Worked example · 2022-08

Tornado Cash OFAC sanctions — trust-substrate shift via regulatory action — Ethereum — 2022-08-08

Loss

non-financial at the individual-user level; the loss was a trust-substrate revocation — the structural assumption that a decentralized, immutable smart-contract protocol could not be sanctioned or blacklisted by a sovereign regulator was invalidated by the OFAC action. Downstream effects included: removal of Tornado Cash from DeFi frontend integrations (Uniswap Labs blocked TRON-associated wallet addresses in its frontend; Aave, dYdX, and other DeFi frontends followed); GitHub repository takedown; domain seizure; and the arrest of Tornado Cash developer Alexey Pertsev in the Netherlands (August 2022). The OFAC designation established the precedent that smart-contract addresses can be sanctioned entities under U.S. law — a trust-substrate shift with cohort-level consequences for every DeFi protocol whose users relied on the "code is law / immutable smart contract cannot be censored" assumption.

OAK Techniques observed

OAK-T7.009 (Sanctioned-Entity and Illicit-Purpose Financing) — the canonical T7.009 regulatory-designation action: the U.S. Treasury OFAC SDN designation of Tornado Cash smart-contract addresses established the precedent that cryptocurrency mixer addresses can be designated entities under U.S. sanctions law, creating the compliance-screening obligation that underlies T7.009 detection at the CEX/VASP layer. OAK-T6.007 (Trust-substrate Shift / Vendor-side Promise Revocation — broadly construed at the regulatory-action level; the U.S. Treasury OFAC designation revoked the load-bearing trust-substrate claim that "decentralized protocol cannot be sanctioned," structurally identical to a vendor-policy revocation of a trust claim). OAK-T14.005 (Builder Censorship MEV Extraction — downstream effect; post-OFAC, a material share of Ethereum block builders censored Tornado Cash transactions in compliance with OFAC, creating the builder-censorship surface documented at T14.005).

Attribution

unattributed Tornado Cash and associated Ethereum addresses were added to the SDN (Specially Designated Nationals) list on 2022-08-08. OFAC alleged that Tornado Cash had been used to launder ~$7B+ in cryptocurrency since 2019, including ~$455M by DPRK's Lazarus Group. The designation was challenged in court (Van Loon v. Department of Treasury); a Fifth Circuit ruling in November 2024 found that OFAC exceeded its authority in sanctioning immutable smart contracts, but the trust-substrate shift had already been operational for two years.

Key teaching point

The Tornado Cash OFAC designation is the canonical T6.007 regulatory-action anchor: a sovereign regulator's enforcement action revoked the load-bearing trust-substrate claim that "decentralized smart-contract protocols are beyond the reach of sanctions enforcement." The structural lesson is that T6.007 defense-evasion-by-policy-change extends beyond vendor-policy decisions to include regulatory, legal-process, and infrastructure-policy events that reshape user threat models without an attacker present.