Macauley Peterson

Yesterday’s <a href="https://blockworks.co/news/roman-storm-guilty-one-count">partial verdict</a> in U.S. v. Roman Storm is about more than the fate of one Tornado Cash developer. It dampens hopes of giving DeFi protocols greater access to the US market by sending chills through the entire open‑source community.



Storm was found guilty under <a href="https://www.law.cornell.edu/uscode/text/18/1960">18 U.S.C. § 1960(b)(1)(C)</a>, which treats noncustodial code as &#8220;money transmitting&#8221; and thus a criminal offense, if it&#8217;s used by anyone for illicit purposes. In the <a href="https://x.com/preston_vanloon/status/1953137607853871516">words</a> of Ethereum core developer Preston van Loon: “This is a dark day for crypto and [Roman Storm].”



<h2 class="wp-block-heading">Sketchy legal foundations</h2>



At issue in rendering a verdict was how § 1960 defines “money transmission.” The law requires transmitting funds on behalf of the public and has traditionally meant moving others’ money as a custodial intermediary — not publishing permissionless code. Yet SDNY prosecutors convinced the jury that deploying <a href="https://blockworks.co/news/tornado-cash-sanctions-expose-potential-defi-achilles-heel">immutable smart contracts</a> meets that definition.



Coin Center executive director Peter Van Valkenburgh spoke to the flawed logic in <a href="https://twitter.com/i/spaces/1vAxRDQZeDDGl">a must-listen X space</a> on Wednesday: “I can’t transfer your funds if I don’t have them in my possession and in my control.” And yet that’s exactly how Storm’s Tornado Cash functioned: no custody, only code.



The government also shut out FinCEN’s own 2019 <a href="https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf">guidance</a> on the matter, which explicitly carves out non‑custodial software providers from Money Service Business (MSB) liability, as DeFi Education Fund&#8217;s Amanda Tuminelli explained: “The DOJ said they don’t have to listen to that guidance…They can come up with their own interpretation.”



That <a href="https://blockworks.co/news/doj-trial-tornado-cash-roman-storm">disregard for regulatory alignment</a> undermines legal clarity and due process.



<h2 class="wp-block-heading">A warning for every DeFi dev</h2>



What happens when writing neutral, useful software tools becomes laden with risk? This verdict signals that simply publishing code could mean criminal liability — regardless of intent or control. Yes, it’s just one case, but this guilty verdict still will embolden prosecutors and intimidate developers.



Even more alarming: It exemplifies how jurisdiction is elastic. Peter Van Valkenburgh aptly calls SDNY “the sovereign District of New York,” capable of reeling in any dev, anywhere, if even a single user in Manhattan runs your code. This worry is no longer theoretical. Between Storm’s conviction and the Samourai Wallet developers’ recent plea deal, it’s a blueprint for future prosecutions unless the law is changed, or the interpretation repudiated.



<h2 class="wp-block-heading">DOJ’s approach: Unfair, hypocritical and dangerous</h2>



Let’s call it what it is: Prosecuting a developer who doesn’t touch users’ funds while letting large financial actors facing multi‑billion‑dollar laundering scandals skate by is hypocrisy.



Compared to world-scale financial scandals involving multinational banks, the criminal case against Storm is outrageous. In cases like <a href="https://www.bbc.com/news/topics/cm8m6leejrkt">the 1MDB scandal</a>, where over $4.5 billion was siphoned from Malaysia’s sovereign wealth fund with the help of major global financial institutions, few individuals faced meaningful criminal consequences.



Goldman Sachs, which helped underwrite billions in 1MDB bond sales, ultimately reached a deferred prosecution agreement with the DOJ in 2020. The bank <a href="https://www.reuters.com/markets/asia/goldman-sachs-its-role-multi-billion-dollar-1mdb-scandal-2023-10-12/">paid $2.9 billion in fines</a> but avoided criminal conviction, and no senior executives were charged. Only one former banker for Goldman’s Asia group, Roger Ng, <a href="https://www.theguardian.com/world/2023/mar/09/roger-ng-goldman-sachs-banker-malaysia-1mdb-fraud#:~:text=Roger%20Ng%2C%20the%20former%20Goldman,frauds%20of%20the%20past%20decade.">received</a> a prison sentence, and the DOJ closed the matter in 2024 without further indictments.



