US Treasury sanctions crypto mixing service Tornado Cash and 44 associated ETH and USDC wallets, citing its use in high profile hacks, including by North Korea
- The Treasury is sanctioning DeFi mixing service, Tornado Cash. — The move is the agency's second sanction of a mixing service. Source: U.S. Department … .
Context & Ripple Effects
Treasury had already set a precedent by sanctioning Blender.io over alleged Axie Infinity hack proceeds. The Tornado Cash action extends that approach from one mixer to a service associated with 44 ETH and USDC wallets and high-profile hacks.
The designation became a broader enforcement campaign: Dutch authorities arrested a suspected Tornado Cash developer days later, and OFAC later added a designation connecting the mixer to North Korea’s nuclear weapons program. A federal appeals court ultimately constrained the action, leading Treasury to remove Tornado Cash from its blacklist in 2025.
First-order effects
- Tornado Cash and the 44 named ETH and USDC wallets are brought within Treasury’s sanctions regime, making them the immediate focus of U.S. financial-crime enforcement.
- Treasury establishes Tornado Cash as its second sanctioned mixing service, following the earlier Blender.io designation.
Second-order effects
- The developer arrest in the Netherlands turned the U.S. designation into a cross-border enforcement matter rather than a wallet-only action.
- OFAC’s later North Korea nuclear-program designation broadened the stated rationale from laundering tied to hacks to national-security sanctions exposure.
Third-order effects
- The later removal after an appeals-court ruling shows that sanctions against decentralized crypto services face legal boundaries, even as Treasury continues to use mixer designations against alleged North Korean laundering channels.
- Crypto’s legitimacy gap is increasingly shaped by whether enforcement can distinguish illicit transaction flows from the underlying software and its users.
The trend: Treasury is testing sanctions designations against crypto-mixing infrastructure as part of its response to alleged North Korean theft and laundering, with courts defining the limits of that tool.