13.3 DeFi, Mixers, and Smart Contract Sanctions

Decentralized Finance (DeFi) and privacy-enhancing technologies present some of the most complex legal and technical challenges in anti-financial crime compliance. By replacing centralized corporate intermediaries with autonomous, self-executing software programs deployed on public blockchains, DeFi eliminates traditional compliance checkpoints. Compliance officers must master the FATF regulatory perimeter governing decentralized arrangements, analyze the cryptographic inner workings of mixing protocols, examine landmark sanctions actions by the US Department of the Treasury's Office of Foreign Assets Control (OFAC), and navigate the legal doctrines governing smart contract sanctions under federal law.

The Architecture of Decentralized Finance (DeFi)

DeFi refers to an ecosystem of non-custodial, open-source financial applications built on programmable smart contract blockchains (predominantly Ethereum, but expanding to Solana, Avalanche, and Arbitrum). Unlike traditional financial institutions or centralized crypto exchanges (such as Coinbase or Kraken), DeFi applications execute transactions without centralized balance sheets, human brokers, or custodial intermediaries.

Core structural pillars of the DeFi ecosystem include:

• Automated Market Makers (AMMs): Decentralized exchanges (DEXs, such as Uniswap or Curve) that replace traditional central limit order books (CLOBs) with algorithmic pricing formulas (e.g., $x \times y = k$). Trades execute against peer-to-pool liquidity reserves contributed by passive liquidity providers (LPs).
• Liquidity Pools: Smart contracts holding aggregated cryptocurrency tokens that enable autonomous lending, borrowing, and token swaps. Users who deposit assets receive LP tokens representing fractional claims on the underlying pool and accrued trading fees.
• Algorithmic Lending Protocols: Autonomous money markets (such as Aave or Compound) where borrowers draw over-collateralized loans directly from pooled reserves without undergoing credit underwriting or identity verification.
• Cross-Chain Bridges: Protocols that lock or burn assets on one blockchain and mint synthetic representations on another, enabling cross-chain capital velocity but serving as primary targets for cyber heists.

Because DeFi protocols operate autonomously on public networks, any user equipped with an internet connection and an unhosted Web3 wallet (such as MetaMask) can interact directly with the underlying smart contracts, bypassing traditional Customer Due Diligence (CDD) and Know Your Customer (KYC) controls.

FATF 2021 Guidance: The "Sufficient Control or Influence" Standard

A central question for global regulators is whether decentralized protocols fall within the statutory definition of a Virtual Asset Service Provider (VASP). In its October 2021 Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs, the FATF established a substance-over-form doctrine:

1. Software vs. Persons: The FATF recognized that pure, self-executing software code running autonomously on a blockchain is not an entity and cannot be designated as a VASP. An autonomous computer program cannot maintain an AML compliance program or file a Suspicious Activity Report (SAR).
2. The Functional Control Test: However, the FATF asserted that the creators, developers, owners, and operators behind a DeFi arrangement often maintain "sufficient control or influence" over the software. If an identifiable natural person or legal entity exercises control or significant influence over the protocol, that person or entity is classified as a VASP under FATF standards.

Indicators establishing sufficient control or influence include:

• Administrative Keys (Admin Keys) and Multi-Sig Powers: Holding cryptographic keys capable of pausing smart contracts, upgrading code logic, blacklisting addresses, or seizing protocol balances;
• Commercial Fee Extraction: Capturing commercial revenue, developer cuts, or transaction fees derived from protocol trading volume;
• Governance Concentration: Holding a controlling allocation of governance tokens within a Decentralized Autonomous Organization (DAO), directing voting outcomes;
• Control Over Centralized Front-Ends: Owning and operating the commercial web domains, cloud hosting servers, and graphical user interfaces (APIs) through which the public accesses the smart contracts.

Under FATF guidance, marketing a platform as a "DAO" or claiming that operations are "decentralized" does not shield operators from regulatory liability if functional control exists. Regulators look past corporate facades to impose AML obligations on the human actors steering the system.

Privacy-Enhancing Technologies (PETs) and Mixer Mechanics

To conceal the transparent transaction audit trail inherent in public blockchains, illicit actors rely heavily on Privacy-Enhancing Technologies (PETs), primarily mixers and tumblers:

Centralized Tumblers vs. Non-Custodial Smart Contract Mixers

• Centralized Tumblers (Custodial): Early mixers (such as BestMixer or Blender.io) operated as custodial money transmitters. Users sent virtual currency to a centralized operator, who pooled the funds, deducted a 1% to 3% service fee, and forwarded randomized coins from other users to designated payout addresses after a timed delay. These entities were unambiguous Money Services Businesses (MSBs) under FinCEN regulations.
• Decentralized Mixers (Non-Custodial): Modern privacy protocols (such as Tornado Cash) operate entirely through immutable smart contracts deployed on public blockchains, removing the human intermediary from custodial possession.