By contrast, Roman Storm&#8217;s role was limited to writing and deploying open-source smart contracts that others used, yet even on the lesser money-transmitter count, he faces up to a maximum of five years prison time. (Storm himself <a href="https://x.com/EleanorTerrett/status/1953146088602427664">sounded an optimistic note</a> following the verdict.)



Legal experts argue that this represents <a href="https://blockworks.co/news/appeals-court-dismiss-tornado-cash-suit">a double standard</a> in enforcement. “If you don&#8217;t handle other people’s money,” said Van Valkenburgh, “you shouldn&#8217;t be held to the same regulatory expectations as a bank like Credit Suisse or Goldman Sachs.”



The DOJ’s approach not only criminalizes innovation but diverts enforcement resources away from large-scale financial misconduct that poses far greater systemic risk. While traditional financial institutions routinely secure settlement deals for billion-dollar offenses, developers facing felony charges will think twice before publishing open-source tools that promote privacy and financial autonomy.&nbsp;



<h2 class="wp-block-heading">Political remedies needed</h2>



The Blockchain Regulatory Certainty Act (BRCA), now tacked onto the <a href="https://blockworks.co/news/us-house-passes-clarity-act">CLARITY market‑structure legislation</a>, would codify that non‑custodial developers are not money transmitters, aligned with the <a href="https://blockworks.co/tag/fincen">FinCEN</a> guidance. Van Valkenburgh describes it as a “really good simple statutory drafting exercise to clamp the brakes on this abuse of prosecutions.”



But even if that makes it through Congress — still a big if — CLARITY isn’t retroactive, so it won’t help Storm. Yet it can spare future developers.



“There’ll be a moment in a couple of months where it might be important to call your senator,” Van Valkenburgh said.



On the other side of the regulatory spectrum stands SEC Commissioner Hester Peirce. In <a href="https://www.sec.gov/newsroom/speeches-statements/peirce-remarks-blockchain-conference-080425">a speech this week</a>, she emphasized financial privacy as a constitutional right and warned against treating privacy‑protecting code as criminal. She reminded us: “Denying people financial privacy — whether through sweeping surveillance programs or restrictions on privacy‑protecting technologies — undermines the fabric and freedoms of our families, communities, and nation.”&nbsp;



Peirce also preached disintermediation — the idea that technology should obviate the need for intermediaries, and not add new mandates. She warned against deputizing private actors to surveil each other, saying it’s “antithetical to a free society.”&nbsp;



These principles directly clash with SDNY’s approach: criminalizing neutral tools that enhance one’s financial privacy. Peirce’s vision is of protecting, not policing, innovation.



Storm’s legal team is expected to challenge the conviction in the Second Circuit Court of Appeals, focusing on the misinterpretation of federal law. Key legal questions were foreclosed during <a href="https://blockworks.co/news/tornado-cash-motion-to-dismiss-denied">pretrial motions</a>, not left for the jury, Tuminelli said. “The jury was fenced in on the 1960 charge because they weren’t given the opportunity to really make the decision on the part that’s most relevant… the definition of money transmission,” she said.



The outcome of the appeal could have major implications for the crypto ecosystem. Coin Center is also supporting <a href="https://www.coincenter.org/app/uploads/2025/01/Lewellen-v.-Garland.pdf">a related civil lawsuit</a> in Texas.



The CLARITY Act, while offering no retroactive relief, could lessen the impact of Storm’s guilty verdict, clarifying that publishing noncustodial code alone can’t be treated as a criminal act. Without reform, every DeFi dev runs a risk.



Crypto can feel directionless at times. However, this is a clear fork in the road: What’s decided in the months ahead will shape the future of crypto development both in the United States and outside of it.



