto mixing service attracts both privacy-conscious users and illicit actors, and why the risks land on the sender.
Key Takeaways
-
Tornado Cash is a crypto mixer on Ethereum. It accepts fixed-size deposits and pays out to unrelated wallet addresses in separate transactions, using zero-knowledge proofs so a withdrawal cannot be tied to a deposit in a single transaction.
-
OFAC sanctioned Tornado Cash in August 2022, redesignated it in November 2022, and delisted it on March 21, 2025. The Fifth Circuit had ruled in November 2024 that the immutable smart contracts were not "property" that economic sanctions could block.
-
Delisting ended the sanctions exposure of the contracts, not the criminal charges. Alexey Pertsev was convicted in the Netherlands in 2024 and is appealing; Roman Storm was convicted on one count in August 2025, and a retrial on two deadlocked counts is scheduled for April 26, 2027.
-
The contracts do not screen deposits. Compliance sits at the edges: relayers, front ends, bridges, exchanges, and the analytics tools that score the transactions before an exchange accepts them.
-
In 2026, stolen funds still use the mixer. Roughly 44,510 ETH from the Drift exploit, worth about USD 109 million, entered Tornado Cash in October 2026.
What Is Tornado Cash?
Blockchains are pseudonymous, not anonymous: all cryptocurrency transactions are public on a blockchain, and one exchange withdrawal can attach a name to a wallet and its transaction history. That exposure is the reason financial privacy tools exist.
Tornado Cash softens it through crypto mixing. Deposits from multiple users go into one shared mixing pool, and withdrawals leave from different wallet addresses. Crypto mixing hides the link among identical amounts, though not the withdrawal address. Launched in 2019, the crypto mixing service became the largest privacy protocol on Ethereum and later expanded to BNB Smart Chain, Polygon, and the Nova pool.
Unlike privacy coins such as Monero and Zcash, which hide details at the base layer, Tornado Cash is a cryptocurrency application on a transparent blockchain like bitcoin: the deposit and withdrawal stay visible even when the link does not.
What Is a Coin Mixer?
A coin mixer, or crypto mixer, aggregates crypto deposits from multiple users and returns equivalent funds to fresh wallet addresses. In a crypto mixer, the mixing process breaks the direct link: one person can send money to one receiver, or many senders can pay funds into a shared pool and withdraw in separate transactions, so the sender and the receiver are not the same person, and no observer sees both ends. Tornado Cash turned the mixer into a trustless service, with no operator holding the funds and a cryptographic proof replacing a promise.
A centralized crypto mixer relies on an operator that shuffles transactions. The mixer is autonomous code, a set of smart contracts, so sanctions against it raised a legal question that sanctions against a company do not. Bitcoin tumblers and Wasabi Wallet's CoinJoin are earlier designs: a bitcoin tumbler mixes bitcoin and other coins through a service; the mixed bitcoin coins lose their history once traced paths break, and Wasabi Wallet coordinates CoinJoin between bitcoin users who use it without custody.
How Tornado Cash Works
To see how crypto mixers work, start with the proof system. Tornado Cash works with ZK-SNARKs, and a zero-knowledge proof lets a user prove a statement is true, here: a valid deposit exists, without revealing which one. The proof reveals nothing about the depositor.
-
Deposit. To deposit crypto, the user generates a random secret and a commitment derived from it, then deposits a fixed amount, such as 0.1, 1, 10, or 100 ETH, into the matching pool contract. The contract stores the commitment. Deposits are public transactions, but the secret is not.
-
Wait. An immediate withdrawal is easy to correlate with a deposit, so time and crypto mixing matter.
-
Withdraw. The user submits a proof that a valid commitment exists and a nullifier that prevents the same deposit from being spent twice. The contract sends the fixed amount in a fresh transaction. The proof shows membership in the shared pool without naming the sender.
-
Relay. In the withdrawal process, a relayer can submit the transaction and pay the gas, so the new address does not need ETH first. The relayer takes a service fee, one of the few visible links left in the process.
Figure: Tornado Cash deposit interface (2022 archive)
Figure: Tornado Cash withdrawal interface (2022 archive)
The anonymity set is every deposit in the same pool at the same denomination, and mixing improves with size. A larger pool and a longer wait make the mixing harder to break; analysis rarely breaks the proof and instead follows timing, gas payment, and transaction history that can still be traced across the blockchain. Users who withdraw to a fresh wallet address in a later transaction weaken mixing.
Governance Token TORN
Tornado Cash launched the TORN governance token in January 2021 with a total supply of 10 million. The token gave holders a voice in protocol parameters and treasury decisions, and the initial distribution became one of the most discussed airdrops of that cycle.
| Allocation |
Share |
Amount |
Terms |
| Early Ethereum pool users |
5% |
500,000 TORN |
Airdropped |
| Anonymous mining rewards |
10% |
1,000,000 TORN |
Released linearly over one year |
| DAO treasury |
55% |
5,500,000 TORN |
Linear unlock over five years, three-month lock |
| Developers and early supporters |
30% |
3,000,000 TORN |
Linear unlock over three years, one-year lock |
TORN holders could change a parameter, but they could not delete the smart contracts or stop users from calling them, and a malicious proposal in August 2022 briefly gave an attacker voting power.
