1 See Crypto Mixer Usage Reaches All-time Highs in 2022, With Nation State Actors and Cybercriminals Contributing Significant Volume, Chainalysis (July 14, 2022), https://blog.chainalysis.com/reports/cryptocurrency-mixers; see also U.S. Treasury Sanctions Widely Used Crypto Mixer Tornado Cash, TRM Labs (Aug. 8, 2022), https://www.trmlabs.com/post/u-s-treasury-sanctions-widely-used-crypto-mixer-tornado-cash.
2 Miles Jennings, Regulate web3 Apps, Not Protocols, a16z Crypto (Sept. 29, 2022), https://a16zcrypto.com/web3-regulation-apps-not-protocols/.
3 See Chainalysis, supra note 1.
4 The way a prover accomplishes this is by first encoding the statement to be proved as a series of polynomials (the sum of a series of algebraic terms) that are identically zero if and only if the statement is true. This encoding – often called the “arithmetization” of the statement – is the magical step that makes zero-knowledge proofs possible. The prover then convinces the verifier that the polynomials are indeed identically zero.
5 See Chainalysis, supra note 1.
6 See North Korea’s Lazarus Group moves funds through Tornado Cash, TRM Labs (Apr. 28, 2022), https://www.trmlabs.com/post/north-koreas-lazarus-group-moves-funds-through-tornado-cash.
7 “AML” is anti-money laundering, and “CFT” is countering the financing of terrorism. See Fin. Crimes Enf’t Network, History of Anti-Money Laundering Laws, https://www.fincen.gov/history-anti-money-laundering-laws.
8 31 U.S.C. § 5311 et seq.
9 See U.S. Dep’t of the Treasury, Office of Foreign Assets Control (OFAC) – Sanctions Program and Information, https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information.
10 For example, in 2021, the alleged operator of Bitcoin Fog, a mixing service, was arrested and charged with money laundering, operating an unlicensed money transmitting business, and money transmission without a license in the District of Columbia. See Press Release, U.S. Dep’t of Justice, Individual Arrested and Charged with Operating Notorious Darknet Cryptocurrency “Mixer” (Apr. 28, 2021), https://www.justice.gov/opa/pr/individual-arrested-and-charged-operating-notorious-darknet-cryptocurrency-mixer.
11 31 U.S.C. § 5311.
12 Definitions Relating to, and Registration of, Money Services Businesses, 64 Fed. Reg. 45438 (Aug. 1999), https://www.govinfo.gov/content/pkg/FR-1999-08-20/pdf/FR-1999-08-20.pdf.
13 Fin. Crimes Enf’t Network, Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies, FIN-2013-G001 (Mar. 18, 2013), https://www.fincen.gov/sites/default/files/shared/FIN-2013-G001.pdf.
14 Money transmission involves the transmission of funds, CVC, or value that substitutes for currency to another location or person by any means. See Fin. Crimes Enf’t Network, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies, FIN-2019-G001 (May 9, 2019), https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf.
15 Id. at 20, 23-24.
16 Frequently Asked Questions, U.S. Dep’t of the Treasury’s Off. of Foreign Assets Control (“OFAC”), No. 1076, https://home.treasury.gov/policy-issues/financial-sanctions/faqs/1076 (“While engaging in any transaction with Tornado Cash or its blocked property or interests in property is prohibited for U.S. persons, interacting with open-source code itself, in a way that does not involve a prohibited transaction with Tornado Cash, is not prohibited. For example, U.S. persons would not be prohibited by U.S. sanctions regulations from copying the open-source code and making it available online for others to view…”).
17 Press Release, U.S. Dep’t of the Treasury, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022), https://home.treasury.gov/news/press-releases/jy0916.
18 Alexandra D. Comolli & Michele R. Korver, Surfing the First Wave of Cryptocurrency Money Laundering, 69 DOJ J. FED. L. & PRAC. 3 (2021).
