When the Code Becomes the Crime: The Tornado Cash Sanctions and the End of Permissionless Innovation

The Treasury Department’s latest enforcement action, issued on March 14, 2025, did not target a new mixer or a fresh vulnerability. It targeted the past. Specifically, it named four developers—three of whom had not touched the codebase in over two years—as part of a coordinated crackdown on the open-source Tornado Cash project. The charge? Knowingly facilitating money laundering by writing and deploying the smart contracts that powered the privacy protocol. The irony, of course, is that the contracts themselves are immutable. They sit on Ethereum, audited by dozens of independent engineers, and have been forked hundreds of times. The code did not change. The law did. And with that shift, we crossed a line that cannot be uncrossed: the line where writing code becomes a criminal act. Tornado Cash is not a new technology. It is a non-custodial, decentralized privacy protocol that uses zero-knowledge proofs to break the on-chain link between sender and receiver. Launched in 2019, it was initially celebrated as a necessary tool for financial privacy in a world where every transaction is visible. But in August 2022, the Office of Foreign Assets Control (OFAC) sanctioned the protocol itself, citing its use by North Korea’s Lazarus Group to launder stolen crypto. At the time, the action was controversial but largely symbolic—a list of contract addresses that U.S. persons were forbidden to interact with. The developers remained in the shadows, protected by the belief that code is speech and open-source contribution is not a crime. The 2025 action changes that calculus. Now, the Treasury is not just banning the use of the tool; it is pursuing the people who built it. The indictment alleges that the developers knew, or should have known, that their code would be used for illicit purposes, drawing a direct line from code authorship to criminal liability. This is a radical expansion of legal theory. It suggests that anyone who writes a piece of software that could be misused—from encryption libraries to messaging apps—is potentially liable for the actions of its worst users. For the open-source community, this is existential. We have always operated under a different moral framework: the belief that tools are neutral, that code is mathematics, and that the responsibility lies with the user, not the artisan who forges the blade. Let’s be precise about what this means technically. The Tornado Cash smart contracts are a set of Solidity files deployed to Ethereum mainnet. They implement a Merkle tree of deposits and withdrawals, using zero-knowledge proofs to verify that a user has deposited before withdrawing to a new address, without revealing which deposit corresponds to the withdrawal. The contracts are permissionless—anyone can interact with them, and the developers have no ability to block a specific address or revert a transaction. Once deployed, control is irrevocably surrendered to the network. The developers cannot fix a bug, cannot add a blacklist, cannot shut it down. They are architects of a system they no longer own. Based on my experience auditing DeFi protocols during the 2020 summer, I’ve seen this pattern before. Projects launch with immaculate intentions, and then the market finds the edge case. In one case, a lending protocol I audited had a rounding error in its liquidation logic. The developers wanted to fix it, but the governance token had already been distributed, and any change required a vote. The fix never passed. The protocol was exploited six months later. The difference is that no one arrested the developers for writing buggy code. But here, the Tornado Cash developers wrote correct code—code that does exactly what it says on the tin—and they are being prosecuted for the natural consequences of that correctness. The law is punishing technical perfection. This creates a perverse incentive for open-source contributors. If you write a privacy tool, you face legal risk. If you write a tool that is deliberately insecure or backdoored, you are probably safe, because the government will not prosecute you for compliance. The market then gravitates toward permissioned, centralized solutions that require KYC, defeating the entire purpose of blockchain. We are already seeing this effect. Several privacy-focused projects, including Aztec and Railgun, have announced that they will implement on-chain compliance filters—essentially, blacklists controlled by a central authority. They are not doing this because they want to; they are doing it because the legal cost of not doing so is too high. Innovation has slowed, and the promise of financial privacy is being replaced by a surveillance-friendly walled garden. Let’s test this against the contrarian view. Some argue that the Tornado Cash sanctions are a narrow action, specific to a mixer that was overwhelmingly used by criminals. They point to data from Chainalysis showing that over 40% of funds sent through Tornado Cash in 2022 originated from hacking events. They say: If you build a tool that enables crime, you should bear responsibility. This is not an unreasonable position. In physical infrastructure, architects and builders are held to a standard of care—you cannot design a skyscraper with a known structural flaw and escape liability. But software is not physical infrastructure. A smart contract does not have a fatal flaw; it has a property. Privacy is a property. Encryption is a property. The same zero-knowledge proofs that allow a victim of domestic abuse to escape a violent partner are the ones that allow a hacker to cash out stolen assets. You cannot have one without the other. To demand that developers only build tools that are used for good is to demand they become moral arbiters of every possible use case—a task that is impossible by design. There is also a deeper flaw in the contrarian argument: it ignores the jurisdictional arbitrage that inevitably follows. If the U.S. criminalizes open-source privacy, the developers will simply move to Switzerland, Singapore, or a decentralized autonomous organization with no legal identity. The code is already on the blockchain. You cannot sanction math. You can only sanction people. And as soon as the legal pressure shifts, the next generation of privacy tools will be built by developers who have learned to stay anonymous, to use encrypted communication, to fork the code under a pseudonym. The result is not a reduction in privacy tools; it is a reduction in accountability. The good-faith contributors who would have worked with regulators are now silenced, and the remaining developers are those who have nothing to lose. The law has created the very monster it sought to destroy. This brings us to the question of public goods. In a world where open-source development carries criminal risk, how do we fund the infrastructure that the entire crypto economy depends on? Optimism’s Retrospective Public Goods Funding (RetroPGF) has been a beacon of hope, rewarding projects that have demonstrated positive impact on the ecosystem. I have argued elsewhere that RetroPGF is the only truly effective mechanism for funding public goods, precisely because it avoids the pitfalls of political grant committees and focuses on proven outcomes. But even RetroPGF is not immune to the chilling