Technology Cannot Distinguish Between Good and Evil
A mixer does not ask why someone wants privacy. The same shared mixing pool can hold a salary payment, a political donation, and stolen cryptocurrency, and the technology cannot tell them apart. That indifference is the design, and it is also the legal problem.
Figure: Contract transaction list, 2022 archive (etherscan.io)
Treasury's August 2022 designation said the service had laundered more than USD 7 billion in cryptocurrency since 2019, including funds tied to North Korean state actors, and that it had no effective controls against illicit actors. The figure is contested, but a crypto mixer that cannot screen users is either privacy infrastructure or a laundering venue.
Privacy advocates answer that a crypto privacy tool is infrastructure, not a co-conspirator, and that the same logic would reach encryption and cash. Courts have started to draw that line, but narrowly.
The Story of Tornado Cash Sanctions
On August 8, 2022, the Biden administration's Treasury Department added Tornado Cash to the SDN list, the first time economic sanctions targeted autonomous code rather than a person or a company. Treasury's Office of Foreign Assets Control said the crypto mixer had been used to benefit malicious cyber actors, including North Korean groups, and to launder stolen crypto. The Tornado Cash sanctions were now U.S. policy, and US citizens were barred from the contracts.
OFAC redesignated it on November 8, 2022, months after the August listing, under cyber and North Korea authorities, after the first action ran into procedural objections. Front ends disappeared, the developer repository was taken down, and one contributor was arrested in the Netherlands. The two co-founders, Roman Semenov and Roman Storm, were designated as well.
After the Ban Was Introduced
Dutch authorities arrested developer Alexey Pertsev in Amsterdam on August 12, 2022. In May 2024, a Dutch court convicted him of money laundering and sentenced him to 64 months in prison. He was released from pretrial detention in February 2025 under electronic monitoring while he prepared an appeal, which was still pending in 2026.
The U.S. case moved on a separate track. Roman Storm, a co-founder, was charged in 2023. In August 2025, a Manhattan jury convicted him of conspiracy to operate an unlicensed money transmitting business. The jury deadlocked on conspiracy to commit money laundering and conspiracy to violate sanctions, and the judge set a retrial on those two counts for April 26, 2027. The charge treats developers as money transmitters, a rare move in a criminal case of this kind.
Source: dune.com (2022 archive)
The Community's "Poison" Counterattack
Starting in August 2022, anonymous users sent small amounts of ETH that had passed through Tornado Cash to public figures' wallets. The August "poison" idea was to taint those addresses for any protocol or exchange that screened for Tornado Cash exposure.
Source: 0xjim.eth (2022 archive)
The stunt showed address-based compliance can be gamed by a stranger sending a few dollars, pushing teams toward risk scoring rather than a blocklist.
What Changed After OFAC Delisted Tornado Cash
The legal foundation cracked in November 2024. In Van Loon v. Department of the Treasury, the Fifth Circuit held that immutable smart contracts are not "property" that can be blocked under the International Emergency Economic Powers Act, because no foreign person or entity owns them. The court sent the case back to the district court.
On March 21, 2025, OFAC removed Tornado Cash from the SDN list, restoring access for US citizens, allowing users to withdraw again, while stating that OFAC's action left the underlying conduct and criminal charges unaffected. The delisting removed the sanctions exposure of the contracts, not the liability of people. A person in the United States can still face criminal exposure if transactions involve stolen or sanctioned funds, and financial institutions can refuse a withdrawal that fails AML requirements.
Did Usage Come Back?
Partly, and not as headline numbers suggest. A seven-year on-chain audit by Bitquery counted about USD 7.3 billion in deposit transactions and USD 7.2 billion in withdrawals, dominated by 1 ETH and 10 ETH pools. Clustering and direct exposure to hacks are better signals than volume.
Large users have alternatives. Railgun, a crypto privacy system, screens deposits and supports private swaps and lending. Chainalysis also reported that some North Korean operatives shifted toward mixers such as YoMix as the service became harder to use.
The Developers Are Still on Trial
Storm's August 2025 conviction was a partial win for both sides: the jury accepted one charge and deadlocked on the two carrying the longest sentences. Days later, a senior Justice Department official said prosecutors would no longer approve unlicensed money-transmitting charges where such crypto software is decentralized and non-custodial. The retrial was adjourned to April 26, 2027.
Pertsev's Dutch appeal is still pending. His case asks whether a developer who publishes code can be criminally liable for how strangers use it; Storm's case asks what he operated if he could not pause, edit, or block the contracts.
The Drift Exploit: Why Mixers Still Matter
The clearest case arrived in 2026. On April 1, Drift Protocol, a Solana perpetual futures exchange, lost roughly USD 285 million. The attacker did not break the code: it spent weeks building trust, then used durable nonces to obtain pre-signed transactions from security council members and executed them later to take control.
