Tornado Cash and the transfers nobody asked for
Sanctioning a mixer’s smart contracts meant sanctioned funds could arrive uninvited, and the parties a bank would normally screen did not exist. Sanctions programs touching crypto had to handle unsolicited receipts, exposure several hops away, and a designation under legal attack.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 8, 2022, the Treasury Department’s Office of Foreign Assets Control added Tornado Cash, a virtual currency mixer on the Ethereum blockchain, to its Specially Designated Nationals list. OFAC said it had been used to launder more than 7 billion dollars’ worth of virtual currency since 2019. That included more than 455 million dollars stolen by the Lazarus Group, a North Korean state-sponsored hacking group. The designation listed dozens of Ethereum addresses, many of them smart contracts that ran autonomously, and barred U.S. persons from transacting with them. Within days, an anonymous user sent small amounts of ether through the mixer to the public wallets of well-known people, a practice called dusting. Code repositories were taken down, and lawsuits soon challenged whether immutable software could be sanctioned at all.
Sanctions programs in banking are built around counterparties. A customer, a beneficiary or an intermediary bank has a name and an identity, and the institution decides whether to deal with them. The Tornado Cash designation removed both of those anchors. The sanctioned thing was largely code that nobody could switch off, and anyone could use it to send funds to anyone else.
Earlier in this series we looked at how OFAC’s 2021 action against a crypto exchange tied ransom payments to sanctions risk, and how the Russia sanctions turned screening into an ownership data problem. This designation raised a different set of questions for banks, credit unions and fintechs with any crypto exposure, directly or through partners. They fall into three parts: funds that arrive without being requested, exposure that sits several transactions away, and how to run a control while its legal basis is contested.
Funds nobody requested
The dusting episode made the first problem concrete. Anyone holding a public wallet address could receive funds from a sanctioned contract without doing anything. Under the rules as written, a U.S. person who receives property in which a blocked party has an interest must block it and report it to OFAC. A transfer that arrives unasked does not change that obligation.
In September 2022, OFAC issued answers to frequently asked questions. It said it would not prioritize enforcement against delayed blocking reports from people who had received unsolicited dust with no other sanctions connection. It also explained how people with funds deposited in the mixer before the designation could apply for a license to withdraw them. That eased the pressure on individuals. It left institutions with an operational task.
A crypto platform or a bank’s crypto partner needed a written procedure for inbound exposure. It should say how a receipt from a sanctioned address is detected and who decides whether to freeze the affected balance. It should also cover how the report is filed and how the customer is told without disclosing more than the rules allow. On a blockchain, the platform cannot reject an inbound transfer the way a bank can reject a wire. It can only decide what to do with the funds after they land, which makes the freeze and reporting steps the whole control.
Exposure several hops away
The second problem is distance. A bank’s direct dealings with a mixer were usually nil. Its exposure ran through three kinds of relationship: business customers that are crypto firms, fintech programs where the bank holds customer funds, and retail customers who move money to and from exchanges.
Screening an address list for exact matches is easy. The meaningful question is whether funds reaching a customer passed through a sanctioned address recently, and how many intermediate transfers make a difference. That requires blockchain analytics and a written policy on hop distance and risk scoring. A policy set too tight flags most of the market. One set too loose misses obvious laundering chains.
For most banks, this work sits with partners. The practical first step was written confirmation that crypto business customers and fintech partners screen on-chain activity. Banks also needed to understand the analytics provider and thresholds used, and to obtain the right to review alerts and dispositions. Crypto business customers warranted enhanced due diligence on their sanctions programs, including how they handle dusted funds. Retail monitoring needed rules that catch transfers from platforms known to process mixer outflows without treating every crypto-related payment as suspicious.
Boards needed to hear one implication plainly. Offering digital asset services, or banking those who do, carries a fixed cost in analytics tools and specialist staff that does not scale down with volume.
A control under legal attack
The third problem was legal. Critics argued that an ownerless smart contract is not property that can be blocked, and that the designation swept in lawful users seeking financial privacy. Lawsuits followed within weeks. None of that suspended the obligation in 2022. The designation was in force, and U.S. persons had to comply.
Running a control whose basis may fall calls for documentation. Each control should record which designation it implements, the risk rationale, and what would change if the designation were narrowed or withdrawn. That makes a later change a configuration update rather than a program rebuild. It also preserves the record of why balances were frozen, which matters when a frozen customer asks for release.
The same documentation should cover the exit. If a designation is lifted, blocked balances do not release themselves. Someone has to confirm the change, check that no other sanctions connection applies to each account, release funds in an orderly way and close the related reports. A procedure written in advance avoids a scramble and inconsistent treatment of customers in the same position.
Frontline staff needed scripts as well. Customers whose transfers were held often called the branch or contact center. A consistent explanation that the institution must follow federal sanctions rules, without discussing specific screening results, protected both the customer relationship and the institution. Organizations should check with counsel on how sanctions obligations apply to their specific activities and to frozen balances.
With hindsight
The legal challenge partly succeeded. In November 2024, the Fifth Circuit held that the immutable smart contracts at issue were not property OFAC could block under its statute, and in March 2025 Treasury removed Tornado Cash from the sanctions list. Developers faced separate prosecutions. One was convicted in the Netherlands in 2024. In a U.S. trial in 2025, another was convicted of conspiring to operate an unlicensed money transmitting business, while the jury did not reach verdicts on the other charges. The wider shift held. OFAC kept listing crypto addresses for other designated parties, including North Korean laundering networks, and blockchain analytics became a standard part of sanctions programs at crypto firms and many banks that serve them. Institutions that documented why each control existed found the 2025 delisting a manageable change.