OFAC sanctions targeted the cryptocurrency mixer Tornado Cash this week and this led to a succession of events that made the community react. We take a look back at the various acts of this case, which has unwillingly gone beyond the borders of the United States, raising many questions about the values of decentralised blockchain in the process.
The consequences of OFAC sanctions on Tornado Cash
It was the unmissable news of the week: the cryptocurrency mixer Tornado Cash sanctioned by the Office of Foreign Assets Control (OFAC). Announced on August 8, this news triggered a cascade of events, raising many questions within the ecosystem.
In concrete terms, this measure is only supposed to concern American citizens. On the one hand, the latter can no longer use the protocol, but they are also no longer entitled to interact with the various sanctioned actors. This is not a retroactive law, so people who used Tornado Cash before the OFAC announcement are not at risk.
However, the consequences were quickly felt beyond the United States. Firstly, Circle, the issuer of the USDC, chose to block certain addresses linked to Tornado Cash, freezing $75,000 of funds in the process.
This choice, although not very significant from a monetary point of view, caused the crypto community to react, seeing it as the last straw in an ecosystem that advocates decentralisation.
This has led Rune Christensen, the founder of MakerDAO, to question the functioning of DAI. Indeed, the latter is largely collateralised by the USDC. This point of dependence on a centralised actor now bothers Rune Christensen, who is now considering other methods of collateralisation. He is even thinking about a potential version of stablecoin where it would no longer be pegged to the dollar:
rune: we should seriously consider depegging from usd pic.twitter.com/HBMrPH7LrW
– banteg (@bantg) August 11, 2022
Two opposing visions
OFAC’s main argument for its sanctions against Tornado Cash is its use for money laundering. This is an unstoppable argument, the fact is that when a hack hits decentralised finance (DeFi), the very protocol is called upon to make the stolen funds untraceable.
Moreover, many of these hacks are often attributed to the North Korean hacker group Lazarus.
However, illicit activities are not the only motivation for anonymising transactions. Vitalik Buterin, for example, has stated that he used Tornado Cash in connection with donations for Ukraine. The intention here was not to protect him, but rather the recipients.
This could also be illustrated with a public figure whose addresses are known. If this person does not want his entire address set to be exposed for all to see, he is better off using a cryptocurrency mixer.
In parallel, GitHub has removed the Tornado Cash code from its platform, even though it is open source. This freedom from a court ruling, which did not directly concern GitHub, has reignited the debate that the bad actions of some should not necessarily condemn everyone.
Roman Semenov, a developer who worked on the project, even had his account suspended:
My @GitHub account was just suspended
Is writing an open source code illegal now?
– Roman Semenov ️ (@semenov_roman_) August 8, 2022
Aave and dYdX take action
Apps such as dYdX and Aave have chosen to block the use of their platform to anyone who has interacted with Tornado Cash since the OFAC decision. Where the debate comes in is that this choice concerns all investors, whereas the restrictions are only supposed to concern American citizens.
One of the consequences of this measure, which lends itself to a smile, is that Justin Sun, founder of the Tron ecosystem (TRX), has been blocked from accessing Aave:
I’m officially blocked by @AaveAave since someone sent 0.1 eth randomly from @TornadoCash to me. @StaniKulechov pic.twitter.com/tNXNLNYZha
– H.E. Justin Sun (@justinsuntron) August 13, 2022
The irony is that he himself complied with OFAC sanctions with the address in question. However, an anonymous user actually sent 0.1 ETH to many known addresses in protest of the US Treasury’s actions. As it is impossible to block an incoming transaction on Ethereum, receiving funds from Tornado Cash means that in theory one is no longer in compliance with the sanctions.
This is obviously nonsense and that’s why the Aave teams took action as soon as they became aware of the problem:
The Aave team’s top priority is building a safe and secure system for users. We integrated TRM’s API on the Aave IPFS frontend, which is why some users may be experiencing trouble accessing the Aave app, one of the frontends to the Aave Protocol.
Read for more info
– Aave (@AaveAave) August 13, 2022
However, it should be noted that these blocks are only applicable from the interface of the platforms in question. In fact, someone with programming skills can interact directly with the smart contracts of their choice, without going through the so-called “front-end”. Thus, even a blocked address can, in theory, continue to use Aave and even Tornado Cash for example.
Moreover, it cannot be ruled out that other developers will end up developing new interfaces to overcome these limits and facilitate access to these smart contracts for anyone who is blocked.
The arrest of one of the developers of Tornado Cash
Wednesday, August 10, one of the developers of the protocol was arrested. He is accused of facilitating money laundering, as well as participating in hiding criminal funds.
As Twitter user Mikko Ohtamaa explains, we can indeed point to an ambiguous situation regarding the governance of the protocol. Indeed, its use costs a fee, like any DeFi application. In order to be able to retrieve the funds from a blank address and without ETH to pay these fees, the sender then pays an additional commission to cover the operation.
TORN token holders can, on the other hand, get some of these funds back in exchange for stacking:
47/ Unfortunately there are some legs to claim Tornado Cash has operators, even with a profit motive. Tornado Cash has revenue, at least in their newer “Nova” version.
– Mikko Ohtamaa (@moo9000) August 13, 2022
This practice is seen as a lucrative way to participate in transaction anonymisation. In the context of laundering illicitly acquired funds, this obviously raises ethical questions.
According to Chainalysis, the protocol has seen more than $7.6 billion pass through since its launch in 2019. The graph below shows that 10.5% of these funds are believed to be stolen and 17.7% come from sanctioned addresses:
Origin of funds sent on Tornado Cash
At least a quarter of Tornado Cash’s business is therefore said to be the result of illegal practices.
Thus, this case sees two opposing views, both with legitimate arguments. While we should not encourage cybercrime, we should not make generalizations either. There is no doubt that this episode, going far beyond the borders of one country, will set a precedent in the future.
It should also be borne in mind that in a regulatory context, players who are not concerned in principle prefer to play the security card so that nothing will be held against them in the future in this respect.
