Tornado Cash and Free Speech: What Changed by 2026

The Tornado Cash dispute is about where the law draws a line between publishing software and operating or using a financial service. In 2022, the US Treasury Department sanctioned Tornado Cash, a cryptocurrency mixer on Ethereum. Critics argued that the action burdened lawful privacy and chilled the publication of code. The government’s position focused on the service’s alleged role in laundering funds, including funds linked to cybercrime.

The sanctions were removed in March 2025, but that did not settle the broader free-speech question. It did not establish that every privacy tool is protected from regulation, or that every transaction involving a mixer is lawful. Separate court proceedings have also concerned individual defendants and alleged conduct.

For you, the practical lesson is to separate three questions: what the software does, whether the government currently restricts a particular person or service, and whether your own transaction complies with applicable law. A speech argument about code is not a blanket legal safe harbour. Nor does a tool’s privacy purpose prove that its use is safe or lawful.

Tornado Cash is a cryptocurrency mixer: a service designed to make it harder to link a deposit to a later withdrawal. Users send cryptocurrency into a pool and later withdraw it through a process intended to reduce the visible connection between those transactions. That privacy feature can have legitimate uses, but it can also make tracing illicit funds more difficult.

In August 2022, the US Treasury Department added Tornado Cash to its sanctions list. The action restricted dealings involving the designated service under US sanctions rules. The government said the mixer had been used to launder funds, including cryptocurrency stolen by malicious actors. Opponents argued that sanctioning an open-source tool could affect people who wrote, published or used code without being involved in wrongdoing.

The legal timeline matters because the dispute did not end with the initial designation:

Date	What happened
August 2022	The US Treasury sanctioned Tornado Cash.
August 2023	A federal court ruled that the sanctions were lawful in a challenge to the designation.
March 2025	The Treasury removed Tornado Cash from the sanctions list.

Removal changed the sanctions status. It did not resolve every question about software, speech, privacy or individual liability.

The free-speech argument starts with a familiar principle: writing and publishing can be expressive activity. Software developers communicate ideas through code, and a program can be published for others to inspect, adapt or run. Critics of the Tornado Cash sanctions said restricting access to or interaction with a tool could burden that expression, including for people who wanted financial privacy for lawful reasons.

The harder question is whether a government action targets expression itself or regulates conduct associated with a service. A program can be speech in one context and also form part of a financial service in another. Courts may distinguish between publishing source code, operating a service, facilitating transactions and knowingly helping someone evade legal restrictions. Those distinctions depend on the facts and the specific law at issue.

That is why “code is speech” does not answer the whole case. A First Amendment claim may be relevant to whether a restriction is constitutional, but it does not automatically make software immune from regulation. It also does not establish that every user, developer or operator has the same legal position. The dispute is about the boundaries between these activities, not a simple choice between privacy and public safety.

The government’s case was not simply that privacy is undesirable. Officials argued that Tornado Cash had been used to launder cryptocurrency, including funds associated with cybercrime, and that the service had not put effective controls in place to prevent misuse. From that perspective, sanctions were a way to restrict dealings with a service linked to serious financial crime.

Critics countered that a decentralized tool is not the same as a company that can screen customers or change its terms. They argued that sanctioning a set of smart contracts or associated software could affect people who had no connection to criminal activity. They also questioned whether the government could treat autonomous code as property subject to sanctions in the same way as an organization or conventional business.

These arguments concern different risks. The government’s concern is that illicit funds can move through privacy tools and become harder to trace. The civil-liberties concern is that broad restrictions may reach lawful expression and privacy-seeking users as well as criminals. A sound analysis has to consider both: the harm a tool can facilitate and whether a restriction is appropriately limited. Neither side’s general claim establishes what happened in a particular transaction.

Several legal tracks are easy to confuse. The 2023 court decision concerned a challenge to the Treasury’s sanctions designation. A separate criminal proceeding involving Tornado Cash co-founder Roman Storm raised charges against an individual. In September 2024, a judge rejected an argument that the First Amendment required those charges to be dismissed. That ruling addressed a motion in a criminal case; it was not a final answer to every constitutional question about publishing code.

Keep these distinctions in mind:

• Sanctions: restrictions on dealings with designated people, entities or property under applicable rules.
• Constitutional challenge: a claim that government action violates protected rights, such as free speech.
• Criminal case: allegations about a person’s conduct, which prosecutors must prove under the relevant law.

The removal of Tornado Cash from the US sanctions list in March 2025 changed its status under that particular sanctions measure. It did not erase earlier court decisions, decide every issue about code and speech, or automatically resolve any separate case. When assessing a current legal question, check the specific order or rule involved rather than treating “the Tornado Cash case” as one single decision.

For crypto users, the debate is a reason to be precise—not a reason to assume that every mixer is either forbidden or safe. Sanctions can change, and legal rules may differ by country. Even when a service is no longer on a particular sanctions list, transactions can still raise legal issues if they involve sanctioned parties, criminal proceeds or other prohibited conduct.

A privacy feature also does not guarantee security. Smart-contract vulnerabilities, deceptive interfaces, compromised devices and mistakes in wallet addresses can still lead to losses. Mixing may make transactions harder to trace, but it does not make funds untraceable or erase a transaction history. Avoid relying on claims that a tool makes you anonymous or automatically keeps you compliant.

Before interacting with a privacy service, ask:

1. Is the service or a relevant party currently subject to restrictions where I live?
2. Can I identify the contract and understand what permissions a transaction requests?
3. Do I know the source of the funds and the legal obligations that apply to me?
4. Am I comfortable with the possibility that a transaction is irreversible and may attract scrutiny?

If you cannot answer these questions, pause. For a transaction with meaningful legal exposure, ask a qualified lawyer rather than relying on a forum post or a project’s own assurances.

Avoid these common mistakes when you read about Tornado Cash or assess a privacy service:

• Treating removal from the sanctions list as blanket approval. It changed the status of one US sanctions measure; it did not legalize every possible transaction or settle all other laws.
• Assuming a code publication and a financial service are legally identical. Courts may treat publication, operation and transaction facilitation differently.
• Confusing a ruling on a motion with a final verdict. A judge’s decision on whether a case can proceed does not necessarily decide every factual or constitutional question.
• Assuming privacy means anonymity. Public blockchains preserve transaction data, and investigative methods can connect activity to people or entities.
• Relying on old headlines. The 2022 designation, later court decisions and 2025 removal describe different points in a changing legal timeline.

The useful takeaway is that the Tornado Cash fight remains important as a debate over privacy, expression and state power, even though the sanctions designation was removed. For your own decisions, verify the current rule that applies to you, understand what a tool does and avoid treating a broad constitutional argument as personal legal advice.