The Roman Storm Case: What the Tornado Cash Verdict Means for Crypto Developers
The criminal prosecution of Tornado Cash co-founder Roman Storm has become one of the most consequential cases in the history of cryptocurrency regulation. At stake is a question that goes far beyond one developer:
Can writing and deploying open-source privacy software expose its creator to criminal liability for how others use it?
After a four-week jury trial in the Southern District of New York, that question remains partially unresolved, and the legal battle is far from over.
Background: The Verdict and What Comes Next
On August 6, 2025, a federal jury convicted Storm of one count of conspiracy to operate an unlicensed money-transmitting business under 18 U.S.C. § 1960. The jury deadlocked on the two more serious charges: conspiracy to commit money laundering and conspiracy to violate sanctions (conspiracy to violate the International Emergency Economic Powers Act, or IEEPA), each carrying a maximum sentence of up to 20 years.
Storm remains free on bail pending sentencing. His legal team filed a post-trial motion for acquittal in October 2025, and prosecutors filed a 113-page brief opposing that motion in November 2025. A hearing on that motion is scheduled for April 9, 2026.
More significantly, on March 9, 2026, just days before this article was published, the Department of Justice filed a letter with U.S. District Judge Katherine Polk Failla requesting a retrial on the deadlocked charges, proposing a start date of October 5 or 12, 2026. The retrial is estimated to last approximately three weeks.
This means Storm faces ongoing exposure to a combined maximum sentence of 40 additional years on the two unresolved counts, in addition to the five-year maximum for the unlicensed money-transmitting conviction.
What Is Tornado Cash?
Tornado Cash is an open-source, non-custodial cryptocurrency mixing protocol built on the Ethereum blockchain. Deployed in 2019 by Storm and co-founders Roman Semenov and Alexey Pertsev, it allows users to anonymize transactions using zero-knowledge proofs, enabling deposits from one address and withdrawals to another, severing the on-chain link between sender and recipient.
The protocol was sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) in August 2022, alleging that the platform was used to launder more than $7 billion in cryptocurrency, including hundreds of millions attributed to North Korea’s state-sponsored Lazarus Group via the 2022 Ronin bridge hack.
However, in November 2024, the U.S. Court of Appeals for the Fifth Circuit held in Van Loon v. Department of the Treasury that OFAC had exceeded its statutory authority by sanctioning Tornado Cash’s immutable smart contracts. The court reasoned that those contracts, once deployed, were not “property” of any foreign national because no person retained control over them. OFAC subsequently delisted Tornado Cash from its Specially Designated Nationals list in March 2025, though Roman Semenov remains listed individually.
The Core Legal Question: Was Tornado Cash a “Money Transmitting Business”?
Storm’s conviction rests on 18 U.S.C. § 1960, which criminalizes the operation of an unlicensed money transmitting business. The statute was enacted as part of the Bank Secrecy Act framework and was designed to capture services that:
- Accept funds from customers
- Transmit those funds to third parties
- Exercise control over the movement of those funds
Classic examples include Western Union, PayPal, crypto exchanges, and remittance providers: businesses that take custody of funds and move them on behalf of clients.
The defense argued that Tornado Cash fits none of these criteria. Once deployed, the core smart contracts were immutable: they could not be modified, shut down, or controlled by the developers. Users interacted directly with the contracts, not with Storm, any corporate entity, or any custodian holding their assets.
The defense’s core argument was straightforward: publishing software is not the same thing as transmitting money.
FinCEN Guidance on Software Developers
This argument draws support from longstanding U.S. Treasury guidance. FinCEN has historically distinguished between:
- Developers who create software tools for financial transactions, and
- Businesses that actually accept and transmit funds on behalf of customers
FinCEN’s interpretive guidance has stated that merely writing or distributing software does not, by itself, make a person a money transmitter; the relevant inquiry is whether the person is actually engaged, as a business, in accepting and transmitting value. The defense argued this distinction was fatal to the prosecution’s theory.
The Fifth Circuit’s Van Loon Ruling and Its Implications
The Fifth Circuit’s November 2024 decision in Van Loon creates significant tension with the government’s criminal theory, even though it addressed sanctions law rather than criminal liability.
The court held that Tornado Cash’s immutable smart contracts were not “property” under the IEEPA because no person could control them after deployment. If that reasoning is applied to the criminal context, it becomes difficult to argue that Storm was “operating” a money transmitting business through contracts over which he exercised no control.
An appeal to the U.S. Court of Appeals for the Second Circuit, which covers the Southern District of New York, is anticipated once post-trial motions are resolved. Appellate courts often prefer narrow statutory rulings over sweeping constitutional decisions, which makes the “no money transmitting business” argument particularly significant: if the Second Circuit concludes that Tornado Cash’s immutable contracts did not constitute a money transmitting business under § 1960, the conviction could be vacated without the court needing to address broader questions about free speech, privacy technology, or crypto innovation.
