In a ruling eagerly awaited by the cryptocurrency industry, the US Court of Appeals for the Fifth Circuit held that immutable smart contracts on the Tornado Cash crypto-transaction software protocol are not “property” subject to the sanctions jurisdiction asserted by the Office of Foreign Assets Control (OFAC). Relying on the US Supreme Court’s decision in Loper Bright Enterprises v. Raimando, the circuit court ruled that the unique nature of immutable smart contracts means they lack the classic characteristics of property as that term is used in OFAC’s sanctions regulations, and as a result, OFAC’s ability to sanction Tornado Cash and the smart contracts is limited.
While there are issues left to later jurisprudence, the circuit court’s decision provides clarity with respect to at least one issue of importance to the industry and potentially signals to practitioners that, following Loper Bright, courts may construe OFAC’s authority more restrictively than in the past.
In late 2022, OFAC designated as a sanctioned party Tornado Cash, which, as an open-source crypto-transaction software protocol, facilitates anonymous cryptocurrency transactions. Tornado Cash, according to OFAC, allowed bad actors to launder cryptocurrency by obfuscating the origins and destinations of digital asset transactions. OFAC asserted that Tornado Cash had been used by, among others, the North Korea-linked hacking group Lazarus, to launder the proceeds of cybercrimes.
According to OFAC’s November 8, 2022 press release, “Tornado Cash . . . provide[d] virtual currency mixing services, [that] obfuscated the movement of over $455 million stolen in March 2022 by the OFAC-designated, DPRK-controlled Lazarus Group in the largest known virtual currency heist to date.” OFAC’s designation placed Tornado Cash on the list of Specially Designated National and Blocked Persons (SDN). As a result, US persons were prohibited from engaging in any dealings with Tornado Cash. OFAC’s designation of Tornado Cash also included certain virtual currency wallet addresses associated with Tornado Cash and the URL address for Tornado Cash’s website.
Six Tornado Cash users promptly sued OFAC, claiming that the designation exceeded OFAC’s authority, asserting that the “immutable”[1] smart contracts were not “property” as defined in the International Emergency Economic Powers Act (IEEPA), the law upon which the Executive Orders establishing the sanctions programs relied, and therefore beyond the scope of the statutory authority underpinning OFAC’s action designating Tornado Cash. After losing before the district court, the users appealed to the Fifth Circuit, which issued its opinion on November 26, 2024. While Tornado Cash included (at the time of OFAC’s action) both mutable and immutable smart contracts, the plaintiffs sued on the basis of their use of the immutable contracts, and the court’s opinion relies on the nature of these immutable contracts as an essential aspect of its decision regarding the reach of OFAC’s jurisdiction.
The Fifth Circuit held that under the standard set forth in Loper Bright, “heightened deference” was no longer due OFAC’s definition of the key terms at issue: “property,” foreign “national,” “person” or “entity,” and “interest.”[2] As a result, the Court engaged in a detailed analysis of whether the Tornado Cash software protocol could be squared with any traditional definition of “property,” and concluded it could not. Focusing first on the nature of property, the Fifth Circuit reached into the long history of common law, setting forth the definition of property under long-settled legal principles:
Property includes “everything which is or may be the subject of ownership, whether a legal ownership, or whether beneficial, or a private ownership.” Similarly, it is “the condition of being owned by or belonging to some person or persons” and encompasses “the right to possess, use, and dispose of something.” It also includes the right “to exclude everyone else from interfering with it.”[3]
Relying on this well-established set of defining traits, the court concluded that the immutable smart contracts used by Tornado Cash could not meet any of the historical definitions of the term “property”:
The immutable smart contracts at issue in this appeal are not property because they are not capable of being owned. More than one thousand volunteers participated in a “trusted setup ceremony” to “irrevocably remov[e] the option for anyone to update, remove, or otherwise control those lines of code.” And as a result, no one can “exclude” anyone from using the Tornado Cash pool smart contracts. In fact, because these immutable smart contracts are unchangeable and unremovable, they remain available for anyone to use and “the targeted North Korean wrongdoers are not actually blocked from retrieving their assets,” even under the sanctions regime. Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.[4]
The Fifth Circuit also rejected OFAC’s assertion that the agency’s long-standing regulatory definition of “any property” supported a different result. Instead, the court took the opportunity to emphasize that the immutable contracts “even under OFAC’s definitions, . . . still must be ownable; (2) they aren’t contracts; and (3) they aren’t services. And accordingly, the immutable smart contracts are outside the scope of OFAC’s [sanctions] designation authority.”[5] While the circuit panel recognized “the real-world downsides of certain uncontrollable technology falling outside OFAC’s sanctioning authority,”[6] it declined to engage in what it saw as “judicial lawmaking—revising Congress’s handiwork under the guise of interpreting it.”[7]
The Fifth Circuit’s decision could be appealed by OFAC, which could lead to a Supreme Court review of these issues. If OFAC elects not to appeal the decision, it may determine that the Tornado Cash designation can remain in place on grounds unrelated to the immutable contracts.
