Victory for Tornado Cash as Court Rules Sanctions Were Unlawful

12/03/2024|6 minute read

Key Takeaways:

• OFAC exceeded its statutory authority by sanctioning Tornado Cash's immutable smart contracts because they are not "property" under the IEEPA.
• Tornado Cash immutable smart contracts are not "property" according to that term's plain meaning because property requires an element of ownership, and the Tornado Cash immutable smart contracts are incapable of being owned.
• Tornado Cash immutable smart contracts likewise cannot constitute "property" under OFAC's regulatory definition of the term because an immutable smart contract is neither a contract nor a service.

On November 26, 2024, in a three-judge panel decision, Van Loon v. U.S. Department of the Treasury, the United States Court of Appeals for the Fifth Circuit (Court) reversed a Texas district court and held that immutable smart contracts used in the operation of Tornado Cash, a decentralized cryptocurrency "mixer" available on the Ethereum blockchain, could not be sanctioned by the U.S. Office of Foreign Assets Control (OFAC) because they are not "property" under the International Emergency Economic Powers Act (IEEPA).[1]

The decision marks another recent instance in which a Court of Appeals considers agency deference in the wake of Loper Bright v. Raimondo, which overruled Chevron deference requiring courts to defer to an agency's reasonable interpretation of ambiguous statutes.[2]

I. Legal Background

OFAC is an agency within the U.S. Department of the Treasury (Department) charged with enforcing sanctions imposed by the United States in support of U.S. national security interests. The IEEPA authorizes OFAC to sanction "any property in which any foreign country or a national thereof has any interest" that threatens America's national security.[3] "Property" is not defined in the IEEPA; however, OFAC's long-standing regulatory definition includes "contracts of any nature" and "services of any nature."[4] OFAC may also "designate" "persons" by adding them to various sanctions lists, including the Specially Designated Nationals and Blocked Persons (SDN) List. U.S. persons are prohibited from transacting or dealings of any kind with persons on the SDN List. Accordingly, designation restricts the ability of such persons and entities to engage in business, provide services, or engage in other economic activities.[5]

II. Technical Background

Smart contracts are open-source computer code based on if-then logic that are deployed on a blockchain. They facilitate transactions in which a given outcome occurs upon the satisfaction of certain conditions. "Smart" refers to the fact that the code is autonomous and self-executing; "contract" refers to the fact that a transaction occurs automatically when predetermined conditions are met.[6] Smart contracts can be mutable or immutable. Mutable smart contracts are controlled or managed by a person and may be altered. An immutable smart contract cannot be altered or removed from the blockchain. Mutable smart contracts can be altered to become immutable, but not vice versa.[7]

A "mixer" is a service that allows cryptocurrency users to obscure the origin and destination of their cryptocurrency by mixing funds with that of other users, making it difficult to trace the source of cryptocurrency on the blockchain. While mixers are notorious for being used by cyber-criminals to launder stolen cryptocurrency, they are also used by law-abiding cryptocurrency owners to maintain anonymity concerning their net worth, spending habits, and donations to political causes.[8]

III. Case Background

As described in the Court's decision, Tornado Cash is a decentralized, open-source mixer software project developed by a group of individuals who uploaded a series of smart contracts to the Ethereum blockchain in 2019. By 2020, all Tornado Cash smart contracts were immutable. These smart contracts served to collect, pool, and mix cryptocurrencies sent by users. Users would send crypto to a "pool" smart contract and could then withdraw the same amount to a different wallet than the depositing wallet, thereby obfuscating the funds' transaction and ownership history and anonymizing the transactors. The mixing process occurred automatically, without human intervention.[9]

In August 2022, OFAC designated Tornado Cash, asserting, in an accompanying press release, that Tornado Cash laundered hundreds of millions of dollars' worth of cryptocurrency from bad actors, including the Lazarus Group, a North Korean state-sponsored group.[10] In November 2022, OFAC rescinded its original designation and simultaneously issued a new designation, which included 53 Ethereum addresses associated with the Tornado Cash software, including the "pool" smart contracts. In so doing, OFAC identified Tornado Cash as an entity organized by its decentralized autonomous organization (DAO) and blocked "all real, personal, and other property and interests in property" of the designated Tornado Cash entity subject to U.S. jurisdiction.[11] This made it illegal for U.S. persons to interact with the Tornado Cash "pool" smart contracts and effectively prohibited U.S. persons from using the Tornado Cash mixer.

