Late last night, a federal jury in New York delivered an interesting decision in the fight against crypto‑enabled money laundering. Roman Storm, co‑founder of the Ethereum mixer Tornado Cash, was found guilty of operating an unlicensed money‑transmitting business—a conviction of a decentralized mixer operator in the United States. While the jury acquitted Storm on sanctions charges.
A quick primer on Tornado Cash
Tornado Cash was set up in 2019 as a set of smart contracts that pool user deposits and let them withdraw from a new address, breaking the on-chain link between sender and recipient.
The U.S. Treasury has linked more than $7 billion in value to Tornado transactions, including funds from North Korea’s Lazarus cyber‑hacking group.
In August 2022, the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the protocol’s smart‑contract addresses—the first time code itself appeared on the Specially Designated Nationals (SDN) list.
In May 2024, a Dutch court convicted Tornado Cash developer Alexey Pertsev of money‑laundering charges and sentenced him to 64 months (5 years, 4 months) in prison.
The Legal Foundation: FinCEN´s 2019 guidance
Back in May 2019, the U.S. Financial Crimes Enforcement Network (FinCEN) issued guidance (FIN‑2019‑G001) clarifying that anyone who “accepts and transmits convertible virtual currency in a manner designed to prevent tracing” is a Money Services Business (MSB)—and therefore must:
Register with FinCEN;
Implement a written AML/KYC programme; and
File Suspicious Activity Reports (SARs).
Although the document is formally interpretive guidance (not a new rule), U.S. courts grant it persuasive weight. Storm’s conviction demonstrates that ignoring such guidance can trigger not only civil fines but criminal liability under 18 U.S.C. § 1960 (unlicensed money transmission).
| Charge | Maximum Penalty | Jury Decision | Take‑away |
|---|---|---|---|
| Unlicensed money‑transmitting conspiracy (§ 1960) | 5 years | Guilty | Confirms that operating or controlling a mixer—even via multisig keys or a web front‑end—counts as “money transmission.” |
| Money‑laundering conspiracy (§ 1956) | 20 years | Hung jury | Prosecutors may retry; shows juries scrutinise intent to launder, not just the tool. |
| Sanctions conspiracy (IEEPA) | 20 years | Not guilty | Willfulness toward facilitating North Korean sanctions evasion was not proven beyond reasonable doubt. |
Storm now awaits sentencing; guideline estimates suggest a term well below the five‑year statutory maximum, but the conviction itself sets an important precedent.
Future Implications for the Crypto Industry:
With this verdict, the government can point to a jury that embraced its central theory.
FinCEN’s 2019 document served as proof that Storm knew or should have known registration was required.
DOJ has already used the same legal reasoning in Helix (operator Larry Harmon sentenced to three years in prison and forfeiture of over US $400 million in November 2024); and applied it to Samourai Wallet (founders Keonne Rodriguez and William Hill pled guilty on 30 July 2025 in running an unlicensed money transmitting business; (sentencing pending); and is pushing forward against ChipMixer—its Vietnamese founder Minh Quoc Nguyen was indicted in March 2023 for money‑laundering and unlicensed money transmission, but remains a fugitive, leaving the criminal case open in the Eastern District of Pennsylvania.
Implications for consumer protection & fraud recovery
Easier asset tracing – A chilling effect on mixers may reduce one avenue fraudsters use to hide funds, improving chances of victim restitution.
Design shift in privacy tools – Developers are likely to ship immutable, key‑less smart contracts to argue they do not “accept” customer funds, complicating enforcement.
Need for balanced policy – Privacy is a legitimate goal, but consumer fraud losses are real. EFRI advocates for
Clear licensing pathways for privacy‑enhancing services that implement robust AML controls,
Safe-harbour carve‑outs for open‑source developers who have no operational control, and
Mandatory disclosure obligations apply to services that exercise control over customer funds.