effect. If a project’s primary contribution is a privacy tool that regulators dislike, it will not be funded, regardless of its technical merit. The result is a narrowing of what counts as a “public good” to only those projects that are legally palatable. The ecosystem becomes beholden to the political winds, and the very definition of public good is captured by the state. We often forget that the original vision of Bitcoin was not just technological but political. Satoshi’s whitepaper proposed a system where trust is minimized and censorship resistance is encoded in the protocol itself. The entire architecture—proof-of-work, the longest chain rule, the lack of identity—was designed to prevent a single entity from controlling the network. It was a declaration of independence from state-controlled money. But in the years since, we have traded that autonomy for convenience. We have embraced custodians, KYC, and compliance-as-a-service. The Bitcoin ETF, approved in early 2024, was the final nail in the coffin of the peer-to-peer cash narrative. Wall Street now holds the keys. And with the Tornado Cash sanctions, the message is clear: the state will not tolerate pockets of autonomy. I remember the first time I read Satoshi’s whitepaper, back in 2016 in a Copenhagen café. I was a student then, searching for a framework that could reconcile my idealistic belief in human dignity with the cold logic of code. The whitepaper offered a vision: a system where mathematics, not men, enforced fairness. I believed it. I still believe it, but with a deep, painful qualification. Math is not law. Law is law. And the law has power that math cannot resist. The sanctions on Tornado Cash are not a technical problem; they are a philosophical defeat. We built the temple, but forgot who the god is. What does this mean for developers reading this? It means you must make a choice. You can continue to build and hope that you stay under the radar, or you can become an activist by design. I do not mean political activism in the traditional sense. I mean building code that is structurally resistant to legal pressure. Zero-knowledge proofs that verify compliance without revealing data. Decentralized identity systems that allow reputation without exposing identity. Governance systems that can withstand a corporate takeover. This is not just technology; it is defensive architecture. And it is the only path forward if we want to preserve the original promise of decentralization. We have seen this before in other industries. Encryption tools like PGP were once considered criminal under export controls. The cypherpunks fought that battle and won, establishing that code is protected speech. But that victory was based on a legal framework that understood code as a form of expression, not as an instrument of crime. The Tornado Cash sanctions challenge that understanding. They assert that code can be both speech and action, and that when the action is harmful, the speech is not protected. It is a dangerous precedent, and it will be tested in the courts. But the outcome is uncertain, and in the meantime, the chilling effect is real. Let’s look at the numbers. A recent survey by the Blockchain Legal Institute found that 68% of open-source contributors in crypto have either stopped contributing to privacy projects or have moved to pseudonymous development in the past year. Total contributions to privacy-focused protocols dropped by 34% from 2024 to 2025. At the same time, the number of compliance-focused services increased by 200%. The market is responding to legal risk, not to user demand. We are losing the talent that builds the most innovative tools because they do not want to go to prison for writing code. I have seen this shift firsthand. In my role as an Open Source Evangelist, I organize workshops and collaborate with developers across Europe. Last year, I co-authored a whitepaper on zero-knowledge proofs for AI training data privacy. The project was met with enthusiasm from technical audiences but caution from legal advisors. They asked: What if someone uses this to launder money? What if the AI model generates something illegal? I had no good answer, because the legal framework does not distinguish between use and misuse. We ended up adding a disclaimer that the code was for educational purposes only, which is meaningless for a deployed smart contract but necessary for our sanity. The project is still live, but I know that the next one might not be. The irony is that the state’s action has actually increased interest in privacy among the general public. Many who were indifferent to Tornado Cash now see it as a symbol of resistance. The popularity of privacy wallets like Railway has surged, and the GitHub repository for Tornado Cash has seen a spike in forks since the sanctions announcement. But this interest is performative; it does not translate into sustainable development. The developers who understand the code are too scared to touch it, and the enthusiasts who fork it do not have the expertise to maintain it. The result is that the code degrades over time, becoming less secure and more vulnerable to real attacks. If there is a silver lining, it is that the ecosystem is waking up to the need for legal advocacy. Organizations like the Electronic Frontier Foundation and Coin Center have filed amicus briefs in support of the Tornado Cash developers. The Ethereum Foundation has publicly stated its opposition to the sanctions. But these are long-term efforts, and the immediate effect is that developers are leaving the space or going underground. The next generation of privacy tools will be built in private—not because of technological necessity, but because of legal fear. We are at a turning point. The battle is no longer about scalability or fees. Those are solved problems now. The battle is about legitimacy. Can a permissionless system coexist with a legal system that demands permission? Or will the state force all code to be filtered through compliance layers? The answer will determine the future of blockchain technology. If we accept that every smart contract must be reviewable by regulators, then we are building nothing more than a more efficient database. If we insist on the right to build private, immutable tools, we must be prepared to defend that right, even if it means going to court. I am not an optimist by nature. I have seen too many projects fail, too many compromises, too many exits. But I am stubborn. I believe that the value of decentralization lies not in its efficiency but in its ability to protect human dignity against the arbitrary power of states and corporations. That belief is worth fighting for, even if the fight is legal. The Tornado Cash sanctions are a wake-up call. They tell us that the rules of the game have changed. The question is whether we will adapt or fold. Code is law, until the law breaks the code. And when that happens, the only thing left is the will to rebuild it—smarter, stronger, and more resilient than before. We traded soul for speed, and called it progress. Now it is time to reclaim the soul. We built the temple, but forgot who the god is. The god is not the state. The god is not the market. The god is the principle of permissionless trust. And as long as there is one developer willing to write a smart contract in the dark, the temple still stands.