Tornado Cash sanctioned: Service providers "cut ties," anonymous users targeted for "poisoning"

Author: Allen, PANews

The U.S. regulators have initiated sanctions against DeFi protocols for the first time, targeting the largest crypto mixer in the space.

On August 8, the U.S. Treasury Department announced sanctions against the decentralized cryptocurrency mixer Tornado Cash, prohibiting all U.S. individuals and entities from providing services related to the Tornado Cash protocol, as well as prohibiting interactions with Ethereum wallet addresses sanctioned due to the protocol.

The news caused an uproar in the crypto community, leading to a nearly 12% drop in the TVL of the Tornado Cash protocol over the next two days, with its token TORN falling approximately 46%. This round of sanctions marks the first action by the U.S. government against a DeFi protocol, sparking widespread discussions among crypto users about the security and privacy of on-chain assets and the "decentralized" spirit of the Web3 world.

Sanctioned for Money Laundering, Service Providers Cut Ties

Tornado Cash is an on-chain mixer that uses zero-knowledge proof technology. Since everyone's funds are pooled in the mixer, the link between deposit addresses and withdrawal addresses can be severed, thereby protecting users' transfer privacy. According to Dune Analytics data, as of August 10, the total amount transferred into the Tornado Cash protocol was approximately $7.6 billion, with total protocol revenue around $18 million.

Regarding the reasons for the sanctions against Tornado Cash, the U.S. Treasury stated that while most virtual currency activities are legal, they can also be used for illegal activities. For instance, criminals use mixers and dark web markets to trade virtual currencies to evade tracking and sanctions on illegal proceeds, which undermines the government's control over cybercrimes such as fraud and extortion.

Additionally, the U.S. Treasury disclosed that the Tornado Cash protocol has repeatedly assisted hacker organizations in laundering stolen funds, totaling over $7 billion. In several major theft incidents this year, hackers used Tornado Cash for money laundering, including the Axie Infinity sidechain Ronin hacker laundering approximately $455 million through the protocol, the Harmony Bridge hacker laundering about $96 million, and the cross-chain bridge Nomad hacker laundering around $7.8 million.

According to Beosin statistics, in the first half of 2022, approximately $1.14 billion of stolen funds were transferred to Tornado Cash by hackers, accounting for about 60% of total losses in Web3.

Before sanctioning the Tornado Cash protocol, the U.S. Treasury had already imposed sanctions and penalties on several mixers, including announcing sanctions on May 6 against the centralized mixing service Blender for allegedly helping the North Korean hacker group Lazarus Group launder money, and fining the BTC mixing service Helix $60 million in October 2020.

According to PANews, the Tornado Cash website has now been shut down, the project code repository has been removed from GitHub, and the GitHub account of co-founder Roman Semenov has also been suspended. Additionally, some protocols have announced they are cutting ties with Tornado Cash, such as the donation platform Gitcoin announcing it would suspend funding for Tornado Cash, and blockchain infrastructure providers Infura and Alchemy blocking RPC (Remote Procedure Call) requests to Tornado Cash.

In addition to the shutdown of the Tornado Cash protocol, in response to the U.S. government's legal orders, the centralized stablecoin issuer Circle also announced it would freeze USDC assets in wallet addresses listed on the U.S. Treasury's blacklist. According to information from the U.S. Treasury's official website, as of August 10, there were 45 addresses on the blacklist, and stablecoin issuer Circle had frozen 75,000 USDC belonging to those addresses.

Account / Asset Freezes Spark Controversy, "Poisoning" Attacks Emerge

The freezing of user accounts and assets quickly sparked dissatisfaction and concern among crypto community members. For example, Tornado Cash co-founder Roman Semenov expressed on Twitter that only the Tornado Cash protocol itself was sanctioned, and he was just a developer not on the sanctions list, questioning why his GitHub account was also frozen.

Moreover, Circle's sudden freezing of USDC assets in related wallets raised investors' "insecurity" regarding their centralized stablecoin assets. Yield aggregator Yearn protocol developer banteg expressed his dissatisfaction on Twitter, and his tweet about Circle freezing user assets was widely shared and discussed.

