Challenging Sanctions of Crypto Mixing Services

Cryptocurrency transactions are often anonymous, but they’re not private. In fact, they’re quite public. Anyone with the right technical know-how can see every transaction ever made on most publicly accessible blockchains.

This radical transparency and traceability has made it easier (contrary to popular belief) for law enforcement to track stolen and laundered cryptocurrency across various transactions. But it has also made it easier for criminal crypto actors to trace certain transactions, and — by collecting enough data points — recognize the real-world identity of crypto users who would otherwise remain anonymous.

Dramatic stories abound about violent home invasions targeting those with large cryptocurrency holdings or hackers targeting those who donate to controversial causes. More mundanely, those who accept cryptocurrency as payment for goods or services might not want the person paying them to know their entire on-chain financial history with only a few clicks.

Recognizing these realities, crypto-mixing services sprung to life. The technical details can differ dramatically, but essentially these services act as intermediaries, mixing together crypto transactions to make them more difficult, if not impossible, to track. Some mixing services actually take custody of the cryptocurrency, mix the funds together, and then distribute them to pre-determined places. Others rely instead on smart contracts (pre-written computer code) to do this for them. Created in 2019, popular crypto-mixing service Tornado Cash falls into this latter category.

For the same reasons these services appeal to legitimate users (privacy and making transactions harder to track), they also appeal to criminals and hostile foreign state actors such as North Korea. Knowing this, the Treasury Department’s Office of Foreign Assets Control (OFAC) imposed sanctions that would prohibit “U.S. persons” from engaging in transactions with, or using, some of these mixing services, including Tornado Cash.

But does OFAC have the authority to do this, particularly when it comes to smart-contract-based services such as Tornado Cash?

In two similar lawsuits — one pending in the Fifth Circuit and one pending in the Eleventh Circuit — a series of plaintiffs are arguing that it does not, saying that OFAC’s decision involves “an unprecedented exercise of [its] authority.” To understand why, we need to back up and understand precisely what Congress has said.

For starters, it makes sense that Americans wouldn’t want criminals or foreign adversaries using the U.S. financial system to accomplish their nefarious goals. So, Congress empowered the president to use a panoply of broad economic tools to stop them from doing so. The president in turn delegated his authority to impose and exercise these economic sanctions to the Secretary of the Treasury who in turn delegated much of the responsibility to OFAC for implementing them.

As relevant here, Congress passed two laws that authorize the president and those to whom he has delegated authority, to act. The International Emergency Economic Powers Act (IEEPA) empowers the chief executive (who has delegated his authority all the way down to OFAC) to block “any property in which any foreign country or a national thereof has any interest” when certain other specified conditions are met. Another act, the North Korea Sanctions and Policy Enhancement Act, allows the president to sanction the “property and interest in property” of “any person” who engaged in specified conduct.

While national security concerns pervade the cases challenging OFAC’s actions, fundamentally the cases are about statutory interpretation. What do the terms “person,” “property,” and “interest in property” mean in plain English so that courts can decide whether Congress gave the President — and OFAC — the power to impose sanctions on Tornado Cash?

In the wake of the U.S. Supreme Court’s Loper Bright decision, courts must decide for themselves what these terms mean without giving deference to the agency’s interpretation.

Of course, the plaintiffs in these lawsuits argue that these aren’t obscure technical terms. And they argue that “text, precedent, and history” support their position that OFAC exceeded its authority in placing the Tornado Cash entity it designated on the sanctions list — largely because of how Tornado Cash operates and is structured.

They argue, essentially, that OFAC didn’t properly identify any person — which can include an entity (though they argue there isn’t one in this case) — didn’t properly identify any property because the open-source immutable smart contracts (computer code) at issue here aren’t capable of being owned, and didn’t properly identify any interest in property, as traditionally understood to mean a “legal or equitable claim to or right in property.”

In part, this stems from the fact that there’s confusion over what exactly constitutes “Tornado Cash.” While the government referred to an amalgamation of entities and individuals, the plaintiffs say that “[n]obody besides the government call these people ‘Tornado Cash’” and others instead typically use Tornado Cash to refer to the smart contracts underlying the mixing service.

Essentially, there’s the (Ethereum) blockchain on which the smart contracts run , the developers who initially programmed the smart contracts, the smart contracts themselves, and a decentralized autonomous organization (DAO) that has many members that vote and takes actions related to the smart contracts but that doesn’t own or control the smart contracts themselves since they are unchangeable open-source software code.

The plaintiffs say that by allowing OFAC to break free from the traditional widely accepted understanding of “person,” “property,” and “interest in property,” OFAC’s “sanctions authority would be nearly limitless.” The plaintiffs say that if OFAC’s sanctions are allowed to stand, “every American citizen may be prohibited from executing those lines of code to make political donations, start business ventures, or develop new software features.” They also make clear that OFAC “cannot ban Americans from transacting only with fellow Americans or with their own property,” yet they say that’s exactly what has happened here.

Both district courts considering these issues disagreed and found that OFAC had acted lawfully in imposing the sanctions. At a recent oral argument in the Fifth Circuit case, however, the appellate judges seemed skeptical. And the appellate judges in the Eleventh Circuit case asked tough questions too.

Due process and First Amendment concerns have been brought up in varying degrees in both cases. There’s also questions about what role, if any, the rule of lenity and the Major Questions Doctrine should play. And, even more to the point, there’s questions with larger implications for the crypto community such as whether a smart contract (computer code) can be a unilateral contract and whether a DAO standing alone can be thought of as an unincorporated association or even a general partnership with liability for some or all of its members.

With all of these lingering questions, one thing is clear: Congress should be the entity to respond to the changing circumstances brought about by new technology rather than an administrative agency such as OFAC. Current law shouldn’t be stretched in new and novel ways beyond its proper bounds to fit new circumstances.

On that much, we should all agree. Otherwise, OFAC and other agencies will continue to assert even more constitutionally questionable authority.