The failure was operational, not cryptographic. The attacker created a fake token contract, manufactured its price, deposited it as collateral, and drained the vaults in a series of transactions. Chainalysis and Elliptic traced the exit; Elliptic called the pattern consistent with a North Korean operation. The stolen cryptocurrency assets were swapped into USDC, bridged to the Ethereum blockchain, and converted into ETH.
Then Tornado Cash reappeared. CoinDesk reported that addresses receiving the bridged cryptocurrency had been pre-funded through the mixer, making the withdrawal hard to cluster or be traced. By October 2026, the exploiter had sent about 44,510 ETH worth roughly USD 109 million into the mixer over two days, according to Crypto Briefing, while still holding about 56,569 ETH.
What the Drift Case Shows
The mixer sits downstream of the security failure: Drift lost funds to key management and blind signing, and the crypto mixer only changed what happened afterwards. Delisting changed the legal map, not the technical one. The mixer cannot refuse a deposit, so screening happens at bridges, relayers, and exchanges. Analysts monitor closely any wallet that touches the pool, and the venues that cash out the funds carry the practical risk controls.
Decentralization and Crypto Regulation
Tornado Cash sits at the intersection of four questions: can a stablecoin issuer freeze a payment, can a blockchain censor crypto transactions, can a developer be liable for a user's conduct, and can a government pressure validators? Each answer is contested, and the crypto industry has no rulebook.
Centralization of Stablecoins Roils the Community
The August 2022 freeze response exposed a structural weakness in DeFi. Circle froze USDC at addresses linked to Tornado Cash, while Tether declined to follow automatically. Stablecoins settle much of DeFi lending and collateral, so freezing a pool balance can stop it even when the code is decentralized. Regulators remain deeply concerned that dollar tokens give a few companies a control point over digital assets and crypto assets.
Source: Twitter@Jerallaire (2022 archive)
A crypto mixer can hide an on-chain link, but not the moment funds meet an exchange.
Will Ethereum Be Controlled?
Ethereum's move to proof of stake in September 2022 raised a related question: could validators and builders be pressured to exclude crypto transactions tied to Tornado Cash? Some relays did for a period, but non-censoring relays gained share and transactions were included again. The Ethereum blockchain has no single switch, but block production has a policy layer that government pressure can reach.
Source: dune.com (2022 archive)
Does a Decentralized Utopia Really Exist?
Full decentralization is rarer than the label implies. The contracts may be immutable, but the front end is a website, the relayers are businesses, the developers have passports, and the token has identifiable holders. Code can be permissionless while its authors are not.
Decentralization is a spectrum: capture resistance depends on who controls upgrades, front ends, liquidity, and fiat on-ramps. Tornado Cash removed one chokepoint, the operator, and left several others.
Summary
Tornado Cash is a crypto mixer that pools fixed-size deposits and lets users withdraw to new addresses with zero-knowledge proofs. It was the largest privacy protocol on Ethereum, it was sanctioned in August 2022, and it was delisted in March 2025 after a federal appeals court ruled that its immutable contracts were not sanctionable property.
Delisting did not settle the conflict. The contracts still cannot screen deposits, developers are still fighting criminal charges, and stolen funds still use the mixer. The Drift exploit made that visible: a USD 285 million loss and thousands of transactions moving tens of thousands of ETH into Tornado Cash months after sanctions were lifted.
Privacy and compliance are separate layers. A crypto mixer can obscure an on-chain cryptocurrency link, but it cannot make a withdrawal acceptable to an exchange or a stablecoin issuer. Mixing risks remain for people who use it, and the next chapter will be written in courtrooms, not only on-chain.
FAQ
Is Tornado Cash still sanctioned?
No. OFAC removed it from the SDN list on March 21, 2025, after the Fifth Circuit ruled that its immutable smart contracts were not sanctionable property. Delisting ended the blocking action but did not legalize every use.
What is a crypto mixer?
A crypto mixer is a service that pools crypto deposits from many users and pays withdrawals to different wallet addresses, so the sender and receiver are not linked by a single transaction. Tornado Cash is the best-known crypto mixer, and it carries legal risks.
Is Tornado Cash legal to use?
It depends on who you are and where the funds came from. Contract sanctions were lifted, but money-laundering and sanctions laws still apply if you use the pools. A withdrawal an exchange links to a hack can be frozen, so treat any use of the service as high-risk infrastructure with real legal risks for people who use it.
What happened to the Tornado Cash developers?
Pertsev was convicted of money laundering in the Netherlands in May 2024 and sentenced to 64 months; he was released in February 2025 to prepare an appeal, still pending in 2026. Storm was convicted in New York in August 2025 of one count; a retrial on the deadlocked counts is set for April 26, 2027.
Can Tornado Cash be shut down?
Not in the way a company can be shut down. The core contracts are immutable and have no admin key, so no owner has the ability to pause them. Access narrows by taking down front ends, pressuring relayers, or blocking transactions, but the code remains callable.