Zero-Knowledge Proofs (zk-SNARKs) and Nullifier Trees

Tornado Cash achieved non-custodial privacy by utilizing Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs). Its operational mechanics follow a structured cryptographic sequence:

1. Deposit: A user deposits a fixed denomination of cryptocurrency (e.g., exactly 1, 10, or 100 ETH) into the Tornado Cash smart contract pool. During deposit, the user's browser generates two random 256-bit cryptographic numbers: a secret and a nullifier. The smart contract computes the hash of these numbers (the commitment) and appends it to an on-chain Merkle tree of deposits.
2. Pooling: The deposited ETH mingles in an omnibus smart contract balance alongside deposits from hundreds of other users, severing direct on-chain linkage.
3. Withdrawal via zk-SNARK: When withdrawing to a brand-new, clean address, the user generates a zk-SNARK cryptographic proof. This mathematical proof proves two things to the smart contract without revealing the underlying data: (a) that a valid commitment corresponding to the user's deposit exists within the Merkle tree, and (b) that the corresponding nullifier has not been previously spent.
4. Relayers: If the user executed the withdrawal transaction directly from their clean wallet, they would need ETH to pay blockchain gas fees, which would create an on-chain link back to their funding source. To prevent this, Tornado Cash utilized third-party relayers. A relayer broadcasts the withdrawal transaction to the network and pays the gas fee, deducting their compensation directly from the withdrawn pool balance, completely breaking the on-chain link.

Historic OFAC Designations: Blender.io and Tornado Cash

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has aggressively targeted virtual asset mixing protocols utilized by cybercriminals and state-sponsored threat actors:

Blender.io (May 6, 2022)

OFAC designated Blender.io under Executive Order (E.O.) 13694 (as amended), marking the first time in history that OFAC sanctioned a virtual asset mixer. OFAC identified that Blender.io was used by the Democratic People's Republic of Korea (DPRK) state-sponsored hacking syndicate known as the Lazarus Group to launder over $20.5 million stolen in the catastrophic $620 million Axie Infinity Ronin Network cross-chain bridge heist.

Tornado Cash (August 8, 2022)

In a historic regulatory expansion, OFAC sanctioned Tornado Cash pursuant to E.O. 13694, as amended by E.O. 13757. OFAC asserted that Tornado Cash had been used to launder more than $7 billion in virtual currency since its inception in 2019, including over $455 million in proceeds stolen by the Lazarus Group from the Ronin Bridge, along with funds from the Harmony Horizon Bridge heist and Nomad Bridge exploit.

Critically, OFAC did not merely designate people or companies; it placed dozens of Ethereum smart contract addresses, including the core pool contracts, directly on the Specially Designated Nationals and Blocked Persons (SDN) List. In November 2023 OFAC also sanctioned the mixer Sinbad.io, which it described as a successor to Blender.io.

The Constitutional and Legal Battle: Immutable Code as "Property" Under IEEPA

The designation of Tornado Cash triggered groundbreaking federal litigation that tested the statutory limits of administrative sanctions authorities (Van Loon v. Yellen in the US District Court for the Western District of Texas and the Fifth Circuit Court of Appeals; Coin Center v. Yellen in the US District Court for the Northern District of Florida).

The Core Legal Controversy

Under the International Emergency Economic Powers Act (IEEPA, 50 U.S.C. § 1701 et seq.), the President (via OFAC) holds the statutory power to block transactions involving "property" in which any foreign country or a "national thereof" has an "interest".

The plaintiffs (crypto users, developers, and industry advocacy groups) challenged the sanctions on several grounds:

1. Immutable Software is Not Property: They argued that once deployed, open-source smart contracts run autonomously and immutably on the Ethereum network; they cannot be altered, controlled, possessed, or deleted by any person, including their original developers. Because no person owns or controls the code, it cannot constitute "property."
2. Tornado Cash is Not an Entity: Plaintiffs argued Tornado Cash is merely functional technology, not a foreign national, partnership, or corporate association.
3. First Amendment: Plaintiffs claimed that publishing computer code is speech protected by the First Amendment, and sanctioning autonomous software violates the constitutional rights of software authors.

What the Courts Decided

• District courts: The district courts in both cases sided with the government, treating Tornado Cash as an entity with an interest in the smart contracts.
• Fifth Circuit reversal: On November 26, 2024, the Fifth Circuit reversed in Van Loon v. Department of the Treasury. It held that immutable smart contracts are not "property" under IEEPA, because once deployed no one can own, control, or exclude others from them. OFAC had therefore exceeded its statutory authority in sanctioning them.
• Delisting: On March 21, 2025, Treasury removed Tornado Cash and more than 100 associated addresses from the SDN List.
• Criminal cases continue separately: Delisting did not end prosecutions of individuals. In August 2025, a U.S. jury convicted Tornado Cash co-founder Roman Storm of conspiring to operate an unlicensed money transmitting business; it did not reach verdicts on the money laundering and sanctions charges.

