Tornado Cash developer sentenced. Is Code Speech dead?

Author: Nian Qing, ChainCatcher

Yesterday, Tornado Cash developer and 31-year-old Russian citizen Alexey Pertsev was sentenced to 5 years and 4 months in prison in the Netherlands for laundering $2.2 billion on a cryptocurrency mixer platform. Pertsev had previously been in prison for eight months. This period will be deducted from the sentence, leaving four and a half years. Pertsev's lawyer will have 14 days to appeal the judge's decision.

It is generally believed in the industry that this case is not only a watershed for DeFi regulation, but will also change the course of encrypted privacy and have a "chilling effect" on the global open source community. The conviction of open source software developers also marks that Web3 smart contract developers will be subject to traditional framework laws.

The judge and prosecutor in the Alexey Pertsev case said in their verdict that "the essence and function of Tornado Cash is a tool against criminals" and "Tornado Cash is not just a smart contract, it operates more like a company."

Last August, Tornado Cash co-founders Roman Storm and Roman Semenov were charged with conspiracy to launder money and one count of conspiracy to violate the International Economic Emergency Powers Act, both of which carry a maximum sentence of 20 years in prison, and conspiracy to operate an unlicensed money transmission business, both of which carry a maximum sentence of 5 years in prison.

Currently, Roman Storm has been arrested in Washington State, USA, and Roman Semenov is still at large. In addition, Roman Storm's trial is scheduled for September 23. Alexey Pertsev's verdict will directly affect the outcome of Storm's trial.

It is worth mentioning that after Pertsev was sentenced yesterday, the crypto community continued to transfer funds to the "Free Alexey & Roman" donation fund on Juicebox. Some people left messages such as "privacy is not a crime", "code is speech", "defend freedom", "XX stands with privacy and open-source public goods" to support the developers of Tornado Cash and the "crypto spirit".

Tornado Cash Case Timeline

Tornado Cash was launched in August 2019. The three founders are Roman Storm, Roman Semenov and Alexey Pertsev. Its main founding team is zkSNARK researchers, among whom Alexey Pertsev is also a core member of the security audit company Peppersec.

The following is a complete timeline of events related to the Tornado Cash case (compiled from DL News, with additions and changes by ChainCatcher):

2019

August 6: Tornado Cash goes online, enabling users to "send Ethereum cryptocurrency 100% anonymously."

September 13: The U.S. Office of Foreign Assets Control (OFAC) imposes sanctions on North Korean cyber organizations including the Lazarus Group.

2020

May 10: Tornado Cash completed the "trusted setup ceremony" to burn the management rights of all deposit pools and update the smart contract. The Tornado Cash protocol became a permanent self-executing code that is not controlled by any party. Tornado Cash called it "the world's largest trusted setup ceremony" with a total of 1,114 participants.

June 4: Tornado Cash developers deployed an optional compliance tool for users to choose to disclose their transaction history when needed.

September 25: Hackers stole $275 million worth of cryptocurrency from the KuCoin exchange. This is one of the largest hacking incidents connected to Tornado Cash by Dutch prosecutors.

2022

March 23: Axie Infinity Ronin sidechain bridge loses approximately $625 million in hacking. This is one of the largest cryptocurrency hacks to date, and criminals laundered the money through Tornado Cash.

May 6: OFAC sanctions Blender, the first virtual currency mixer used by North Korean cybercrime gangs.

June 24: Lazarus Group hacks Harmony Horizon bridge, and nearly $100 million worth of stolen cryptocurrency is transferred through Tornado Cash. According to Dutch prosecutors, this is another major hack using Tornado Cash to launder money.

August 8: OFAC imposes sanctions on Tornado Cash for being used to launder $7 billion.

August 9: The Tornado Cash website has been shut down, the project code repository has been deleted from GitHub, and the GitHub account of co-founder Roman Semenov has been suspended

August 10: Alexey Pertsev was arrested in the Netherlands and jailed without public charges.

October 12: Coin Center, a nonprofit focused on cryptocurrency policy issues, sued OFAC over Tornado Cash sanctions.

November 22: Dutch prosecutors disclosed the charges for the first time in a court hearing.

2023

April 20: Alexey Pertsev was released from prison pending trial.

August 23: The U.S. Department of Justice charged Tornado Cash developer Roman Storm and sanctioned developer Roman Semenov.

August 25, Tornado Cash co-founder Roman Storm was released on bail.

December 7, Binance delisted Tornado Cash native token TORN.

2024

March 25-26: Alexey Pertsev was tried for two days in the city of 's-Hertogenbosch, the Netherlands.

April 5: The US trade association submitted a brief to the court in defense of Roman Storm and addressed each of the charges against him.

May 14: Alexey Pertsev was sentenced to 64 months in prison for money laundering.

September 23: Roman Storm will stand trial in the United States.

Controversy and focus of the trial: the identity boundary of smart contract developers

The focus of the Tornado Cash case trial is whether the current anti-money laundering law applies to blockchain/crypto financial platforms.

During the trial, Pertsev's defense attorney Keith Cheng said that no one, including Tornado Cash developers, can prevent others from using open source smart contract code. The contributors to a smart contract are a decentralized organization, not a single person in charge like a traditional company.

