Tornado Cash Explained From Cryptography to Court Rulings

Tornado Cash is a set of open-source, non-custodial smart contracts that let a user deposit a fixed amount of cryptocurrency into a shared pool and later withdraw the same amount to a different address, with no public link between the deposit and the withdrawal. It runs on Ethereum and on several other EVM-compatible networks. What separates Tornado Cash from an ordinary mixing service is that no operator ever holds the funds and no operator ever learns which deposit belongs to which withdrawal.

The mechanism is a zero-knowledge proof. Each deposit into a Tornado Cash pool inserts a cryptographic commitment into a Merkle tree stored inside the contract. Each withdrawal submits a proof that the sender knows the secret behind one of the commitments in that tree, without revealing which one. Because the contract verifies mathematics and nothing else, a withdrawal from a Tornado Cash pool looks, from the chain's point of view, exactly like a withdrawal by any other depositor in the same pool.

Tornado Cash was deployed in 2019 and is publicly associated with the developers Roman Storm, Roman Semenov, and Alexey Pertsev. In May 2020 the administrative keys to the Ether pools were destroyed. From that point on the deployed Tornado Cash contracts could not be paused, upgraded, or emptied by anyone, including the people who wrote them.

That one design decision is why Tornado Cash became a legal landmark rather than just another privacy tool. In August 2022 the U.S. Treasury's Office of Foreign Assets Control added Tornado Cash contract addresses to its sanctions list. In November 2024 a federal appeals court held that immutable smart contracts are not property that can be blocked under the statute the government relied on. In March 2025 Treasury removed the addresses. Criminal prosecutions of individual developers ran on a separate track and produced separate outcomes.

This page covers both halves. The first sections describe how Tornado Cash actually works, from commitments and nullifiers through relayers and anonymity sets. The later sections set out the regulatory and criminal record with dates attached, because most public confusion about Tornado Cash comes from treating the protocol and the prosecutions as if they were the same thing.

The proving system behind Tornado Cash is Groth16, a succinct non-interactive argument that produces very small proofs and verifies them cheaply on-chain. The circuits are written in Circom, and the proof is generated in the user's browser or local client, never on a server. If you want a general primer on the underlying idea, the Wikipedia entry on zero-knowledge proofs is a reasonable starting point.

The withdrawal circuit used by Tornado Cash asserts a short list of statements at once: that the prover knows a nullifier and a secret, that their Pedersen hash is a leaf in a tree whose root matches the public input, and that the published nullifier hash is derived from that same nullifier. Everything else in the transaction is dragged into the proof as a constraint purely so that it cannot be tampered with.

Groth16 requires a structured reference string produced in advance, which is the well-known trusted setup problem. Tornado Cash addressed it with a multi-party ceremony in 2020 in which more than a thousand contributors each added randomness and then discarded it. The construction is secure as long as at least one participant honestly destroyed their share.

It is worth being precise about what a compromised setup would mean. An attacker holding the discarded randomness could forge withdrawal proofs and drain a pool. They could not retroactively deanonymize past Tornado Cash users, because privacy comes from the fact that the contract never receives the linking data in the first place, not from the soundness of the proof.

The hash choices follow from the same economics. Standard hashes such as SHA-256 are expensive to express as arithmetic constraints, so Tornado Cash uses Pedersen hashing for commitments and MiMC for the Merkle tree. Both are algebraically friendly to the proving field, which keeps proof generation fast enough to run on a laptop.

There is an obvious hole in the design as described so far. A withdrawal is an ordinary Ethereum transaction and someone has to pay gas for it. If the fresh recipient address pays its own gas, it needs Ether from somewhere, and funding it from the depositor's old address reconnects the two ends immediately.

Relayers solve this. A relayer is a third party that submits the Tornado Cash withdrawal transaction, pays the gas, and takes a fee out of the withdrawn amount. Because the recipient, relayer, and fee are all committed inside the proof, the relayer cannot change the destination or inflate its cut. It is a paid courier with no discretion.

Governance later formalized this with a relayer registry, where operators stake TORN to be listed and a portion of their fees flows back to the protocol. The registry made relayer selection more legible to users, but it never made relaying exclusive. Anyone can still construct and broadcast a Tornado Cash withdrawal themselves.

Relayers do introduce a soft trust boundary. They see the withdrawal request before it is public, along with the recipient address and whatever network metadata the connection leaks. They cannot steal funds and they cannot see the note, but a careless connection to a logging relayer can undo the privacy that the rest of Tornado Cash provides.

The refund field exists for token pools. When someone withdraws a stablecoin to a brand-new address, that address has no Ether at all and cannot transact afterward. The refund lets the relayer forward a small amount of the native asset alongside the tokens so the recipient is not stranded.

Beyond Ethereum mainnet, Tornado Cash contracts were deployed on other EVM networks including BNB Chain, Polygon, Optimism, Arbitrum, Avalanche, and Gnosis Chain. Each deployment maintains its own pools and its own anonymity sets. A deposit on one chain has no cryptographic relationship to a withdrawal on another, which is why cross-chain comparisons of pool size are meaningless.