The Fifth Circuit’s decision confirms several key sanctions concepts that have been discussed in cases over the last several years. First, the court noted that OFAC’s jurisdiction is not unfettered and that it is bound by the plain language of the statute—here, IEEPA. The court highlighted its own responsibility to interpret the law, not to read new terms into the statute or regulations, regardless of whether the court agrees with the policy result.
Second, through its detailed analysis of statutory construction and citation of the Loper Bright decision, the court provided some certainty to parties subject to OFAC’s jurisdiction that the agency must still meet the requirements of its own regulations, even if policy objectives counsel for a broader reading. In this instance, the court emphasized that the existing statutory and regulatory limitations require congressional legislation to address any gaps in how terms are defined. For now, absent congressional action, the term “property” is cabined in by the traditional legal concepts of ownership.
Third, the court’s analysis demonstrates the difficulties in applying long-standing statutes to rapidly developing technologies—where advancements often outrun the ability to legislate and regulate.[8] While blockchain and cryptocurrencies are no longer new concepts, the rapid growth and evolution of the industry and its products, highlighted by continuing innovation, often extends beyond the reach of existing laws and regulations. As a result, the ability to regulate such technologies will often require a legislative solution, especially where a technology can be used for nefarious purposes. Even IEEPA’s broad reach has limits.
The court’s decision, therefore, while not wholly unexpected, is nonetheless significant in its impact. It addresses the key issue related to OFAC’s reach for immutable contracts, but leaves open for future decisions the issues of (1) mutable contracts and (2) “entity” status for platforms such as Tornado Cash.
For mixers, like Tornado Cash, that use immutable contracts, the court clearly (and assuming the decision is not later changed by the Supreme Court) places their immutable contract activities beyond OFAC’s sanctioning jurisdiction. And absent legislative updates, the court’s decision provides a more definitive response to the treatment of immutable contracts on these platforms for sanctions purposes.
At the same time, the opinion appears to emphasize that it does not view mutable contracts in the same fashion. Though it does not directly address whether mutable contracts may be subject to OFAC’s sanctions authority, the implication is that these would be viewed differently, and may meet the regulations’ definition of “property” because of the potential for ownership and/or control. However, the Fifth Circuit leaves open the ability to argue the issue at a later day.
The court also declined to address whether Tornado Cash constitutes an “entity” under OFAC’s sanctions regulations.[9] This issue was presented at oral argument and appeared to be more difficult to resolve than the property question. Thus, the court’s decision leaves open the ability of other parties to make this assertion.
Given the current statutory status, the incoming US Congress and administration, the possibility of updates to OFAC’s jurisdiction, and the potential for additional court decisions on the issues the Fifth Circuit did not address, a number of open issues remain.
Nevertheless, this decision provides much-needed clarity.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following:
[1]The court’s opinion defined the difference between mutable and immutable smart contracts in the following manner: “Smart contracts come in two forms: ‘mutable’ and ‘immutable.’ A mutable smart contract is one which is managed by some party or group and may be changed. An immutable smart contract, on the other hand, cannot be altered or removed from the blockchain. Importantly, a mutable contract may be altered to become immutable. But that is an irreversible step; once a smart contract becomes immutable, no one can reclaim control over it.” Van Loon v. Dept of Treasury, Slip op. at 5-6. No. 23-50669 (5th Cir. 2024).
[2] Van Loon, Slip op. at 18.
[3] Slip op. at 20–21 (footnotes omitted).
[4] The court does not provide citations for the quoted terms, which appear from the context to have come from the parties’ briefs discussing the nature of the Tornado Cash platform. Slip op. at 22–23 (emphasis added).
[5] Slip op. at 23–24.
[6] Id. at 33
[7] Id. at 33–34.
[8] As is often said, “law lags innovation.”
[9] “Accordingly, we need not address whether Tornado Cash qualifies as an ‘entity’ or whether it has an ‘interest’ in the immutable smart contracts.” Slip op. at 33.