Fifth Circuit Rejects OFAC Sanction of Tornado Cash Crypto Code

On Nov. 26, 2024, in what has been deemed a win for open-source technology, the U.S. Court of Appeals for the Fifth Circuit reversed the district court's ruling in Van Loon v. United States Dep't of the Treasury, holding that OFAC overstepped its authority under IEEPA when it sanctioned Tornado Cash in 2022.

Applying the U. S. Supreme Court's recent decision in Loper Bright v. Raimondo, which abolished the longstanding Chevron doctrine, the Fifth Circuit held that the district court erred in giving "heightened deference" to OFAC's definition of "property" and in finding that immutable smart contracts met that definition.

The court analyzed IEEPA's statutory text to determine that the "ordinary" or "plain meaning" of "property" is that "[it] is capable of being owned." The panel noted one of the most essential rights associated with "property" is "the right to exclude others." Citing to Tornado Cash's "trusted setup ceremony" where over 1,000 volunteers irrevocably removed the option for others to update, remove, or otherwise control the smart contracts' lines of code, the Fifth Circuit concluded that no one had the ability to "exclude" anyone - even the targeted North Korean wrongdoers - from using the smart contracts.

The Fifth Circuit highlighted that its inquiry under Loper Bright could have ended with the conclusion that the plain meaning of "property" in IEEPA does not support the sanctions designation, but it went a step further to conclude that the smart contracts would not be subject to sanction even under OFAC's own broad regulatory definition of "property," because the immutable smart contracts are not ownable, and they do not qualify as true "contracts" or "services" as those terms are used in the regulations.

Background

In August 2022, the OFAC sanctioned Tornado Cash, an open-source crypto-transaction software protocol that allows customers to obscure the original source of virtual currency transactions by mixing multiple transactions and then redistributing them. Citing the protocol's alleged role in laundering virtual currency for North Korean cyber criminals and others that threaten U.S. national security, OFAC added Tornado Cash to its list of Specially Designated National and Blocked Persons (SDN), prohibiting all U.S. persons from engaging with Tornado Cash, directly or indirectly, or dealing in "property" in which Tornado Cash has an interest.

OFAC, which generally interprets the definition and scope of "property" broadly, in this instance interpreted "property" to include open-source computer code known as "smart contracts." Smart contracts are computer programs stored on a blockchain network that do not require validators and automatically perform tasks - such as executing transactions and transferring cryptocurrency assets - when prompted by a user. A smart contract is considered "immutable" if it cannot be altered or removed from the blockchain.

Six Tornado Cash users sued OFAC in the Western District of Texas, claiming that Tornado Cash's inclusion on the SDN list exceeded OFAC's statutory authority under IEEPA. The district court granted summary judgment in OFAC's favor and the users appealed.

Takeaways

The panel's opinion reflects judicial reluctance to regulate emerging technologies by stretching a pre-internet-era statute to fit a contemporary framework, even where there may be persuasive policy reasons for doing so. The Fifth Circuit acknowledged the "real-world downsides" of certain uncontrollable technologies that would fall outside of OFAC's sanctioning authority and recognized that bad actors may take advantage of immutable "smart contracts" for malicious cyber activities. Ultimately, the court shifted the burden onto Congress to update potentially outdated legislation.

It remains to be seen whether Congress takes up the court's invitation to consider extending IEEPA to target modern technologies specifically created to prevent them from being controlled. It is also unclear how the executive branch may adapt its enforcement strategies to try to address the potential for criminal misuse of immutable smart contracts, especially by actors located outside the United States.