On August 6, 2025, a jury convicted Roman Storm of operating an unlicensed money transmitting business for creating Tornado Cash, a decentralized program that lets users protect their financial privacy. The verdict treats the software as if it were a bank, despite the fact that it never held customer funds and ran automatically without human control once deployed. While some criminals used Tornado Cash, so do journalists, dissidents, and ordinary people seeking privacy, just as email, encryption, and cash can be used for both good and bad purposes. Holding a developer responsible for the independent actions of strangers not only misunderstands the technology, it sets a dangerous precedent that could stifle innovation and threaten the tools that protect everyone’s freedom.
On August 6, 2025, a jury in Manhattan convicted Roman Storm, one of the creators of a privacy-focused cryptocurrency tool called Tornado Cash, of operating an unlicensed money transmitting business. The same jury could not agree on two other charges, money laundering and sanctions violations, leaving the verdict split. On the surface, it might sound like Storm was running an underground bank. But the reality is much stranger: the “business” in question was not a business at all. It was a piece of open-source software that Storm and others had written and published, which then ran automatically on the internet without their control.
Tornado Cash was designed to give people privacy in their financial transactions. On public blockchains like Ethereum, every payment is visible to anyone who looks. Tornado Cash worked like a public dropbox: people could put money in, and later take it out to a different address, making it harder for outsiders to link sender and recipient. This is useful for many reasons; activists and journalists operating under repressive regimes can receive funding from supporters abroad without exposing their identities to governments that might imprison or harm them; whistleblowers can accept donations or legal defense funds without revealing personal bank accounts to hostile employers or state actors; businesses conducting sensitive negotiations can move funds without tipping off competitors who monitor public blockchain activity.
What makes Tornado Cash unusual is that it was both permissionless and non-custodial. “Permissionless” means anyone could use it, there was no approval process or operator deciding who could send money through. “Non-custodial” means the software never actually held anyone’s funds the way a bank or PayPal would. Instead, it was a program on the Ethereum network, executing automatically when people interacted with it. The developers didn’t sit in the middle of the transactions; they had no ability to stop or alter them once the program was launched.
That last point is critical. Once the Tornado Cash code was uploaded to the blockchain, it couldn’t be changed or shut down. There was no off-switch and no way for the developers to single out bad actors. This is by design: blockchain systems often aim to be censorship-resistant so they can’t be manipulated by any one person or government. The interface people used to access Tornado Cash could be taken offline, and in fact was, but the underlying program remained accessible to anyone with the technical know-how.
The government’s case treated Tornado Cash as if it were a traditional money service business, the kind that takes custody of your money, moves it to another account, and keeps records of who sent and received it. Such businesses are required to register, verify customer identities, and report suspicious activity. But Tornado Cash never had customer accounts, never took possession of anyone’s money, and never had the power to refuse a transaction.
It’s true that criminals used Tornado Cash, prosecutors alleged that it moved more than $1 billion in illicit funds, including money from North Korea’s Lazarus Group. But that fact alone doesn’t make the developers guilty. The same is true of countless other tools. Criminals use email, but we don’t arrest the people who wrote the email protocol. They use encryption to hide their messages, but we don’t prosecute the mathematicians who invented the algorithms. They use cash to launder money, but we don’t shut down the U.S. Mint.
The law has long recognized that tools are neutral; it’s the intent of the user that matters. You can’t judge a hammer’s inventor based on whether someone later used that hammer to build a house or to commit a crime. In this case, there was no evidence that Storm coordinated with criminals, customized the tool for them, or even had the ability to prevent their use. The jury’s split verdict, convicting on the licensing charge but deadlocking on laundering and sanctions, suggests they weren’t convinced he had the necessary intent, yet still held him responsible for the mere existence of the tool.
The danger of this reasoning is clear: if you criminalize the creation of a tool simply because some people misuse it, you risk outlawing all sorts of technology. Encrypted messaging apps can protect journalists and activists, or criminals. Privacy-preserving financial tools can help whistleblowers and aid workers in hostile environments, or money launderers. The uses are inseparable; you can’t have one without the other.
Tornado Cash was closer to publishing a math formula than to running a bank. It was an automated, immutable program, not a human-operated business. Holding its creator responsible for how strangers used it, when he had no way to monitor or control those uses, breaks with how we’ve treated toolmakers in other areas of law.
The ruling also raises a troubling precedent. If applied broadly, it could mean that writing open-source code, the kind of code that powers most of the internet, becomes legally risky whenever it can be misused. The result could be a chilling effect on innovation, especially in privacy and security technologies.
For ordinary people, the principle at stake is simple: the same technologies that shield activists from repressive governments or protect your bank account from hackers can also be misused by criminals. But if we punish creators whenever their tools are abused, we risk losing those protections entirely. The Tornado Cash case isn’t just about cryptocurrency, it’s about whether we still believe in the neutrality of tools and the freedom to build them.
Disclaimer
The information provided on TheLogbook (the "Substack") is strictly for informational and educational purposes only and should not be considered as investment or financial advice. The author is not a licensed financial advisor or tax professional and is not offering any professional services through this Substack. Investing in financial markets involves substantial risk, including possible loss of principal. Past performance is not indicative of future results. The author makes no representations or warranties about the completeness, accuracy, reliability, suitability, or availability of the information provided.
This Substack may contain links to external websites not affiliated with the author, and the accuracy of information on these sites is not guaranteed. Nothing contained in this Substack constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or other financial instruments. Always seek the advice of a qualified financial advisor before making any investment decisions.