Six Tornado Cash users then sued the Department, arguing that OFAC lacked authority to designate Tornado Cash as an SDN because (1) Tornado Cash is not a foreign "national" or "person," (2) the immutable pool smart contracts are not "property," and (3) Tornado Cash cannot have a property interest in the immutable smart contracts. The district court granted the Department's summary judgment motion and denied that of the plaintiffs, concluding that (1) Tornado Cash was properly designated as a "person" under the IEEPA, (2) smart contracts constitute "property," and (3) the DAO associated with Tornado Cash has an "interest in its smart contracts."[12]

IV. Decision

On November 26, 2024, the Fifth Circuit reversed, holding that the Tornado Cash immutable smart contracts were not "property" under the IEEPA and therefore could not be sanctioned. Because that holding was dispositive, the Court found no need to address the parties' other arguments.[13]

The Court relied heavily on the Supreme Court's recent Loper Bright decision. Loper Bright expressly overruled the 40-year-old Chevron doctrine, which had required courts to defer to an agency's reasonable interpretation of federal legislation that is ambiguous or leaves an administrative gap. Under Loper Bright,the Court stated, courts were instead required to independently interpret statutes and determine their best reading.[14]

The Court then assessed the plain meaning of the term "property." Citing numerous dictionaries contemporaneous with the IEEPA's passage, the Court concluded that property required ownership: "Property includes everything which is or may be the subject of ownership, whether a legal ownership, or whether beneficial, or private ownership."[15] Ownership itself, the Court continued, entails certain rights of possession and control, including the right to exclude others from said property. The Tornado Cash immutable smart contracts, the Court found, lacked this crucial element: "The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned."[16] The Court reasoned that no one could exclude anyone from using the smart contracts or stop them from operating. The Court pointed out that even with the sanctions in place, the immutable smart contracts remain accessible to anyone with an internet connection.[17]

The Court then acknowledged that its inquiry could end there, but it went further to find that the immutable smart contracts also did not qualify as property under OFAC's own definition, which included "contracts of any nature" and "services of any nature."

While the district court had found that the Tornado Cash smart contracts at issue were a species of unilateral contracts, the Court disagreed, finding that immutable smart contracts were not contracts at all. "Contracts," the Court found, require an agreement between two or more parties.[18] Here, there was no such agreement; when a user chose to "make an offer" to the immutable smart contract (i.e., chose to interact with it), there was no one on the other end to accept or make a counteroffer-there was only software code. Further, unlike a unilateral contract, which could be revoked prior to the offeree's performance, no revocation here was possible. Even assuming the creation and publication of the Tornado Cash smart contract code initially constituted an offer by developers, the offers were revoked permanently when the smart contracts became immutable, running independently and autonomously.[19]

The Court also rejected OFAC's contention that the immutable smart contracts qualify as "services of any nature whatsoever," finding that while immutable smart contracts may provide services, they are not services themselves. The Court, again employing plain-meaning principles, explained that "service" denotes an intangible commodity "in the form of human effort, such as labor, skill, or advice."[20] In contrast, "[n]o human effort is expended by the immutable smart contracts," which are nothing more than lines of code.[21] More importantly, the Court continued, Tornado Cash did not own the services provided by the immutable smart contracts.

V. Conclusion

The Fifth Circuit's overruling of OFAC's Tornado Cash sanctions is poised to have significant implications for DAOs, decentralized finance (DeFi), and other blockchain projects underpinned by immutable smart contracts. Pending an appeal to the U.S. Supreme Court or an Act of Congress, the decision removes immutable smart contracts from the threat of OFAC sanctions. Additionally, while the decision is limited to its specific facts and circumstances, the Court's decision to exclude immutable smart contracts from the plain meaning of the terms "property," "contracts," and "services" may influence how other courts apply these terms to immutable smart contracts in other statutory contexts. At the same time, the decision leaves open the question of the status of mutable smart contracts-including certain third-party relayers-that often coexist in the same ecosystem. The decision also underscores that courts will continue to play a critical role in defining the legal status of the U.S. cryptocurrency industry.

[1] Van Loon v. Dep't of Treasury, No. 23-50669, ---F.4th---, 2024 WL 4891474 (5th Cir. Nov. 26, 2024) (Decision).

[2] 144 S. Ct. 2244 (2024).

[3] Id. at *6 (citing 50 U.S.C. § 1702(a)(1)(B), emphasis added).

[4] Decision at *10.

[5] See Specially Designated Nationals List, Off. of Foreign Assets Control, https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists (last visited Dec. 2, 2024).

[6] See, e.g., Decoding DeFi: Breaking Down the Future of Decentralized Finance, U.S. House Financial Services Committee's Subcomm. on Digital Assets and Financial Inclusion (Sept. 10, 2024) (written testimony of Rebecca Rettig, Chief Legal & Policy Officer of Polygon Labs).

[7] Decision at *3.

[8] Id. at *5.

[9] Id. at *3.

[10] Van Loon v. Dep't of Treasury, 688 F. Supp. 3d 454, 463 (W.D. Tex. 2023).

[11] Decision at *6.

[12] Id. at *7.

[13] Id.

[14] Id.

[15] Id. at *8 (cleaned up).

[16] Id. at *9.

[17] Id.

[18] Id. at *11.

[19] Id. at *12.

[20] Id. at *13 (citing Black's Law Dictionary (12th ed.)).

[21] Id. at *13.

Public link

Please use the above public link if you want to share this noodl on another website.