Roman Storm, co-founder of the Ethereum-based privacy mixer Tornado Cash, stands convicted of conspiracy to operate an unlicensed money transmitting business. The conviction, handed down in August 2025 by a jury in the Southern District of New York, carries a maximum sentence of five years. But the real story isn’t the conviction itself. It’s the legal theory the DOJ used to get there, and where that theory could logically travel next.
The jury deadlocked on two additional, far more severe charges: conspiracy to commit money laundering and conspiracy to violate sanctions. Each of those carries up to 20 years. The DOJ isn’t letting that go quietly, pushing for a retrial on the deadlocked counts as early as October 2026.
The case against writing code
Tornado Cash launched in 2019 as a non-custodial mixer. In plain terms, it’s a smart contract on Ethereum that lets users deposit crypto and withdraw it later in a way that breaks the on-chain link between sender and receiver. It uses zero-knowledge proofs to verify transactions without revealing details. No company holds your funds. No human intermediary touches them.
That distinction, non-custodial versus custodial, sits at the heart of this case. Traditional money transmitters like Western Union or PayPal take possession of customer funds and move them on the customer’s behalf. Tornado Cash’s smart contracts execute autonomously on the Ethereum blockchain. Storm’s defense has argued, repeatedly, that writing and deploying code that runs without human intervention is fundamentally different from operating a money transmitting business.
