Developers and operators of decentralized privacy protocols remain exposed to potential US sanctions enforcement despite the Treasury Department’s Office of Foreign Assets Control (OFAC) removing Tornado Cash smart contracts from its sanctions in March.
According to an April 15 report published by the DeFi Education Fund, while the Fifth Circuit Court of Appeals ruled that Tornado Cash’s immutable smart contracts do not constitute property under the International Emergency Economic Powers Act (IEEPA), the Treasury continues to assert broad discretion over mutable protocols and developers associated with them.
The Treasury’s response to the Van Loon v. Department of Treasury ruling suggests that it does not view the court’s decision as limiting its authority to sanction decentralized technologies.
In its March filing, the agency argued that the Fifth Circuit’s judgment applied only to immutable smart contracts, leaving the possibility of future designations for mutable components or protocol developers.
Although OFAC subsequently removed Tornado Cash’s smart contracts from its Specially Designated Nationals (SDN) list, it framed the move as a discretionary action rather than compliance with the court order. Currently, the ability to reimpose sanctions if conditions change is preserved.
Continued enforcement
According to the report, OFAC’s decision to retain sanctions on Roman Semenov, a Tornado Cash co-founder, highlights the Treasury’s broader enforcement strategy. While Semenov was removed from the Cyber-Related sanctions list, he remains designated under the North Korean Sanctions Program.
The agency claims that by helping develop a decentralized protocol used by North Korean-linked hackers, Semenov “materially assisted” the government of North Korea, even though it alleged no direct or intentional contact.
This interpretation extends liability to software developers based solely on the downstream use of their code by sanctioned parties.
The Department of Justice has also cited these designations in its criminal indictments of Semenov and fellow developer Roman Storm, raising additional questions about the legal boundaries for creating open-source privacy tools.
The Treasury has not provided detailed guidance on evaluating potential liability for those indirectly connected to sanctioned behavior.
The agency’s approach signals that developers of DeFi protocols and privacy applications may continue to face legal exposure if designated entities later use their tools. This includes potential scrutiny over token listings, protocol integrations, or user interactions that could be construed as indirect support under North Korea-related sanctions.
Unclear standards
According to the report, the Tornado Cash case has also shed light on the opacity of OFAC’s designation standards.
Under Executive Orders 13694 and 13722, which cover cyber-enabled threats and North Korea sanctions, the Treasury maintains expansive authority to designate persons or entities that support cybercrime or the North Korean regime. However, applying these frameworks to decentralized software and anonymous users has introduced legal ambiguity.
Cyber-related sanctions are broadly defined and can include any activity perceived as threatening to US national security. In contrast, North Korea-related sanctions require attribution but cover an extensive range of activities.
OFAC has not specified how it differentiates between these frameworks in practice or what technical thresholds must be met to constitute “support.” As a result, legal exposure for mixers and developers remains challenging to predict.
The decision to delist Tornado Cash’s smart contracts without acknowledging fault or affirming limits on regulatory authority reflects the Treasury’s preference to avoid setting a judicial precedent.
Rather than accept a broad ruling from the Fifth Circuit, the agency asked the District Court to issue a narrow judgment confined to immutable smart contracts. Then, it argued that its discretionary delisting rendered the case moot.
Court judgment still pending
Although OFAC has argued that its delisting resolved the matter, the US District Court is still responsible for issuing a final ruling. A full vacatur of the original designation could limit the agency’s authority to sanction other smart contracts or DeFi protocols in similar cases.
Conversely, if the court accepts the Treasury’s narrow interpretation, the ruling could establish a precedent that would allow OFAC to reassert sanctions under different rationales.
In the interim, privacy tool developers and decentralized protocol contributors operate in a regulatory gray zone, where the risk of being designated or criminally charged may depend more on their software’s perceived uses than on any demonstrable intent.
While delisting Tornado Cash’s contracts temporarily relieved the DeFi community, the government’s stance on enforcement suggests that sanctions-related exposure persists well beyond this single case.
