On 8 August 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned virtual currency mixer Tornado Cash. On 12 August 2022, the FIOD (a Dutch body responsible for financial and fiscal crime) arrested a developer who worked on Tornado Cash on the suspicion of aiding money laundering.

In this week’s deep-dive, I’m going to dig into what Tornado is, why it was banned and most importantly, important questions to think about following the ban.

Tornado cash helps people send and receive crypto without leaving a trail. It achieves the same outcome as cash — it’s impossible to track the flow of funds. The big difference though is that crypto makes it easier to move money. Goodluck moving moving $500 million in cash.

If you deposit cash into Tornado, it’s mixed with other users’ funds (hence the name “crypto mixer”). The depositor is given a unique code. When the depositor wants their crypto back, they (or whoever they nominate) submits the code and the wallet they want to withdraw the funds to. There is no way to connect the sender and the receiver. Tornado makes a small fee on the transfer.

Tornado can be used for the following:

Based on a Chainanalysis report, approximately 28% of the funds routed through Tornado Cash is either stolen or from sanctioned individuals.

The intention to stop money laundering and crypto heists are supported by the entire crypto community. The contention is in the how; did Tornado have to be blocked? why was the developer arrested?

According to the US, Tornado Cash has been used to launder $7 billion in total assets. This includes 3 of the biggest crypto heists: the Ronin Bridge attack ($425 million), Harmony Protocol attack ($96 million) and the Nomad Heist ($7.8 million).

Specifically, the ban lists a bunch of wallets; anyone sending or receiving crypto from these wallets has been added to the Specially Designated Nationals (SDN) list. It is a crime for any US person or entity to do business with someone on this list.

The key questions people are asking are:

I’m not a legal expert so I’m not going to attempt to answer the above. Instead, I’ll focus on the second order effects of the ban.

If any crypto that has touched Tornado is tainted, it’s pretty simple to get someone you don’t like banned. Send them a little crypto using Tornado.

And yes, people are doing this.

I’m not worried about this — authorities will see past this.

Stablecoins maintain a 1:1 peg with a specific currency. In order to do so, they maintain reserves. USDC is the second-largest stablecoin and is managed by a US entity called Circle. They froze $75,000 of assets because of interactions with Tornado. I don’t think this is Circle’s fault. They are a US entity that is abiding by US laws.

That’s a small amount right now but people are worried about what could happen if more addresses are banned. Stablecoins with some degree of centralisation, like USDC, are subject to regulatory risks. If a large amount of their reserve get’s frozen, the coin will lose it’s 1:1 peg.

The only alternative is a decentralised stablecoin like MakerDAO’s DAI. However, this comes with it’s own challenges. First, a large part of DAI’s reserves are other centralised stablecoins — they’re working on changing this. Second, they usually have other crypto currencies as reserves. Due to the volatility of crypto, they need to over-collateralise (maintain $1.50 for every $1). This is capital inefficient.

Like Circle, DeFi protocols are required to block any individual that interacted with Tornado. Multiple users reported seeing the following screen on Aave.

Again, you can blame Aave all you want but they’re simply complying with government regulations. Besides, most decentralised finance protocols have long leveraged blockchain analytics firms like TRM to block sanctioned addresses.

The other interesting point to note is that users can still interact with the Aave smart contract. It’s only the front-end website that is banned. Using a tool like Etherscan, you can execute functions on the smart contract. Decentralised finance is truly decentralised for now.

One of the grand visions for crypto is to make the world more equitable. It enables individuals to receive money without divulging personal details. The theory is that this helps marginalised communities who typically suffer from bias.

We’re fine for now, but this starts to fall down as you lose privacy.

Anyone can still go to Aave and get a loan on their crypto without divulging who they are. But if this goes a step further where users are required to KYC themselves, this benefit doesn’t exist.

There is a tradeoff — you can choose privacy and some bad stuff, or no bad stuff but no privacy. And the lack of privacy has its implications.

If the authorities really wanted to ban transactions, they’d need to stop transactions from entering the blockchain at all. This the real kicker.

Ethereum is moving from a proof-of-work consensus protocol to a proof-of-stake consensus protocol in September this year (called The Merge).

When this happens, ‘validators’ will help ensure that the data on the blockchain is accurate. Think of them as a large pool of accountants, who are constantly confirming that the data recorded on the chain is accurate.

Now, imagine the US government asks them to stop validating transactions from addresses that have interacted with Tornado.

This is, first and foremost, contrarian to the principle of crypto. Validators were never intended to be subjective. Their job is to validate, not choose whether to validate.

The graph below shows the largest validators for the Ethereum chain (relevant once the Merge happens). Lido, Coinbase, Kraken and Binance account for over 50% of all validators.

If this did go through, each validator has 2 choices:

I haven’t got my head around how (1) would work or whether it’s even feasible. I suppose there’s always a way.

But I can tell you for sure that (1) would result in a large number of people losing faith in crypto. If the government can choose what to allow and what not to allow on a network, it’s not really decentralised.

It might still prove to be useful infrastructure, but it’s much more comparable to FinTech than it is to decentralised infrastructure without intermediaries.

I struggle to talk in absolutes on a topic like this one. There are folks who are more knowledgable about law and will challenge what needs challenging. For example, Coincenter, a US-based non-profit focussed on crypto policy, believes that OFAC has over-stepped it’s statutory authority. They may even challenge this in court.

If you’re a builder or believer, I urge you to think about the opportunities. Here are the two biggest ones: