The Fight for Privacy

Last week Web3 privacy was dealt a significant blow by a US regulator when the SEC sanctioned the Tornado Cash service that runs on Ethereum.

Web3 Comes Under Attack

Tornado cash is a mixing service which allows holders of Ether to anonymise their holdings. When you hold a cryptocurrency such as Ether in a crypto wallet, all transactions associated with that wallet are visible on the blockchain. Hence if someone is able to link a wallet with an individual, details of that user’s transactions are public knowledge.

Mixing services provide a facility to anonymise crypto holdings. A user sends crypto from their wallet to the service, which then mixes those funds with other funds and allows the user to specify a new wallet(s) for the funds to be transferred to.

Once the funds leave the mixing service, the link with the original user’s wallet is severed allowing the holders to deploy the funds as they see fit without them being traced back to their original source. If the source of these funds was some illicit activity such as hacking a DeFi protocol, this gives the perpetrators a way to get their ill-gotten gains to a safe location where they are free to use them as they please.

The users of such services are not all illicit, some users simply want to ensure that all of their crypto holdings are not public knowledge. For instance, if you registered an ENS address such as ericcartman.eth and paid for it using funds from another wallet with a significant balance of Ether, the fact you have a decent chunk of crypto change is now public knowledge. Sites such as here and here demonstrate who some of the well-known Ethereum wallets are.

You may wish to sever details of these holdings which is where a mixing service can help. You’d still need to be a good citizen and report details of the new wallets to your tax authority but the mixer will help anonymise these funds. In other instances, people use mixer services to be anonymous donors. For instance, Vitalik Buterin used Tornado Cash to donate funds to help the people of Ukraine so, there are very legitimate reasons for making use of mixer services. But they were on the SEC’s radar due to their usage by both criminal and sanctioned groups, such as the Lazarus Group, a Democratic People’s Republic of Korea (DPRK) who had stolen $455 million and used Tornado Cash to launder these funds.

The SEC’s actions were followed by a number of significant responses by some key Web3 companies:

This effectively locked out a number of Web3 services and users from accessing Tornado Cash. However, as Tornado Cash exists as a set of smart contracts on the Ethereum blockchain, it’s still possible to use the service, but given avoiding the US sanctions can result in 30 years in prison, it’s a risk that very few would be willing to take.

Those Web3 companies mentioned above are all U.S. companies, hence they had to respond to the action by the SEC. Whilst the technology of Web3 continues to remain sound, these events go to demonstrate how vulnerable it is to decisions by regulators.

It’s understandable why the SEC does not like services that enable criminals to launder their funds, but there are very legitimate reasons for making use of mixing services. In the days following the initial announcement, events appear to have taken a further turn for the worst with a dutch developer being arrested for their work on Tornado Cash.

What’s not clear at this time is if they were just a code contributor to the service, or working with or assisting groups performing criminal actions on the platform. However, there is widespread concern that they were just undertaking the former.

If this is the case, someone being arrested for writing code is very concerning. This is akin to a knife manufacturer being arrested when someone takes one of their knives and attacks someone with it. The specifics will become clear over time, but currently, there is widespread concern about…