Coinbase backs Tornado Cash lawsuit

In recent years, Tornado Cash has emerged as a popular tool for those wishing to hide their crypto transactions. Using smart contracts on the Ethereum blockchain, it allows users to deposit crypto into a pool alongside other users and then distribute it to third-party wallets—the process makes it highly difficult to determine who gave funds to a given wallet.

The plaintiffs in the case include Preston Van Loon, a prominent figure in the Ethereum community who claims he cannot access thousands of dollars worth of Ethereum deposited with Tornado Cash, and his brother, Joseph, who says he intends to use the service to privately fund an Ethereum node and staking service but can no longer do so because of the sanctions.

The plaintiffs also include Tyler Almeida, a California security analyst Coinbase, who alleges that he used Tornado Cash to make anonymous donations to support Ukraine. Almeida claims the US placing sanctions on the service impedes his right to donate—and by extension his right to express himself under the First Amendment.

Almeida is one of two Coinbase employees to put their name on the lawsuit. The company, whose CEO Brian Armstrong has vocally objected to the sanctions on Tornado Cash, is paying the legal bills of the employees and four other plaintiffs.

“We didn’t do this lightly. We have lots of respect for [sanctions agency] OFAC and Treasury for their work keeping us safe,” said Coinbase’s head lawyer, Paul Grewal, who added that the company believes the government overstepped its authority by placing sanctions on code.

Terrorist sanctions on software code

The decision by the Treasury Department to impose sanctions on code used by Tornado Cash has alarmed the crypto industry and the broader software development community who fear the move will stifle privacy and free expression.

The legal regime used to impose the sanctions is hardly new—it was crafted under President Barack Obama as a means to combat the increasingly sophisticated financial tools used by terrorists and rogue states to launder money and skirt sanctions.

Until now, however, the Treasury has imposed the sanctions—violations of which bring severe penalties—on people or companies. But in the Tornado Cash case, the target of the sanctions is not a specific entity but a series of smart contracts.

“The Tornado Cash privacy protocol consists of perpetually self-executing code on the Ethereum blockchain that cannot be altered, edited, or otherwise controlled,” the complaint notes.

In targeting Tornado Cash, the Treasury Department noted that the service had become a popular vehicle for North Korean hackers and others to launder proceeds of crime. In response, critics of the move say the government should have targeted individuals’ wallet addresses as they have in the past, and not the smart contracts that allow the service to operate in the first place.

According to Grewal, the sanctions decision is akin to the government going after bank robbers by banning the use of the public highway the crooks used for their escape.

In challenging the decision, Coinbase and the plaintiffs appear to believe that their strongest argument turns on how to define the “persons” subject to the sanctions regime. The law in question describes “persons” as “individuals or entities”—neither of which covers something like open source software code, according to the complaint.

The Coinbase employees and Ethereum backers are not seeking damages, but rather an injunction stating that the Treasury Department exceeded its authority under the Administrative Procedures Act.

While federal lawsuits typically take many months or years to resolve, Grewal says Coinbase expects a decision fairly quickly given there is no money involved and as the case turns on a straightforward statutory and constitutional challenge. The case was filed in the US District Court for West Texas, which is known for a rapid docket compared to other federal jurisdictions.

A decision is likely to arrive in the first part of 2023 at the earliest. In the meantime, the Tornado Cash users will remain without access to either the Ethereum they placed in its smart contracts or the privacy service it provides.

“None of the Plaintiffs is a terrorist. None supports terrorism or state-sponsored illegal activity. None launder moneys. Each is an American who simply wants to engage in entirely lawful activity in private,” notes the complaint.