Crypto Mixer Tornado Cash and the Tumblers Before It

Prepared by the editorial team. Updated August 31, 2026.

Crypto mixer Tornado Cash arrived into a field that already had a decade of history and a settled enforcement pattern behind it. That earlier generation was custodial, which meant every case against it began from the same convenient fact: a person or a company had physically held other people’s money.

What did the earlier generation of tumblers look like?

They were businesses. A customer sent coins to an address the service controlled, the service pooled those coins with others, and after a delay it sent different coins to a destination the customer named, keeping a percentage. Everything about that arrangement, including the pooling and the delay, depended on a company holding the funds throughout.

This model dominated because it was the only one available. Early public blockchains offered no cryptographic mechanism for proving a right to withdraw without revealing which deposit was being withdrawn, so severing the trail meant handing assets to someone who would send back different assets. The privacy achieved was privacy from ledger observers only, since the operator itself knew both ends of every transaction.

Those services were typically run by identifiable people, took fees to identifiable accounts, ran on hosted infrastructure and often advertised openly. Some were built for ordinary financial privacy and some were built explicitly for proceeds of crime, and the design gave outside observers little way to tell which was which without looking at the operator’s own records.

Why were custodial operators straightforward to prosecute?

Because the design produced every element a prosecutor needs. A named human being took possession of funds, exercised discretion over whether to return them, charged a fee for the transfer, and left records showing what was known and when. Money transmission statutes and money laundering statutes are both written around exactly that shape of conduct.

Money transmitting rules in the United States attach to a person who accepts value from one party and transmits it to another for a fee, and they require registration and an anti-money-laundering program. An operator who never registered was in breach on the first day of business, regardless of who the customers were. That is an unusually clean theory to prove, because it turns on the structure of the business rather than on the character of any particular transaction.

Laundering charges required more, generally that the operator knew the funds represented criminal proceeds and moved them to conceal that origin. Here too custody helped the prosecution, because an operator with a support inbox, a pricing page and a customer list leaves behind evidence of what it understood about its own business. Several matters of that era resolved through pleas or settlements rather than contested trials, which meant they produced enforcement outcomes without producing much binding law.

What changed when custody left the design?

Zero-knowledge proofs made it possible to withdraw a deposit without any party holding it. A contract can accept fixed-size deposits recorded as commitments, then release funds to whoever presents a valid proof containing the matching nullifier, releasing each deposit exactly once. No operator ever controls the assets, so the element every earlier case started from is simply absent.

Tornado Cash implemented that pattern on Ethereum, and its core pool contracts were deployed as immutable code with no owner, no pause function and no upgrade mechanism. Nobody could change the rules, refuse a caller, freeze a balance or shut the pools down, including the people who wrote them. Whatever one concludes about the wisdom of that choice, it removed the operator from the middle of the transaction as a matter of engineering rather than of promise.

The consequence for enforcement was not that nothing could be pursued, but that the pursuit had to attach somewhere else. Attention moved to the parties around the system: the developers who wrote and published the software, the interface that was hosted for users, the governance organisation associated with the TORN token, and relayers who submitted withdrawal transactions and took a fee without ever controlling the funds.

How can you trace an enforcement history through primary records?

You locate the original filing rather than the coverage, separate the entity from the individuals, read what was charged rather than what was alleged, check the outcome and its date, and note the law that was in force at the time. This is a research method for reading a legal record, not guidance about any service.

Step 1: Find the original filing rather than the coverage

Locate the indictment, complaint, opinion or agency notice itself, because news coverage compresses a legal document into a claim and the compression is where most later errors enter. Dockets and published opinions are public in most jurisdictions.

Step 2: Separate the entity from the individuals

Note carefully whether the action names a company, a named person or both, since a case against an operator personally supports very different conclusions from an action against a business. Commentary frequently merges the two.

Step 3: Read what was charged, not what was alleged

Distinguish the specific counts brought from the surrounding narrative, because a charging document describes conduct at length while resting on a much narrower list of statutes. The counts are what a court will actually rule on.

Step 4: Check the outcome and the date it became final

Follow the matter to its conclusion and record whether it ended in a plea, a verdict, a dismissal or is still open, since an unresolved case is routinely described as though it were settled. A plea also creates no precedent for anyone else.

Step 5: Note what the law was at the time

Record which rules were in force when the conduct occurred, because guidance and statutes covering money transmission and virtual assets changed repeatedly across this period. Applying today’s framework to a decade-old matter produces a misleading comparison.

Two generations of mixing design

The table sets the older custodial pattern beside the later autonomous one on the points that mattered to enforcement. Each row addresses one feature that shaped how cases were built. It summarises general design characteristics and is not a statement about legality in any jurisdiction.

Feature	Custodial tumbler era	Autonomous pool era
Who holds funds	The operating business	Nobody; code releases against a proof
Privacy mechanism	Trust in an operator to send different coins	Zero-knowledge proof and an anonymity set
Obvious enforcement target	The operator and its officers	Contested; surrounding parties are argued over
Can it be switched off	Yes, by seizure or court order	Not the immutable core contracts
Typical legal outcome	Pleas and settlements, little precedent	Contested litigation producing new rulings

The last row explains why this subject generates so much commentary. The older cases were rarely fought to a judgment, so the newer ones are being argued on a surprisingly thin body of settled law.

Why does the earlier era still shape how the newer one is read?

Because the vocabulary and the assumptions survived the change in architecture. Regulators, journalists and screening tools inherited a mental model in which a mixer is a business with a proprietor, and that model was accurate for roughly a decade. Applying it to code with no proprietor produces conclusions that feel obvious and are contested.

The 2022 sanctions action shows the pattern clearly. Treasury designated Tornado Cash by name in an action recorded in the August 2022 OFAC notice, using an instrument designed for parties holding property interests. In November 2024 the Fifth Circuit held in Van Loon v. Department of the Treasury that the immutable contracts were not property capable of designation, and the name was removed from the sanctions list in March 2025. It is not currently designated.

The inherited model did not vanish with the delisting, and it should not be assumed to be simply wrong. The criminal case against Roman Storm proceeded on a money transmitting theory drawn from the earlier era, and in August 2025 a jury convicted him on one count of conspiracy to operate an unlicensed money transmitting business while deadlocking on two others. A retrial on the undecided counts is scheduled for April 2027, so how far the old framework reaches the new architecture remains an open question rather than a resolved one.

Frequently asked questions

Were early tumblers illegal by definition?

No. Operating a money transmitting business is lawful where the operator is registered and meets its obligations, and the enforcement actions of that era generally turned on failures to register or on knowledge of criminal proceeds. The activity was not treated as inherently unlawful so much as unlawfully conducted.

Did users of custodial tumblers face charges as well?

Enforcement in that period concentrated overwhelmingly on operators rather than on customers, which follows from where the obligations sat. Individual users could still face exposure where their own conduct was independently unlawful, and anyone with a specific concern should raise it with counsel rather than reading a general pattern as a rule.

Does the older enforcement record still bind courts today?

Guilty pleas and settlements create no binding precedent, and much of the earlier record consists of exactly those. Contested rulings carry more weight but were decided on facts involving an operator with custody, so their application to an ownerless design is argued rather than assumed.

Why did some early services fail without any enforcement at all?

Holding other people’s funds creates an obvious temptation and an obvious single point of failure, and several early services simply stopped returning deposits. That risk is a direct consequence of the custodial structure rather than of any legal pressure applied to it.