Let Tuminelli’s warning mobilize us, Peirce’s plea for privacy guide us, and Van Valkenburgh’s strategy direct us.&nbsp;



The legal battle isn’t over, and the political one is still in the early innings.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forward-guidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/supply-shock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

open source development

Opinion: Tornado Cash developer conviction raises alarm for open-source devs

Sebastian Sinclair

<div id="highlights-block_630ddd07f71d7" class="highlights">
 <ul>
 <li>The FBI has detailed various DeFi hacks and exploits faced by the cryptocurrency industry over the past year</li>
 <li>Due diligence has been urged to ensure investors understand protocols and verify code audits have taken place</li>
 </ul>
 
</div>



Criminals are ramping up efforts to exploit DeFi (decentralized finance) vulnerabilities to steal crypto, the US Federal Bureau of Investigation (FBI) has warned.



The agency said it has noticed a rise in smart contract hacks and is urging investors who’ve fallen victim to related theft to reach out.



“Cyber criminals seek to take advantage of investors’ increased interest in cryptocurrencies, as well as the complexity of cross-chain functionality and open source nature of DeFi platforms,” the agency said in a <a href="https://www.ic3.gov/Media/Y2022/PSA220829" target="_blank" rel="noreferrer noopener">statement</a>.



More than $1.8 billion in digital assets were <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/" target="_blank" rel="noreferrer noopener">stolen</a> from DeFi protocols in this year’s first quarter alone — an almost eightfold increase from 2021’s equivalent period.



The FBI made note of several attack vectors specific to DeFi protocols in the last 12 months, including flash loans, token bridges and oracle price pairs.



Indeed, token bridges in particular have been major targets this year. Harmony’s cross-chain <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Horizon Bridge</a> was hacked for $100 million in June while <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin Network</a>, the Ethereum-linked sidechain for blockchain game Axie Infinity, lost a whopping $625 million three months earlier — the crypto industry’s largest exploit to date.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The <a href="https://twitter.com/hashtag/FBI?src=hash&amp;ref_src=twsrc%5Etfw">#FBI</a> warns that cyber criminals are increasingly exploiting vulnerabilities in decentralized finance (DeFi) platforms to steal investors cryptocurrency. If you think you are the victim of this, contact your local FBI field office or IC3. Learn more: <a href="https://t.co/fboL1N17JN">https://t.co/fboL1N17JN</a> <a href="https://t.co/VKdbpbmEU1">pic.twitter.com/VKdbpbmEU1</a>&mdash; FBI (@FBI) <a href="https://twitter.com/FBI/status/1564337233217273857?ref_src=twsrc%5Etfw">August 29, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Authorities <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">believe</a> North Korean hacking unit Lazarus Group was behind both the Horizon and Ronin bridge incidents. 



Some of the stolen funds were traced to Ethereum-powered crypto mixer <a href="https://cms.blockworks.co/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>. Tornado Cash was blacklisted by the US earlier this month, barring citizens from engaging with the protocol — and, technically, even interacting with digital assets that have passed through it.



<h3 class="wp-block-heading">FBI says open source code allows &#8216;unfettered access&#8217; to bad actors</h3>



The FBI laid out four recommendations for crypto investors; precautionary measures to reduce their susceptibility to theft on the blockchain.



Those include the usual caveats of enlisting professional financial advice and undertaking proper research while ensuring their investments have verifiable code audits.



Investors should also be aware of DeFi liquidity pools with “extremely limited timeframes” to join. The FBI also warned of potential risks associated with open source development, on which much of the crypto ecosystem relies.



“Open source code repositories allow unfettered access to all individuals, to include those with nefarious intentions,” the agency said.



It should be noted that several protocols who’ve undergone code audits have fallen victim to exploits outside their control, though security appears to be “getting better,” Immunefi’s CEO Mitchell Amador told Blockworks in an interview in July.



As for the platforms themselves, the FBI advised they should institute real-time analytics and monitoring while continuously testing their code.



Development of an incident response plan to make investors aware of when an exploit has occurred should also be front and center, it said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forward-guidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/supply-shock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>