19 31 CFR § 1010.410.
20 31 CFR § 1022.320(a)(1); 31 U.S.C. § 5318(g)(3).
21 CTRs require reporting of cash or coin transactions over $10,000 conducted by, or on behalf of, one person, as well as multiple currency transactions that aggregate to over $10,000 in a single day. They do not apply to digital assets currently, although there is a pending rule that could expand CTR-like requirements to CVC transactions meeting certain criteria. See 31 CFR § 1010.311; see also Fin. Crimes Enf’t Network, Notice to Customers: A CTR Reference Guide, https://www.fincen.gov/sites/default/files/shared/CTRPamphlet.pdf.
22 See 50 U.S.C. § 1702(a); Nina M. Hart, Enforcement of Economic Sanctions: An Overview, Congressional Research Service Reports (Mar. 18, 2022), https://crsreports.congress.gov/product/pdf/IF/IF12063.
23 Fed. Fin. Institutions Examination Council, Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) Examination Manual (2021), https://bsaaml.ffiec.gov/manual/OfficeOfForeignAssetsControl/01.
24 See OFAC Cyber-Related Sanctions Frequently Asked Questions, Nos. 444, 445, and 447, https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1546. Sanctions involving cryptocurrency may also come from country-specific executive orders, such as those addressing Russia, Iran, or North Korea.
25 See 31 CFR Apx. A to Pt. 501; 50 U.S.C. § 1705.
26 Civil liability arises without having knowledge or reason to know one was engaging in a sanctions violation.
27 See, e.g., 18 U.S.C. §§ 1956, 1957, and 1960.
28 See OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (Oct. 15, 2021) (stating that sanctions compliance programs and risk assessments apply to “companies”), https://home.treasury.gov/system/files/126/virtual_currency_guidance_brochure.pdf [hereinafter: “OFAC Guidance”]; but see Frequently Asked Questions, OFAC, No. 445, https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1546,(stating “[a]s a general matter, U.S. persons, including firms that facilitate or engage in online commerce, are responsible for ensuring that they do not engage in unauthorized transactions or dealings with persons named on any of OFAC’s sanctions lists or operate in jurisdictions targeted by comprehensive sanctions programs. Such persons, including technology companies, should develop a tailored, risk-based compliance program, which may include sanctions list screening or other appropriate measures.”).
29 Frequently Asked Questions, OFAC, No. 1076, https://home.treasury.gov/policy-issues/financial-sanctions/faqs/1076.
30 See generally Tornado Cash, https://tornado.cash (2022).
31 A new version of Tornado Cash, called Nova, supports direct account-to-account transfers without having to first withdraw funds from Tornado. See generally Tornado Cash Nova, https://nova.tornadocash.eth.link (2022).
32 Tim Hakki, Nearly $7M of Hacked Ronin Funds Sent to Privacy Mixer Tornado Cash, Decrypt (Apr. 4, 2022), https://decrypt.co/96811/nearly-7m-hacked-ronin-funds-sent-privacy-mixer-tornado-cash.
33 See OFAC Cyber-Related Sanctions Frequently Asked Questions, Nos. 1076 and 1095, https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1546.
34 See Elizabeth Howcroft et al., U.S. Crypto Firm Harmony Hit by $100 Million Heist, Reuters (June 24, 2022), https://www.reuters.com/technology/us-crypto-firm-harmony-hit-by-100-million-heist-2022-06-24.
35 See Elizabeth Howcroft, U.S. Crypto Firm Nomad Hit by $190 Million Theft, Reuters (Aug. 3, 2022), https://www.reuters.com/technology/us-crypto-firm-nomad-hit-by-190-million-theft-2022-08-02.
36 See supra note 17.
37 See Chainalysis oracle for sanctions screening, Chainalysis, https://go.chainalysis.com/chainalysis-oracle-docs.html.
38 Jeff Benson, Ethereum Privacy Tool Tornado Cash Says It Uses Chainalysis to Block Sanctioned Wallets, Decrypt (Apr. 15, 2022), https://decrypt.co/97984/ethereum-privacytool-Tornado-cash-uses-chainalysis-block-sanctioned-wallets.
