Tornado Sanctions Test Resilience of DeFi Privacy Community

In the wake of the U.S. government’s sanction of Tornado Cash last week, it feels like the Feds have declared war on privacy-first crypto projects. Now several of those ventures are hoping for a truce.

Representatives of those projects say there’s a solution that can benefit all parties — users, protocols, and the state. The solution, they argue, stems from technology that allows a user to conceal blockchain-based transaction history but reveal it on demand by law enforcement.

Jon Wu, head of growth at Aztec Network, a self-styled VPN for Ethereum, said that anti-money laundering protections can be put in place without sacrificing user privacy.

Pragmatic Approach

“I think the industry would be ignorant not to think that we could get away with technologies that are not proactively compliant, and I think Aztec and many other privacy networks are committed to finding that middle balance,” he said on a Twitter Spaces discussion hosted Thursday by Forta, a blockchain security firm.

The industry would be wise to take a pragmatic approach, said Alan Scott Jr., co-founder of Railgun, a smart contract platform that privatizes cryptocurrency transactions. “You always have to make sure you operate in a way that appeases regulators, broadly speaking,” Scott told The Defiant. “I think there’s a way to have your cake and eat it too.”

That remains to be seen.

Tornado-Linked Arrest in Europe Riles Crypto Mavens

Dutch Police Suspect Tornado Cash Involved in 'Criminal Money Flows'

The Defiant

On Aug. 8, the U.S. Department of the Treasury’s Office of Foreign Assets Control sanctioned the Tornado Cash protocol and some four dozen associated crypto wallets.

The bombshell sent shock waves through crypto. The accounts of engineers who’ve contributed to Tornado Cash have been removed from GitHub, an critical online software repository. Infura and Alchemy, crypto infrastructure providers, have blocked access to Tornado Cash’s user-facing interface.

Several DeFi protocols, such as Aave, dYdx and Uniswap, have banned some users who have interacted with Tornado Cash. And the value of TORN, the protocol’s governance token, has halved since the sanctions were announced.

Repercussions

What’s gone less noticed is the repercussions for non-financial platforms such as human rights organizations. Activists and non-profits are increasingly turning to blockchain technology to provide support to people and groups struggling to cope with crises ranging from Russia’s invasion of Ukraine to refugees seeking escape from authoritarian regimes such as Syria.

These groups are questioning whether their networks may be next to get swept up in the government’s enforcement action on blockchain projects in the name of a clampdown on illicit finance.

“I think we all recognize that under the hood a lot of things are more centralized than we’d like them to be,” Ryan Wegner, lead security engineer at Polygon, said on the Fortas-hosted Twitter Spaces. “And if Tornado Cash was truly decentralized and everything was perfect, then nobody would care about these sanctions, because the government wouldn’t be able to be effective with their sanctions.”

‘There’s a clear pragmatic need for privacy in this ecosystem. If we want to get large mainstream adoption, people just don’t want to broadcast their financial information.’

Alan Scott Jr.

Others, even less hopeful, say there’s no pleasing regulators, and are bracing for war.

Blockchains are anonymous, but they aren’t private. Once an account is linked to a real person, it is possible to see every transaction that person has ever made from that wallet, and monitor it to see every transaction they make thereafter.

Protocols that emphasize user privacy address that, by concealing the flow of user funds.

Crypto traders benefit by concealing their strategy from competitors. Political dissidents in repressive regimes benefit by hiding transactions that could land them in jail. Regular people benefit by keeping their entire financial history from friends, family, strangers, marketers.

Malicious Cyber Actors

“There’s a clear pragmatic need for privacy in this ecosystem,” Scott said. “If we want to get large mainstream adoption, people just don’t want to broadcast their financial information.”

But privacy protocols are also popular with hackers. Crypto analysis firm Chainalysis estimates about 10% of the crypto to have ever gone through Tornado Cash was stolen. The Treasury said that state-sponsored North Korean cyber criminals used Tornado to launder crypto stolen in the record-setting $600M hack of Axie Infinity earlier this year.

“Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks,” Brian E. Nelson, a senior Treasury official, said in a statement on Aug. 8.

MakerDAO’s Founder Weighs Dropping U.S. Dollar Peg

Tornado Cash Sanctions Spur Christensen to Ponder Radical Move

The Defiant

On a Twitter Spaces forum hosted by crypto privacy firm Espresso Systems Friday, attorneys said OFAC’s sanctions are without precedent.

OFAC should have taken a “rifle” to the problem posed by crypto mixing services and instead used a “blunderbuss,” said Gus Coldebella, formerly the acting general counsel at the Department of Homeland Security and now a partner at venture capital firm True Ventures.

“What we haven’t seen before is when that attacker uses some sort of software to facilitate the thing that the US government wants to knock down, that that software itself is the subject of the sanction,” Coldebella said. “There is no limiting principle.”

