Worked example · 2022-08

Tornado Cash OFAC sanctions — trust-substrate shift via regulatory action — Ethereum — 2022-08-08

Loss

non-financial at the individual-user level; the loss was a trust-substrate revocation — the structural assumption that a decentralized, immutable smart-contract protocol could not be sanctioned or blacklisted by a sovereign regulator was invalidated by the OFAC action. Downstream effects included: removal of Tornado Cash from DeFi frontend integrations (reported frontend blocking by DeFi interfaces and a GitHub repository takedown, none sourced in this file); and the arrest of Tornado Cash developer Alexey Pertsev in the Netherlands (August 2022) [tbpertsev]. The OFAC designation established the precedent that smart-contract addresses can be sanctioned entities under U.S. law — a trust-substrate shift with cohort-level consequences for every DeFi protocol whose users relied on the "code is law / immutable smart contract cannot be censored" assumption.

OAK Techniques observed

OAK-T7.009 (Sanctioned-Entity and Illicit-Purpose Financing) — the canonical T7.009 regulatory-designation action: the U.S. Treasury OFAC SDN designation of Tornado Cash smart-contract addresses established the precedent that cryptocurrency mixer addresses can be designated entities under U.S. sanctions law, creating the compliance-screening obligation that underlies T7.009 detection at the CEX/VASP layer. OAK-T6.007 (Trust-substrate Shift / Vendor-side Promise Revocation — broadly construed at the regulatory-action level; the U.S. Treasury OFAC designation revoked the load-bearing trust-substrate claim that "decentralized protocol cannot be sanctioned," structurally identical to a vendor-policy revocation of a trust claim). OAK-T14.005 (Builder Censorship MEV Extraction — downstream effect; post-OFAC, a material share of Ethereum block builders censored Tornado Cash transactions in compliance with OFAC, creating the builder-censorship surface documented at T14.005).

Attribution

unattributed Tornado Cash and associated Ethereum addresses were added to the SDN (Specially Designated Nationals) list on 2022-08-08. OFAC alleged that Tornado Cash had been used to launder more than $7B in virtual currency since 2019, including over $455M stolen by DPRK's Lazarus Group [treasjy0916]. The designation was challenged in court (Van Loon v. Department of Treasury); a Fifth Circuit ruling on 2024-11-26 found that OFAC exceeded its authority in sanctioning immutable smart contracts, and OFAC delisted Tornado Cash on 2025-03-21 [paulhastingsdelist]; the trust-substrate shift had by then been operational for over two years.

Key teaching point

The Tornado Cash OFAC designation is the canonical T6.007 regulatory-action anchor: a sovereign regulator's enforcement action revoked the load-bearing trust-substrate claim that "decentralized smart-contract protocols are beyond the reach of sanctions enforcement." The structural lesson is that T6.007 defense-evasion-by-policy-change extends beyond vendor-policy decisions to include regulatory, legal-process, and infrastructure-policy events that reshape user threat models without an attacker present.

Corrected 2026-10-11

Added that OFAC delisted Tornado Cash on 2025-03-21 [paulhastingsdelist]; removed the unsourced '44 addresses' count, the garbled 'TRON-associated' frontend claim and the domain-seizure claim; Pertsev's arrest is dated only to August 2022.