The Government’s Counterargument: More Than Just Code
Prosecutors disputed the framing that Tornado Cash was purely autonomous software. At trial, the government argued Storm and his co-founders were actively running a financial service, pointing to evidence that they:
- Maintained the front-end user interface, which was updated approximately 250 times between 2020 and 2022
- Controlled the domain and user access point (approximately 96% of users accessed Tornado Cash through the developer-maintained UI)
- Operated the relayer infrastructure
- Held and profited from TORN governance tokens
- Continued operating the service after receiving notice that North Korean hackers and other criminal actors were using it
The IRS Criminal Investigation unit, the FBI, and the Southern District of New York’s U.S. Attorney’s office (then led by Jay Clayton) collectively argued that these facts transformed the project from published code into an operated financial service — one whose developers knowingly facilitated the movement of more than $1 billion in criminal proceeds.
Judge Katherine Polk Failla denied a motion to dismiss in September 2024, holding that Tornado Cash could qualify as a money transmitter regardless of whether its developers had custody of funds. That ruling allowed the case to proceed to trial.
What the Mixed Verdict Tells Us
The jury’s split verdict is significant in itself. The deadlock on money laundering and sanctions evasion charges — the most serious allegations — suggests the jury was not prepared to draw a direct line between Storm’s role as a software developer and deliberate criminal facilitation. As one legal commentator noted, the money-transmitting count did not require any finding that Storm had ties to illicit actors; the money-laundering and sanctions counts did, and that’s where the jury could not agree.
Industry groups were quick to respond. The Blockchain Association called the verdict a dangerous precedent that misapplies money transmitter laws. The Solana Policy Institute stated that the conviction means developers can face criminal liability even when they build non-custodial, open-source protocols and relinquish control through immutable smart contracts. The Ethereum Foundation pledged to match up to $750,000 in legal defense contributions, driving Storm’s total defense fund above $5 million.
Vitalik Buterin published an open letter in January 2026 calling for leniency and urging that the case not be used to criminalize open-source development.
The Bigger Question: Where Is the Line?
The Roman Storm case forces courts to confront a question the law was not designed to answer:
Where is the line between publishing software and operating a financial service?
Decentralized protocols blur that boundary in ways legislators did not anticipate when drafting § 1960 or the Bank Secrecy Act. The outcome of Storm’s appeal — and any retrial on the remaining counts could shape how courts treat:
- Non-custodial wallets and DeFi protocols
- Privacy-enhancing tools and zero-knowledge applications
- Open-source financial infrastructure
- Any software developer whose tools are misused by third parties
Notably, even within the Trump administration, the DOJ Criminal Division leadership stated in August 2025 that “writing code” is not a crime and that developers lacking ill intent should not face prosecution. Yet the same DOJ is now seeking a retrial on the two most serious charges. How those positions are reconciled, and whether Congress takes action to provide legislative clarity, will determine the legal environment for an entire generation of crypto developers.
Practical Implications for Developers and Operators
Regardless of how the Storm case is ultimately resolved, it has immediate implications for anyone building or operating digital asset infrastructure in the United States:
Registration and Licensing
Any entity that could be characterized as accepting and transmitting value on behalf of users, even if non-custodial in design, should carefully evaluate whether it is required to register with FinCEN as a money services business and obtain applicable state money transmitter licenses. The Storm prosecution demonstrates that prosecutors are willing to argue that functional control over user access (such as a maintained UI or domain) can substitute for direct custody of funds.
AML/KYC Compliance
Operators of mixing services, privacy protocols, and similar tools face particular scrutiny. The absence of a formal AML/KYC program was central to the government’s case. Teams building privacy-enhancing financial tools should assess whether OFAC screening, transaction monitoring, or other compliance measures are appropriate for their architecture.
Governance Token Considerations
The government pointed to Storm’s holdings of TORN governance tokens as evidence of profit from operations. Developers and founders holding governance tokens in protocols they build or maintain should be aware that such holdings may be considered evidence of ongoing business activity, operation, or control.
Document Intent and Design Decisions
One of Storm’s strongest arguments was that he “burned the keys” to the core mixing pools, deliberately making them immutable and relinquishing any ability to intervene in their operation. Contemporaneous documentation of such design decisions and the intent behind them may be valuable in demonstrating a developer’s intent to build neutral infrastructure rather than a financial service.
This article is provided for informational purposes only and does not constitute legal advice. The law governing digital assets, money transmission, and developer liability is rapidly evolving. If you have questions about your regulatory obligations, please contact Hodder Law.
© 2026 Hodder Law. All rights reserved.