Origins of Money

While many protocols offer privacy on the blockchain, Tornado was the most notorious, Katherine Kirkpatrick, general counsel at crypto firm Maple Finance, told The Defiant.

“I think the notoriety and the magnitude of dirty money flowing through Tornado Cash – it was extremely visible, it was the go-to platform of choice for sanctioned entities to mix and obscure the origins of their money,” Kirkpatrick said. “And so they were an obvious target. And the question is, what are the North Koreans going to use next if they can’t use Tornado Cash?”

Kirkpatrick added the sanctions are not legal precedent that would force other privacy-preserving protocols to change their behavior.

“An individual sanction doesn’t mean anything for anyone else,” she said. “That being said, I think if I were in those organizations, I would look very closely at any protections that we had in place — or lack thereof – that prevent this kind of thing from happening on my platform.

How Zero-Knowledge Proofs Became Ethereum's Magic Bullets

Zero knowledge proofs are powerful cryptographic instruments that accelerate innovation on Ethereum, writes Alex Shipp.

The Defiant

She said there is a clear indication that OFAC will pursue platforms that are facilitating wrongdoing, even if they didn’t intend to do that.

Representatives of those organizations say there are ways to deter bad actors.

“Railgun has a viewing key, a ZK proof-of-funds that shows my [Ethereum] address,” Scott said. “So there’s ways for us to have these reporting mechanisms.”

ZK is a reference to zero-knowledge proofs, which are a cryptographic way to show something is true without revealing the underlying data.

Wu of Aztek Network agrees ZK may be a solution. “There are a couple of ways that this could be achieved through zero-knowledge proofs, but I think it’s important for us to have a conversation and for regulators to be proactive about what their expectations are,” he said.

Real-World Identity

Aztec, for example, has a user deposit limit, “which makes it ridiculously onerous for a harge hacker to move funds through the system in a way that’s untraceable,” Wu said.

Wu said Aztec could even implement know-your-customer requirements without sacrificing user privacy. Such requirements, required at traditional financial institutions, are generally loathed among crypto diehards and considered antithetical to the industry’s ethos.

Aztec users could, for example, prove their real-world identity when creating an account. They could furnish a sort of KYC certificate when depositing and withdrawing money in the protocol without actually broadcasting their identity, Wu said.

“Now, is that sufficient for OFAC? In my opinion, it should be, because, as we know, funds are still laundered through banks and centralized exchanges and other KYC domains,” Wu said.

‘If we want actual decentralization, privacy, permissionless finance, whatever, we have to fight now, to defend this, here.’

Ameen Soleimani

Monero, the largest so-called privacy coin by market capitalization, did not respond to a request for comment.

In a statement released Aug. 8, Electric Coin Co., the developer of Zcash, the second largest privacy coin, with a market capitalization of nearly $1B, said “there are concerns about how today’s announcement impacts the civil liberties of United States citizens.”

Electric Coin Co. went on to say it was compliant with existing anti-money laundering and anti-terrorism laws, and cited a study that found the cryptocurrency was not particularly popular with cyber criminals.

Losing Strategy

Skeptics, however, argue Tornado Cash was also compliant.

Henry de Valence, the founder of Penumba, a forthcoming, privacy-preserving DeFi platform, said trying to appease regulators was a “losing strategy.”

Regulators’ “arbitrary and capricious” sanctioning of “legitimate” people who had contributed to or used Tornado Cash has eroded the belief those regulators are acting in good faith, de Valence said.

That’s because Tornado Cash already has a feature allowing users to reveal transaction history the protocol had obscured – exactly the kind of information law enforcement might use in building a case against alleged hackers.

“And that doesn’t seem to matter,” de Valence said. “So why would anybody who’s actually building something be interested in trying to make a regulator’s life easier if the actual way that’s going to play out is, as soon as we start building a compliance feature, then a regulator will say ‘Well how much information can you give us about these users?’ and no matter how much you [give], it’s never going to be enough.”

Others, even less hopeful, say there is no such thing as having one’s cake and eating it too.

“I’m struggling to understand the nuance,” Ameen Soleimani, co-founder of Spank Chain, said on the forum. A protocol is either private, or it isn’t; the government can force its users to reveal their transaction history, or it cannot, he argued.

Sanctions Levied

“The governments will mandate that we have to put a backdoor in every system or they will ban it, so if we want actual decentralization, privacy, permissionless finance, whatever, we have to fight now, to defend this, here,” Soleimani said.

Ultimately, Aztec’s Wu said, society needs to have a discussion around what degree of privacy is acceptable.

“I think that conversation is being had in the most blunt form possible right now,” he lamented. “There is no conversation happening, there are merely technologies being developed and sanctions being levied, but no dialogue about what our society and democracy is willing to tolerate.”