A second-generation design, Tornado Cash Nova, launched on Gnosis Chain in late 2021. Nova moved away from fixed denominations toward a shielded account model where balances can be split, merged, and transferred internally in arbitrary amounts, closer to a private UTXO ledger than to a mixer. It ran alongside the classic pools rather than replacing them.

Because every one of these deployments is a plain smart contract, the practical availability of Tornado Cash has always depended more on tooling than on the contracts themselves. The chain code kept running through the sanctions period without interruption. What changed was which interfaces, node providers, and wallets were willing to touch it.

The privacy of any Tornado Cash withdrawal is measured by its anonymity set: the number of deposits sitting in the same pool that the withdrawal could plausibly correspond to. If a pool holds four hundred unspent deposits, an observer's best guess about the origin of a withdrawal is one in four hundred, and no better.

This makes pool population the dominant variable. A busy Tornado Cash pool with thousands of deposits gives strong protection. A quiet pool with nine deposits gives almost none, and in the degenerate case where a pool holds exactly one deposit, the link is trivially obvious to anyone who bothers to look.

Timing is the second variable and the one users most often get wrong. Depositing and withdrawing within the same hour narrows the candidate set dramatically, because analysts can discard every deposit that was already spent or made long before. Waiting is free, and it is the single most effective thing a Tornado Cash user can do.

Amount patterns leak too. Depositing seven notes of 10 ETH and withdrawing seven notes of 10 ETH to seven fresh addresses that then consolidate into one wallet reconstructs the entire flow without breaking any cryptography. Chain analysis firms treat these round-trip signatures as routine work, and they are the main reason Tornado Cash usage is often traceable in practice despite being untraceable in theory.

The failure modes that recur in analyses of Tornado Cash usage are almost all behavioral rather than cryptographic:

• > withdrawing immediately after depositing
• > reusing the same recipient address across many notes
• > withdrawing to an address funded by the depositing address
• > depositing and withdrawing an unusual, distinctive quantity of notes
• > using a small or newly created pool
• > paying gas from a known exchange account at either end

The network layer sits outside the protocol entirely. IP addresses seen by an RPC endpoint or relayer, browser fingerprints, and wallet telemetry can all correlate a deposit with a withdrawal even when the on-chain data is perfectly clean. Tornado Cash makes no claim to defend against any of this.

It is worth restating the boundary plainly. Tornado Cash hides one specific relationship, the one between a deposit and a withdrawal of equal size in the same pool. Everything else about a transaction, including its timing, its size, its gas payer, and its downstream destination, remains fully public.

In May 2020 the team behind Tornado Cash performed what they described as a key-burning ceremony, removing the ability to modify or upgrade the Ether pool contracts. This was presented as a credibility step: users were being asked to lock funds in a contract, and the strongest guarantee available was to prove that nobody retained a lever to pull.

A governance layer arrived later in the form of TORN, a fixed-supply token distributed in part to early users and used to vote on proposals. The DAO built around it could fund development, manage the relayer registry, and adjust protocol-level parameters that sat outside the frozen core contracts.

The scope of that governance is narrower than the word suggests. TORN holders never had the power to freeze a Tornado Cash pool, censor a withdrawal, seize deposits, or reverse a transaction. The pools were already immutable when the DAO came into existence, which is exactly the fact the later litigation turned on.

In May 2023 an attacker demonstrated the limits of the governance layer by smuggling malicious logic into a proposal and seizing control of the governance contract, along with staked TORN and voting power. Control was subsequently restored through a further proposal. The core Tornado Cash pools were untouched throughout, since there was no mechanism by which governance could have reached them.

The user-facing interface has always been a separate concern from the contracts. It was published as a static site distributed over IPFS and could be downloaded and run locally. After the 2022 sanctions, code repositories and hosted front ends were taken down and several infrastructure providers blocked access, yet the deployed Tornado Cash contracts continued to accept deposits and honor withdrawals exactly as before.

Privacy that cannot be waived is a problem for anyone with legitimate funds. A user who withdraws from Tornado Cash and then tries to deposit at an exchange may be asked where the money came from, and pointing at an anonymous pool is not an answer that compliance departments accept.

To address this, Tornado Cash shipped a compliance tool that takes a user's note and generates a report tying a specific deposit transaction to a specific withdrawal transaction. Because only the note holder can produce it, the report acts as a voluntary, cryptographically grounded proof of origin that a user can hand to a bank, an exchange, or an auditor.

The limits are real. Disclosure is optional and one-directional, so nothing compels a bad actor to produce a report, and a recipient still has to decide whether to trust the counterparty presenting it. The compliance tool made Tornado Cash usable for people with ordinary privacy needs, but it was never a substitute for the kind of continuous monitoring that regulated intermediaries are expected to perform.

