The US government has sanctioned open source software Tornado Cash and added it to its list of individuals and entities accused of violating rules. The crypto industry is watching all of this and many people are having doubts about what happened.
In addition, a doubt arose that may echo for a long time to come. How is it possible to ban an open source software project?
Let's understand how Tornado Cash works and what led the government to sanction the platform.
How Tornado Cash works
Simply put, Tornado Cash helps keep cryptocurrency transactions private by scrambling tokens. It helps to hide the origins and destinations of cryptocurrency transactions and make them more difficult to trace by mixing funds, allowing complete privacy.
The protocol is powered by pools of funds that mix user assets, along with a Zero Knowledge engine, to hide deposit and withdrawal information.
It works like this: users send funds to a smart contract, which mixes the funds and then makes it possible for them to be transferred from another address. Simply put, you can deposit your funds (ETH or other tokens) in a large pool and give any other address the permission to claim those funds.
Example 1: You can deposit 10 ETH from address A and withdraw those 10 ETH with address B, C or D without anyone knowing that the 10 ETH came from address A.
Example 2: Suppose “Alice.eth” wants to send 50 ETH to a new address, but doesn't want anyone else to know that the new address is hers. She can deposit 50 ETH into a Tornado pool using her main wallet and then designate a new address to claim that 50 ETH at another time. She will then be able to withdraw the 50 ETH without any link to her.
This happens thousands of times in Tornado pools, which hold hundreds of millions in assets.
Utility of Tornado Cash
Contrary to popular belief, few cryptocurrency transactions are private.
Public blockchains keep a record of all transactions. While cryptocurrency wallets or alphanumeric addresses where funds are sent to are pseudonyms, the people behind them can be identified.
Companies like Chainalysis and Elliptic have created entire business models, pulling back the curtain and tracking cryptocurrency transactions.
They do things like identify, categorize and track addresses in real time, using modeling and visual representations to track changes in a blockchain and identify behaviors. In other words, they follow the money.
Chainalysis, for example, a blockchain analytics firm that has done multimillion-dollar deals with the US military and law enforcement, estimated that 18% of the funds received by Tornado Cash were from sanctioned entities.
Therefore, Tornado Cash makes sense for users who do not want to fully expose their movements.
According to Dune Analytics, a blockchain analytics platform, there were 12,243 unique user deposits on Tornado Cash and $7,665,625,855 in deposits.
The sanction
On August 9, 2022, the U.S. Treasury Department added the Tornado Cash protocol to the SDN sanctions list (Specially Designated Nationals and Blocked Persons List), for allegedly facilitating millions of dollars worth of cryptocurrency transactions for the North Korean government. with the involvement of hackers.
The Department has accused Tornado Cash of being used to launder more than $7 billion since its inception in 2019. This includes more than $455 million stolen by the Lazarus Group, a North Korean hacking group sponsored by the Korean government. The Treasury Department also justified its decision by arguing that the Tornado was used for money laundering, including the recent $625 million hack in March of Axie Infinity's Ronin Network by hackers. To make matters even more complex, the Dutch government agency responsible for investigating financial crimes said it had arrested a 29-year-old suspected of being a Tornado Cash developer.
While the direct implications of US sanctions are enormous, prohibiting individuals and entities from interacting or transacting with the privacy tool, externalities can have a major impact on individuals not involved in illegal activities.
The externalities of these sanctions have already shaken web3, forcing large institutions such as the Github repository, Infura eAlchemy (both centralized API and node infrastructure providers) and USDC provider Circle to delete or freeze any assets associated with sanctioned members and putting everyone who interacted with the Tornado at legal risk. In addition, Dutch authorities announced that they had arrested a 29-year-old man on suspicion of involvement in the concealment of criminal financial flows and for facilitating money laundering through Tornado Cash. Authorities said further arrests cannot be ruled out.
The sanctions also required all major financial institutions with exposure to Tornado to take steps to immediately freeze assets interacting with Tornado Cash. Circle, the company that controls USDC, froze more than 75,000 USDC in Tornado pools, blacklisting sanctioned addresses. This means that whoever deposited USDC can no longer withdraw their funds.
Not only has this led to fears that Circle will freeze all USDC that were previously in Tornado, but it has also opened up debates about how truly decentralized a stablecoin is, as it can be frozen.
Microsoft-owned public code repository Github deleted the accounts and repositories of top Tornado developers.
Even users who contributed small pieces of code years ago were given a warning that unless they fill out financial disclosures, their accounts will also be deleted.
The crux of the problem
Tornado Cash is not a company. It is an open source software project based on Ethereum, maintained by people and servers around the world.
The US action raises a number of questions about whether any government can effectively sanction open source code rather than individuals, and what widespread effects this could have not just for future open source projects, but for anyone who has used it. the Tornado Cash.
The sanction requires that no individual or organization can transact with the Tornado or do business with any address that has used the Tornado to receive or deposit funds - no matter the size.
Not only does this sanction challenge the strength of our decentralized systems or question a developer's responsibility towards open source code, but it opens up the argument whether the government can sanction a smart contract, which is an independent piece of code.
This censorship and how it has been applied since then opened up new questions about freedom of expression and the right to privacy:
- Can the government censor code and its ability to interact with software whose purpose is neither good nor bad?
- Is a developer responsible for the open source code he writes after it is released?
- How do you sanction a smart contract that has no owner and can't actually be terminated?
- Does want privacy make you a criminal?
This is uncharted territory for regulators, web3 legal experts and the internet in general. The law never imagined a technology that was immutable and owned by no one.
Wanting to remain anonymous should not be synonymous with hiding criminal activities. While it has its downsides, privacy has allowed people to spread truth and justice across the world and allowed permissionless innovation in every industry.
The decisions that regulators and courts make now will greatly influence how Americans live online and how the brightest minds of our generation build the tools of the future.
Tornado Cash itself is neither good nor bad. It is just a tool that allows privacy in financial transactions. Setting the precedent that individual developers are responsible for the actions of others using open source software is dangerous. This stifles innovation, leaving creators fearful of what might happen if they push the envelope or invent something new.
This sanction is a watershed moment for web3 and open source technology. It calls into question our freedom of expression and the right to privacy in the digital age. Legal battles and established precedents will be very important for the future of decentralized technology.