Tornado Cash co-founder Roman Storm was found guilty of conspiracy to operate an unlicensed money transmitting business, setting a critical legal precedent for decentralized finance developers.

Executive Summary

A Manhattan jury found Roman Storm, co-founder of Tornado Cash, guilty of conspiracy to operate an unlicensed money transmitting business. This verdict, delivered on a Wednesday, establishes a significant legal precedent for developer responsibility within the decentralized finance (DeFi) ecosystem. The decision has prompted increased caution among DeFi developers and users of privacy tools, signaling potential long-term impacts on innovation in privacy-enhancing technologies and decentralized applications, as legal risks for developers globally are re-evaluated.

The Event in Detail

Roman Storm, a co-developer of the cryptocurrency mixer Tornado Cash, was convicted in the U.S. District Court for the Southern District of New York (SDNY). The jury found Storm guilty of one felony charge related to his role at Tornado Cash: conspiracy to run an unlicensed money transmittal business, which carries a maximum sentence of up to five years in prison. The jury did not reach a unanimous verdict on charges of conspiracy to commit money laundering nor on conspiracy to violate North Korea sanctions, leading to those charges being dismissed or pending. Storm was indicted in August 2023 on charges including money laundering, conspiracy to operate an unlicensed money transmitter, and conspiracy to violate US sanctions, to which he pleaded not guilty.

The prosecution's case centered on the argument that Storm had the ability to modify Tornado Cash's code to prevent illicit use but chose not to. Witnesses from the Federal Bureau of Investigation and the Internal Revenue Service testified to this point. Conversely, Storm's legal team presented experts, including Ethereum core developer Preston Van Loon, who argued for the dual-use nature of the technology, akin to a wrench that can be used for both legitimate and illicit purposes. Supporters, including Ethereum co-founder Vitalik Buterin and Paradigm founder Matt Huang, contributed over $3 million to his legal defense fund.

Financial Mechanics and Developer Liability

The conviction for operating an unlicensed money transmitting business highlights the legal interpretation of Tornado Cash's function. Despite its decentralized and open-source nature, the protocol was deemed to perform a financial service requiring a license. This ruling underscores the tension between decentralized systems and traditional financial regulations, particularly concerning Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements. The case demonstrates that even non-custodial protocols and their developers may be subject to such regulations if their tools are perceived to facilitate financial transactions without proper licensing.

This follows a broader trend of legal challenges to DeFi privacy tools. Alexey Pertsev, another Tornado Cash developer, was sentenced to five years and four months in prison in the Netherlands in May 2024 for money laundering. In contrast, the U.S. Treasury Department removed Tornado Cash from its sanctions list in March 2025, following a November 2024 court ruling that its core smart contract did not qualify as "property." However, this withdrawal of sanctions does not negate developer liability for operating an unlicensed money transmission service.

Market Implications

The verdict sets a precedent that could pressure developers of decentralized applications to comply with AML/KYC regulations, even for protocols designed to be non-custodial. This outcome has sparked debate on whether open-source code authors should be held liable for misuse of their tools, potentially leading to a chilling effect on innovation in privacy-enhancing technologies within the Web3 ecosystem. Investors now face increased scrutiny in assessing the risks of funding projects operating in regulatory gray areas.

Broader Context

The U.S. Department of Justice (DOJ) announced a policy shift in 2025, clarifying that developers of "truly decentralized" protocols will not face criminal charges unless there is explicit intent to facilitate illegal activity. While this aims to provide some clarity and foster "balanced innovation," the policy is not retroactive and leaves cases like Storm's to navigate a complex legal landscape. The industry has actively advocated for developer protection, with over 110 crypto entities, including the DeFi Education Fund (DEF) and the Blockchain Association, urging lawmakers to shield software developers and non-custodial service providers from regulatory liability.

Concerns regarding global regulatory divergence and compliance costs have been linked to a decline in U.S. open-source blockchain developers, with their share dropping from 25% to 18% between 2021 and 2025. The Tornado Cash case, alongside ongoing legal battles such as SEC v. Ripple, highlights the persistent tensions between anti-money laundering goals and protecting developer freedoms in the evolving digital asset space.