Last August, after Roman Storm and Roman Semenov were prosecuted by the United States, Coin Center (Coin Center is a non-profit organization that focuses on cryptocurrency policy issues, engages in research and education policy formulation, and advocates that regulators adopt reasonable regulatory strategies for encryption technology) issued a statement of support, stating that Tornado Cash's latest allegations are inconsistent with the FinCEN files of the Financial Crimes Guidance Bureau.

The core point of view is that Tornado Cash developers only provide "pure software development or communication services" and are not engaged in "the business of transferring funds on behalf of the public." Judicial agencies should not confuse "service providers" with "fund transmitters." Tornado Cash's only control over smart contracts is to change the cryptographic logic related to privacy functions, and it does not have any actual ability to view or move user funds.

In early April, Coin Center said in a friend-of-the-court statement filed in Roman Storm's ongoing criminal case in the Southern District of New York that it hoped the court would delete the prosecutor's vague and biased description of Tornado Cash, that open source software developers cannot control the behavior of others who happen to use their tools, and that Tornado Cash code releases are explicitly protected by the U.S. Constitution. In addition, Coin Center also believes that the prosecution statement and judgment in this case "are of interest to those who engage in pure open source software development, code release and speech work", and calls for the protection of the right to freely develop and release software in the United States.

In a document filed with the U.S. District Court for the Southern District of New York at the end of March, Roman Storm's lawyers also mentioned that Tornado Cash, as a non-custodial smart contract, gives users full control over their assets without relying on any service provider or third-party entrusted holding. Programming falls within the scope of freedom of speech and is therefore protected by the First Amendment of the U.S. Constitution.

But in the trial on the 14th, the court rejected such a view, arguing that no technological innovation can go beyond the legal obligation to prevent the platform from helping criminals and sanctioned entities conceal the source of stolen assets. Prosecutor Martine Boerlage's final characterization of Tornado Cash is that it is "not just a smart contract, it operates like a company."

The U.S. Department of Justice reiterated that its indictment has nothing to do with whether Tornado Cash's computer code has free speech or is protected by the First Amendment Constitution. The defendant was not prosecuted for publishing computer code, but for using it to promote profitable illegal business.

The Department of Justice further explained that banks use computer code to process financial transactions. If the code performs the work of a money transmitter defined by law, then the code is not just free speech, but a computer code that people must ensure is implemented in a way that does not violate money transmission laws. Tornado Cash is both part of the code, part of speech, and part of business. Overall, it is a human creation. Storm didn't just release code; he ran a business and made operational decisions for years. The Tornado Cash protocol is not equivalent to the Tornado Cash business. Just because Tornado Cash has some open source code does not mean that all of Roman Storm's actions involving that code as the owner of the Tornado Cash business are constitutionally protected.

Petitions, protests and donations

Crypto lawyer David Lesperance once said that legally, Alexey Pertsev's case is more important to the future of DeFi than the simple fraud cases against SBF and Do Kwon or Zhao Changpeng's failure to develop the required anti-money laundering protocols. Precisely because the Tornado Cash case is so representative, the three founders have received various forms of support.

The crypto community, especially the developer community, has strongly protested Pertsev's arrest. In addition to petitions and solidarity on various social media, posters supporting Alexey Pertsev were distributed outside the Dutch court.

In August 22, some anonymous crypto users even protested through a "poisoning" attack, using Tornado Cash to transfer a small amount of ETH to the addresses of well-known crypto figures to express their dissatisfaction with the US government's sanctions. Shenyu, Sun Yuchen, Coinbase CEO Brian Armstrong, artist Beeple and many other well-known KOLs were "poisoned".

In addition, a member of the crypto community launched a donation campaign called "Free Alexey & Roman" on the crowdfunding platform Juicebox on January 22 this year as a donation to help Tornado Cash co-founder Roman Storm and developer Alexey Pertsev is exempt from legal punishment. As of press time, the fund has received 834 donations totaling 548.49 ETH, or about $1.6 million. Ethereum co-founder Vitalik and crypto trading platform Kraken co-founder Jesse Powell have donated to the fund.

It is worth mentioning that after Pertsev was sentenced yesterday, the number of donations suddenly increased, and some people left messages such as "privacy is not a crime", "code is speech", "defend freedom", "XX stands with privacy and open-source public goods" to support Tornado Cash developers and the "crypto spirit".

The other side of the coin

Although Pertsev himself has always emphasized that he is just a programmer and has no criminal intent. He is "disappointed" that criminals use Tornado Cash to conceal illegal gains, but he can't do anything about it.

When the judge asked Pertsev whether he took the crime seriously enough, he called up the group chat records between Pertsev and co-developers Roman Storm and Roman Semonov. Pertsev responded to the news that the $625 million Axie Infinity Ronin Bridge was hacked with "haha". But Pertsev said that this did not mean that he thought it was funny, but that it was his habit to express surprise.

In addition, an objective fact is that Tornado Cash has remained the largest cryptocurrency mixer since it was sanctioned. Hackers and protocol attackers are still using this tool to launder money.

On the one hand, the verdict of Tornado Cash developers will threaten the future of technological development and privacy. On the other hand, the reality is that from a legal perspective, technology cannot be neutral and must be based on the relationship between people.