The page on why privacy matters argued that financial privacy is worth keeping, and that on Zcash it is a property you hold by how you use the tool. Its sibling, Privacy under pressure, told the other technical half of the story: the ways privacy can fail in practice — promised but not delivered, made then defeated, or switched off while a bug is fixed. This page is a third kind of pressure, and a different one. Here the privacy technology largely worked as built — and a government responded anyway, through economic sanctions and through criminal charges against the people who wrote and ran the software. The recurring question underneath every case below is the same, and it is not yet settled: when does writing or operating a privacy tool make its author legally responsible for what other people do with it?
A few plain definitions first, because the cases turn on them. A mixer (or tumbler) is a service or program that pools many people's coins together and pays them back out, so that which coins came from whom is hard to follow on a public chain — the funds-level cousin of the network mixnets the privacy page described, which shuffle traffic rather than money. Software is non-custodial when it never takes control of a user's coins: the user keeps the keys and the funds throughout, and the code only helps them move their own money. And the SDN list is the sanctions list kept by the US Treasury's Office of Foreign Assets Control (OFAC); US persons generally may not transact with anyone or anything on it.
This page describes legal events and the positions of the parties, attributed and date-stamped; it is current as of 21 June 2026, and because these cases are live it is a snapshot, not a final word. It takes no side on whether any outcome was right, gives no legal advice, and does not predict how the unresolved cases will end. Where a case is still open, it says so.
In August 2022 OFAC sanctioned Tornado Cash, an Ethereum mixer, adding its smart-contract addresses to the SDN list. Treasury's stated reason was that the service had been used to launder more than $7 billion in virtual currency since 2019, including over $455 million stolen by the Lazarus Group, a hacking unit attributed to North Korea. The designation was novel because the thing sanctioned was not a company or a person but a set of autonomous smart contracts, including immutable ones that no one could switch off — and critics, including the crypto-policy nonprofit Coin Center, argued that placing open, unowned code on the sanctions list swept up lawful users along with criminal ones.
That objection was tested in Van Loon v. Department of the Treasury. Six Tornado Cash users sued, and in November 2024 the US Court of Appeals for the Fifth Circuit ruled (No. 23-50669) that the immutable smart contracts are not "property" under the statute OFAC relied on — because they cannot be owned or controlled by anyone, even their creators — and so the agency had exceeded its authority. The court reversed the decision below and sent the case back. Following that ruling, Treasury removed Tornado Cash from the sanctions list in March 2025. As of June 2026 the protocol's contracts are off the SDN list; the decision settled one narrow point — that this kind of immutable code is not sanctionable property — and not the broader questions the criminal cases raise.
The sanctions case was about the software. A separate set of cases is about the people who built and ran it, and those went a different way. In August 2023 the US Department of Justice charged two Tornado Cash co-founders, Roman Storm and Roman Semenov, with conspiracy to commit money laundering, conspiracy to violate sanctions, and conspiracy to operate an unlicensed money-transmitting business. The government's position is that the founders knew their service was moving criminal proceeds — including for the Lazarus Group — and profited from running it. The defense, backed by civil-liberties and crypto-policy groups such as Coin Center and the DeFi Education Fund, is that Tornado Cash is non-custodial open-source software whose authors never controlled anyone's funds, that publishing code is protected expression, and that holding a developer criminally liable for users' conduct would chill the writing of privacy tools.
Storm was tried in the Southern District of New York. In August 2025 the jury returned a split verdict: it convicted him on the count of conspiring to operate an unlicensed money-transmitting business, but deadlocked on the two more serious counts — money laundering and sanctions violations — and the judge declared a mistrial on those. As of June 2026, Storm is awaiting sentencing on the count he was convicted of (which carries a statutory maximum of five years), prosecutors have signaled their intent to retry the two deadlocked counts, and the second founder, Semenov, remains at large outside US custody.
A parallel prosecution ran in the Netherlands against a third developer, Alexey Pertsev — a separate country, a separate court, and a separate body of law. In May 2024 the Oost-Brabant District Court convicted him of money laundering and sentenced him to 64 months (just over five years), reasoning that Tornado Cash as he built and ran it did nothing to prevent the laundering of criminal funds — at least roughly $1.2 billion of it, traced to dozens of identified hacks and treated by the court as a lower bound. Pertsev appealed; Coin Center filed an expert opinion to the appeals court supporting him, again on the argument that a developer of neutral, non-custodial software should not be liable for how others use it. As of June 2026 his appeal is pending and he has been conditionally released to prepare it.
The Tornado Cash cases mostly concern an Ethereum mixer; the Samourai Wallet case concerns a Bitcoin one. In April 2024 the Department of Justice indicted Samourai's co-founders, Keonne Rodriguez (CEO) and William Lonergan Hill (CTO), on conspiracy to commit money laundering and conspiracy to operate an unlicensed money-transmitting business, alleging the service had executed over $2 billion in unlawful transactions and facilitated more than $100 million in laundering from dark-web markets. As with Tornado Cash, the government's position was that the operators knowingly moved criminal proceeds, while privacy advocates — the Cato Institute called the charges a "chilling moment for financial privacy" — framed Samourai as non-custodial privacy software and warned against criminalizing the people who write it.
This case did not reach a contested verdict. After an unsuccessful bid to dismiss the indictment, both founders pleaded guilty in 2025 to conspiracy to operate an unlicensed money-transmitting business. In November 2025 Judge Denise Cote sentenced Rodriguez to five years and Hill to four; the government described more than $237 million in criminal proceeds laundered through the service, and the founders forfeited assets. As of June 2026 the case has concluded at the trial level.
Put side by side, these cases do not point to a single tidy rule, and it would be wrong to read one into them. Different forums have answered different slices of the question differently: a US appeals court held that immutable smart contracts cannot be sanctioned as "property"; a New York jury convicted one developer of a money-transmitting offense while deadlocking on the gravest charges against him; a Dutch court convicted another of money laundering outright; and two Bitcoin-mixer developers pleaded guilty to a money-transmitting charge. None of these decides the general question of when writing or running privacy software makes its author responsible for others' misuse, and several threads are still open — Storm's sentencing and a possible retrial, Pertsev's appeal.
The honest summary is the one the privacy page started with, carried one step further. That page said privacy on Zcash is a property you keep by how you use the tool. These cases add that the tools themselves sit in a contested and shifting legal space — one that differs by country and by which part of the law is at issue, and that is still moving as of 21 June 2026. That contest is a fact a reader should know before relying on any such tool; this page records it, and leaves the judgment, and any decision about one's own situation, to the reader and to qualified legal counsel.