39 See Brian Armstrong & Vitalik Buterin Discuss Decentralization, Privacy, and More, Coinbase: Around the Block, at 35:00 (Aug. 30, 2022) (available on Spotify), https://open.spotify.com/episode/2vzctO7qgvYqGLKbnMnqha?si=X3eu221IRvGIJn3kd4tWFA&nd=1; see, e.g., Ben Fisch, Configurable Privacy Case Study: Partitioned Privacy Pools, Espresso Systems (Sept. 11, 2022), https://www.espressosys.com/blog/configurable-privacy-case-study-partitioned-privacy-pools.
40 See OFAC Guidance at 12-16 (outlining risk assessment obligations).
42 See generally Tornado Cash, Tornado.cash compliance, Medium (June 3, 2020), https://tornado-cash.medium.com/tornado-cash-compliance-9abbf254a370.
43 The newer Tornado Nova protocol supports private transfers while the funds are in the Tornado system. In this case, the “address” encrypted under the law enforcement public key must be the entire chain of transactions that led to the funds currently being withdrawn – more data than just a single address.
44 See Fisch, supra note 39.
Acknowledgements: With thanks to Jai Ramaswamy and Miles Jennings for their feedback and contributions to the concepts in the piece, including Miles’s “allowlist” proposal. Thanks also to David Sverdlov who helped put this together.
Editor: Robert Hackett
Joseph Burleson is an associate general counsel at a16z crypto, where he advises the firm and its portfolio companies on legal, governance, and decentralization matters.
Michele Korver is the head of regulatory at a16z crypto. She previously served as FinCEN’s Chief Digital Currency Advisor, DOJ’s Digital Currency Counsel, and as an Assistant United States Attorney.
Dan Boneh is a senior research advisor at a16z crypto. He is a professor of computer science at Stanford University, where he heads its Applied Cryptography Group; co-directs the Stanford Center for Blockchain Research; and co-directs the Stanford Computer Security Lab.
The views expressed here are those of the individual AH Capital Management, L.L.C. (“a16z”) personnel quoted and are not the views of a16z or its affiliates. Certain information contained in here has been obtained from third-party sources, including from portfolio companies of funds managed by a16z. While taken from sources believed to be reliable, a16z has not independently verified such information and makes no representations about the current or enduring accuracy of the information or its appropriateness for a given situation. In addition, this content may include third-party advertisements; a16z has not reviewed such advertisements and does not endorse any advertising content contained therein.
This content is provided for informational purposes only, and should not be relied upon as legal, business, investment, or tax advice. You should consult your own advisers as to those matters. References to any securities or digital assets are for illustrative purposes only, and do not constitute an investment recommendation or offer to provide investment advisory services. Furthermore, this content is not directed at nor intended for use by any investors or prospective investors, and may not under any circumstances be relied upon when making a decision to invest in any fund managed by a16z. (An offering to invest in an a16z fund will be made only by the private placement memorandum, subscription agreement, and other relevant documentation of any such fund and should be read in their entirety.) Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z, and there can be no assurance that the investments will be profitable or that other investments made in the future will have similar characteristics or results. A list of investments made by funds managed by Andreessen Horowitz (excluding investments for which the issuer has not provided permission for a16z to disclose publicly as well as unannounced investments in publicly traded digital assets) is available at https://a16z.com/investments/.
Charts and graphs provided within are for informational purposes solely and should not be relied upon when making any investment decision. Past performance is not indicative of future results. The content speaks only as of the date indicated. Any projections, estimates, forecasts, targets, prospects, and/or opinions expressed in these materials are subject to change without notice and may differ or be contrary to opinions expressed by others. Please see https://a16z.com/disclosures for additional important information.