The conviction of Tornado Cash co-founder and developer Roman Storm could set a “dangerous” precedent for developers and privacy, legal observers in the crypto space say.
Storm was found guilty of operating an unlicensed money-transmitting business on Wednesday, Aug. 6. The crime carries a maximum sentence of five years. The jury could not reach a consensus on charges of conspiracy to commit money laundering and conspiracy to violate US sanctions. Federal prosecutors could still retry him on these two charges.
While Storm is yet to face sentencing, other crypto-related cases, including former FTX CEO Sam Bankman-Fried and OneCoin co-founder Karl Greenwood, were tried and found guilty in the same district and ended up serving prison time.
Legal professionals and industry observers have decried the verdict, saying that it sets a dangerous precedent for open-source developers and has implications for user privacy.
Roman Storm convicted amid Tornado Cash money laundering concerns
Created in 2019, Tornado Cash is a cryptocurrency mixer and a privacy tool that masks the origin of funds. The tool, founded by Storm, Alexey Pertsev and Roman Semenov, quickly drew the attention of regulators, particularly in the US, which sanctioned the project over its potential use for money laundering before delisting it in March.
Pertsev was arrested in August 2022 in the Netherlands, where he is facing a legal fight of his own. Storm was arrested in the US just one year later, while Semenov remains at large and is on the Federal Bureau of Investigation’s most wanted list.
Some have maintained that the Tornado Cash devs cannot or should not be held liable for the actions of the platform’s users, particularly if that platform, as was the case with Tornado Cash, did not have custody or control over the funds. Critics and the US government, particularly, maintained that they are responsible.
Judge Katherine Failla denied a motion to dismiss the case in September 2024, stating that Tornado Cash qualified as a money transmitter, regardless of whether the developers had control over the funds. As such, they should have enacted the same Anti-Money Laundering and Know Your Customer measures as any other such platform.
The privacy-focused crypto community has closely followed the case, and now, with Storm being found guilty, there is concern over what this means for decentralized finance (DeFi) and software development.
The Blockchain Association, a crypto industry lobby group in Washington, said on Wednesday that the ruling “sets a dangerous precedent for open-source software developers.”
The association also referred to an amicus brief (a filing made in support of a party in a lawsuit, in this case, Tornado Cash) in which it noted that Storm did not exercise control over the crypto that went through the protocol.
Related: Roman Storm’s early passion for code led to Silicon Valley, Tornado Cash — and a guilty verdict
“Roman Storm built privacy tech that operated without his custody/control over the funds of Tornado Cash users. […] Tornado Cash functioned as non-custodial software, meaning that users maintained total control of their assets at all times,” the association said.
The Blockchain Association further stated that the verdict not only threatens open-source software but also “fundamentally misapplies money transmitter laws.” It concluded that this prosecution would “criminalize developers of browsers, messaging apps, or any software misused by bad actors, seriously threatening America’s leadership in tech.”
The Solana Policy Institute stated that the conviction means developers can face criminal liability even when they build non-custodial, open-source protocols that relinquish control through immutable smart contracts and have no ability to control misuse.
According to the group, this represents a “fundamental misunderstanding” of decentralized technology and how it can or should be regulated.
What’s ahead for Storm and open-source software development?
While far from the outcome the crypto industry wanted, not all is lost.
Andrew Rossow, policy and public affairs attorney and principal at Rossow Law, told Cointelegraph that the split verdict “isn’t just about a man or a mixer. It’s a referendum on individual agency in the age of open-source code.”
Rossow noted that while the verdict “casts a shadow” over developer liability, the fact that the jury was unable to come to a verdict on the other two charges “upholds the standard that code itself is not ‘criminal’ — especially in censorship-resistant, permissionless environments.”
The question of “whether creators of neutral software should bear criminal responsibility for its misuse” remains. According to Rossow, the case also exposes the justice system’s current inability to comprehend and adjudicate decentralized technology.
And still, “the jury’s silence on the hardest questions is the opening for the industry to speak.”
Industry groups are planning to do just that. The Solana Policy Institute is pressing for Congress to pass the CLARITY Act, which, among other things, would give legal definitions and carve-outs for some aspects of DeFi activity.
The Blockchain Association stated that the administration of US President Donald Trump needs to stop “regulation by prosecution,” a reference to the more commonly used phrase “regulation by enforcement” that characterized regulators’ approach to crypto under former President Joe Biden.
There is also the possibility of an appeal. “The fight isn’t over,” said Crypto Council for Innovation (CCI) CEO Ji Kim. “An appeal to the Second Circuit awaits. Regulatory clarity is also needed to clarify the definition of a money transmitter,” he said.
The CCI, another crypto industry lobby group, called an appeal “necessary,” while the Blockchain Association urged the same.
Storm has made no public statements following his conviction. It is still unknown whether he will seek an appeal, and his sentencing date is pending.
The crypto industry and its supporters will clearly not take the verdict lying down. One day after the ruling, the Ethereum Foundation pledged to match $500,000 to Storm’s continued legal expenses. Hsiao-Wei Wang, co-executive director of the foundation, said, “Privacy is normal, and writing code is not a crime.”
Magazine: How Ethereum treasury companies could spark ‘DeFi Summer 2.0’