The long-absent founder of Terra, Do Kwon, took to Twitter to state that the sanctions against the Tornado Cash protocol further demonstrate that decentralized networks need decentralized currencies. This statement was met with teasing from Twitter users, asking, "Is DK going to start creating a new decentralized stablecoin project?"

Some crypto KOLs online suggested that project teams and developers migrate to "decentralized" infrastructure. For instance, former CTO of decentralized exchange SushiSwap, Joseph Delong, called on crypto users on Twitter to abandon USDC, urging the crypto industry's infrastructure to leave Amazon Cloud, and for developers to migrate from GitHub to GitLab.

At the same time, 4RC Capital partner DeFi Dad suggested that the crypto community migrate to "censorship-resistant" Web3 infrastructure, such as decentralized indexing protocol The Graph, decentralized communication protocol EPNS, decentralized social protocol Lens Protocol, and decentralized storage protocol Arweave.

Some anonymous crypto users even staged "poisoning" attacks to protest, sending small amounts of ETH through Tornado Cash to the addresses of well-known crypto figures to express their dissatisfaction with this round of U.S. government sanctions. Notably, Coinbase CEO Brian Armstrong, TV host Jimmy Fallon, artist Beeple, and wallets created for donations to Ukraine were all affected. Just hours before, Twitter user @depression2019 had claimed on Twitter that they were compiling the wallet addresses of crypto influencers to send them 0.1 ETH each via Tornado Cash.

In response, dForce founder Yang Mindao asked on Twitter how to handle a situation where a user sends ETH to a blue-chip DeFi protocol address through Tornado Cash.

The Dilemma of Decentralized Stablecoins

In light of these sanctions, Circle co-founder and CEO Jeremy Allaire stated on August 9 that complying with the law and helping to prevent money laundering is not only the right thing to do but also an obligation for Circle as a regulated financial institution. However, this action undermines the belief in the value of open-source software on the internet and contradicts the design principle that USDC should "protect privacy" in its issuance and circulation.

Furthermore, Jeremy Allaire mentioned that the crypto industry is an emerging sector that challenges the outdated regulatory frameworks of governments worldwide. If the crypto industry does not take action internally, it will face more rigid and brutal enforcement actions from governments in the future. Therefore, Circle will call on industry leaders, associations, and relevant developers in the coming days to work together to assist policymakers in optimizing legal frameworks and related policies to strike a balance between protecting user safety and privacy and better advancing the development of the crypto industry.

As mentioned above, centralized stablecoin issuers USDC, USDT, and BUSD all have the right to freeze user assets. So can decentralized stablecoins currently guarantee the safety of user assets? Taking DAI, the largest decentralized stablecoin by market capitalization, as an example, although its over-collateralization model helps maintain its price around $1 effectively, avoiding the "death spiral" of the previous algorithmic stablecoin UST, currently about 50% of the collateral backing DAI is USDC, and around 25% is USDC/DAI in Uniswap, with ETH making up only about 7.4%.

Thus, the value support for DAI is built on the foundation of USDC. If Circle freezes the USDC collateral of a DAI user, the underlying pegged value will lose support, and DAI's value will no longer be guaranteed. From this perspective, DAI also cannot escape the risk of being "sanctioned," failing to achieve true "decentralization."

Given these risks, on August 9, Erik Voorhees, CEO and founder of the Swiss cryptocurrency exchange Shapeshift, suggested that the MakerDAO community remove USDC as collateral and recommended moving its collateral to more censorship-resistant stablecoins.

The Web3 world, which promotes the idea of "decentralization," is alluring and has attracted a continuous influx of capital and talent over the past two years. In addition to assets like BTC and ETH gradually gaining recognition in the mainstream world, fields such as DeFi and NFTs are also growing robustly. Undoubtedly, for the crypto industry to achieve further large-scale development, it will require more traditional capital, talent, and user involvement, which necessitates a complete and clear regulatory framework as a foundation. Faced with outdated regulatory frameworks, the crypto industry struggles to balance issues of user safety and privacy to meet the requirements of policymakers. We still have a long way to go in reconciling the spirit of "decentralization" with the path of "compliance."