In August 2025 a New York jury found Roman Storm, a co-founder of the crypto mixer Tornado Cash, guilty of conspiracy to operate an unlicensed money-transmitting business. After days of deliberation, the jury could not reach a unanimous verdict on the more serious money-laundering and sanctions-evasion charges.
Prosecutors said the service facilitated more than $1 billion in illicit proceeds, while Storm's defenders argued that writing privacy software is not the same as committing a crime.
Code, control and culpability
The partial verdict left one of crypto's thorniest questions unresolved: how much responsibility developers bear for how permissionless tools are used. The outcome carries significant implications for privacy-preserving DeFi and open-source software far beyond Tornado Cash.
Where liability attaches to code
The verdict left the core question unsettled: whether publishing immutable software constitutes operating a service. Developers are left reading tea leaves.
Privacy tooling has legitimate uses that most users never have to justify in any other financial context. That asymmetry is the substance of the objection.