There is no audited public statistic for how much value has passed through Tornado Cash or what share of it was illicit. The most widely repeated numbers come from the U.S. Treasury's designation announcement of August 8, 2022, and they should be read as government allegations rather than as neutral measurements.

On August 8, 2022, the Office of Foreign Assets Control designated Tornado Cash under its cyber-related sanctions authority and added a long list of associated Ethereum addresses, including the pool contracts themselves, to the Specially Designated Nationals list. It was the first time a set of autonomous smart contracts, rather than a person or a company, had been placed on that list.

On November 8, 2022, OFAC revisited the action, delisting and immediately re-designating Tornado Cash on a broader basis that expressly cited support to North Korea. The practical effect on users was unchanged, but the second designation rested on an additional national-security authority.

The knock-on effects arrived within days. A stablecoin issuer froze tokens held at the sanctioned addresses, code repositories and developer accounts were taken offline, major node providers began blocking related requests, and some front ends started screening any wallet that had ever touched Tornado Cash. Someone then sent small unsolicited amounts from the pools to well-known public addresses, an act of dusting that briefly locked those users out of services that screened automatically.

Uncertainty about ordinary users was severe enough that OFAC issued guidance in September 2022 clarifying that U.S. persons whose funds were already sitting in Tornado Cash could apply for a specific license to withdraw them. Guidance also confirmed that merely interacting with the open-source code, as distinct from transacting with sanctioned addresses, was not itself prohibited.

Two legal challenges followed in September 2022, brought by users and advocacy organizations. The central argument was statutory rather than constitutional: the sanctions law lets the government block property in which a foreign national has an interest, and an immutable contract that nobody owns or controls does not fit that definition. A district court initially sided with Treasury.

In November 2024 the U.S. Court of Appeals for the Fifth Circuit reversed. It held that the immutable Tornado Cash smart contracts are not property under the relevant statute, because they cannot be owned, controlled, or contracted over, and concluded that OFAC had exceeded its authority in blocking them. The court was explicit that any expansion of the law to cover such code was a matter for Congress.

On March 21, 2025, Treasury removed Tornado Cash from the SDN list, delisting the associated addresses. The department framed the move in light of the litigation and the novel legal questions the case raised, while reiterating its concern about North Korean laundering activity.

Delisting is not a blanket clearance, and this is the point most often misread. Removing the addresses ended one specific prohibition. It did not legalize laundering proceeds through Tornado Cash, did not bind other jurisdictions, and did not stop exchanges and other intermediaries from applying their own risk policies to funds that have passed through the pools.

Dutch authorities arrested Alexey Pertsev, a developer associated with Tornado Cash, in August 2022, two days after the OFAC designation. In May 2024 a court in the Netherlands convicted him of money laundering and sentenced him to 64 months in prison, reasoning that the tool as built and operated served to conceal criminal proceeds.

Pertsev was released from custody in February 2025 under electronic monitoring while preparing his appeal. His case drew heavy attention from software developers because it was the first time a European court had convicted someone for writing and deploying privacy code rather than for handling funds directly.

In the United States, prosecutors unsealed an indictment in August 2023 charging Roman Storm and Roman Semenov, both connected to Tornado Cash, with conspiracy to commit money laundering, conspiracy to violate sanctions, and conspiracy to operate an unlicensed money transmitting business. Storm was arrested in Washington state; Semenov was not in custody and was separately added to the SDN list.

Storm's trial took place in a federal court in Manhattan in mid-2025. In August 2025 the jury convicted him on the single count of conspiring to operate an unlicensed money transmitting business and deadlocked on the money laundering and sanctions counts, and the judge declared a mistrial on those charges. The split verdict left the hardest questions about Tornado Cash unresolved.

These proceedings are why the delisting of Tornado Cash did not end the story for developers. The sanctions litigation asked whether unowned code can be blocked property; the prosecutions ask what obligations attach to the people who write, publish, promote, and profit from such code. Those are different questions, and the answers to date point in different directions.

Legal exposure

Legal treatment of Tornado Cash varies by jurisdiction and continues to move. The 2025 delisting removed a specific U.S. prohibition tied to the contract addresses, but nothing about it changes the law on laundering criminal proceeds, and other countries have taken their own positions. Anyone weighing the question should look at current local rules rather than at headlines from any single year.

Technical risk

Immutability cuts both ways. Because no one can modify the Tornado Cash pools, no one can patch them either. A latent bug in a verifier, a flaw in the trusted setup, or a mistake in a peripheral contract cannot be fixed after the fact, and there is no support desk, no insurance fund, and no rollback.

User error

The most common way people lose money with Tornado Cash is losing the note. It is the sole key to a deposit, and there is no derivation from a wallet seed and no recovery path. The most common way people lose privacy is withdrawing too quickly, to too few addresses, in too distinctive a pattern.

Downstream screening

Even where use is lawful, funds that have passed through Tornado Cash are frequently flagged by exchange compliance systems, and accounts can be frozen while the origin is reviewed. Screening policies are set by private firms and are stricter than the law in many cases, which is precisely the gap the compliance report was designed to fill.