The hypocrisy behind the Tornado Cash crackdown
Here we are, more than a week after Tornado Cash has been sanctioned by the U.S. Treasury Department. Its Github, where the roughly 336 code lines of Solidity were posted, has been closed, One of the developers has been arrested by Dutch Police last Friday and its Ethereum token TORN is down by 61% since the announcement as of the writing of this article. One of the most widely used mixers and privacy enhancing projects in crypto has apparently been vanquished. Or has it?
Before figuring that out, here is a short run on what Tornado Cash was (is?). Tornado Cash is a mixer, meaning that a wallet can anonymously send another wallet a set amount of ETH due to Tornado grouping several transactions together. I have written a bit more extensively about mixers and other privacy-focused blockchain projects relating to sanctions in a previous article. As far as the receiving wallet is concerned, it got some funds from Tornado Cash, with no way of discerning what the (previous) origin of the funds really is. The way this works is that a user deposits a fixed amount of ETH and is given a receipt for it. They can then send that receipt to another user so that the same amount of funds can be withdrawn. Private, untraceable and anonymous.
Unfortunately, as is the case with new technology and what are supposed to be fundamental rights, bad actors and criminals abuse the system to their benefit. No example is more notorious than the recent allegedly North Korea-backed Lazarus Group hack on Harmony ONE and previously on Axie Infinity via a bridge on the Ronin network. In both cases, the group apparently used Tornado Cash to make the source of the funds untraceable in their Ethereum addresses. And while money laundering through crypto is definitely an active phenomena, it represents only a small fraction of money laundered world-wide and it pales in comparison to the volumes of dirty money from other sources.
This isn’t to say that we should ignore money laundering and other criminal activities that use blockchain in order to obfuscate law enforcement and facilitate their activities. Criminals everywhere should be caught and tried to the fullest extent of their legal jurisdictions and law enforcement should absolutely use all tools at their disposal to that end. Money laundering is an extremely wide-spread phenomenon and funds can be moved from dark markets into the open through literally any means. Small businesses, constructions that never finish, bank transfers, the art market, the wine market, global shipping and packaging routes, gambling, crypto, you name it.
The United Nations Office on Drugs and Crime estimates that anywhere between 2-5% of the global GDP is laundered every year. This accounts for anywhere between $800 billion and $2 trillion USD. The same office estimates that roughly 10% of the total global economy exists as dark money. According to Chainalisys, roughly $8.6 billion was laundered through crypto in 2021. This would make just over 1% of total money laundered globally if we take into account the lowest estimate by the UNODC. In the United States in 2021 alone roughly $300 billion were laundered, out of which only $2.8 billion (0.9%) through Bitcoin according to Zippia Research. The same analysis states that Bitcoin makes up approximately 0.3% of money laundered globally in the same year.
Of course money laundering is bad. However money laundering through crypto is at best an overcomplicated way to move funds around and at worst a different gimmick to hide the source of money.
I personally do not see how targeting a mixer and “sanctioning” it by destroying some developer’s life counts as crime fighting. How it is anything other than marketing and checking a box in some government mandated KPI list is beyond me. The reason why I believe this is not just because of the quasi-inconsequential impact of crypto money laundering. It’s due to the fact that regulators today still do not understand a very simple fact: You cannot regulate that which is ungovernable.
Sure, the TORN token is down and some devs are arrested or hiding. However Tornado Cash is still very much up and running. I won’t link it here because I do not want to wake up to the police knocking at my door at 3 AM. However the IPFS link to the platform is only a Google search away. Github pages can be 404’s, websites can be shut down and people can be put behind bars. But a smart contract will stay up as long as there are people to use and maintain it. No matter how many analysts and money are put behind shutting them down, mixers, ring signature projects and privacy coins will still exist simply because people need them to exist. Privacy does not equal criminality and I would like to believe that this fundamental right is still that: a right, not a luxury.