The compliance lesson is narrower than "code can never be sanctioned." OFAC can still designate the people and entities behind a mixer, and the addresses they own or control, as it did with Blender.io and Sinbad.io. The Fifth Circuit's reasoning turned on the contracts being immutable.

Compliance Obligations for Regulated VASPs

Where addresses or entities are on the SDN List, U.S. persons and VASPs with a U.S. nexus have mandatory duties:

Real-Time Inbound and Outbound Smart Contract Screening

VASPs must load all OFAC-listed digital currency addresses into their screening tools and refresh them when OFAC adds or removes entries. If an incoming deposit comes directly (1-hop) from a listed address, or a customer asks to withdraw to one, the VASP must block or reject the transaction as the applicable regulations require. After the March 2025 delisting, Tornado Cash addresses must come off sanctions blocklists, although firms may still treat mixer exposure as high risk under their own policies.

Mitigating Malicious "Dusting Attacks"

Following the Tornado Cash designation, anonymous activists orchestrated a high-profile "dusting attack", sending micro-transactions (e.g., 0.1 or 0.01 ETH) from sanctioned Tornado Cash pool contracts to hundreds of prominent public figures, celebrities, and exchange deposit addresses without their consent.

OFAC responded in FAQ 1076 that it would not prioritize enforcement against people who merely received such unsolicited "dust". The episode remains a useful lesson for any future designation: unsolicited transfers from a sanctioned address are a real-world risk, and firms need a documented, proportionate way to handle them.

OFAC Blocked Property Reporting Under 31 CFR § 501.603

When a VASP identifies and blocks assets interacting with an SDN-designated smart contract, it must adhere to strict administrative requirements:

1. Blocking and Segregation: Blocked virtual currency must be held so that no one can use it, with a record of its value. OFAC does not require virtual currency to be converted to fiat or held in an interest-bearing account (OFAC FAQ 646). The VASP is prohibited from returning blocked property to the sender, as that would be an unlawful transaction.
2. 10-Business-Day Reporting Requirement: Pursuant to 31 CFR § 501.603, the VASP must submit a formal Report on Blocked Property to OFAC within 10 business days of the blocking action. The report must specify the owner, value, date, transaction hash, and smart contract address involved.
3. Annual Report of Blocked Property: By September 30 of each year, the VASP must submit an aggregate annual report of all blocked property held in its custody.

Suspicious Activity Reporting (SAR) Requirements

OFAC and FinCEN are separate bureaus with separate reports. Under FinCEN guidance, a blocking report to OFAC satisfies the SAR obligation for the sanctions match itself, but if the institution has other facts that make the activity suspicious (for example, the customer knowingly used a sanctioned service), it must also file a Suspicious Activity Report (SAR) under its SAR rule (31 CFR § 1022.320 for MSBs).

Comparative Analysis of Privacy Technologies and Sanctions Exposure

The following table outlines the operational, cryptographic, and regulatory distinctions across prominent virtual asset privacy technologies:

Realistic Exam Scenario

A sanctions compliance officer at a licensed US cryptocurrency exchange investigates an automated alert. A customer, whose verified account has been active for over a year, submitted a deposit request for 20 ETH (approximately $60,000). The exchange's blockchain analytics API flagged the deposit within the mempool, indicating that the incoming funds come directly from a digital currency address that OFAC lists as belonging to the sanctioned mixer Sinbad.io.

Compliance Officer Action and Resolution:

1. Immediate Transaction Freezing: The compliance officer ensures the exchange's core ledger prevents the 20 ETH from being credited to the customer's tradeable balance. The transaction settles into a segregated, blocked custodial wallet.
2. Prohibition on Fund Reversal: The customer contacts customer support, claiming they made a mistake and requesting that the exchange "reject" the deposit and return the 20 ETH to the originating wallet. The compliance officer denies the request; under OFAC regulations, returning blocked property to a sanctioned address or SDN is a severe criminal and civil violation.
3. OFAC Blocked Property Filing: Within 10 business days of the blocking action, the compliance officer completes and submits an official Report on Blocked Property to OFAC in accordance with 31 CFR § 501.603.
4. FinCEN SAR Filing: Because the customer's direct use of a sanctioned mixer goes beyond a bare list match, the compliance officer also files a SAR with FinCEN within 30 days under 31 CFR § 1022.320, documenting the customer's identification profile, IP access logs, transaction hashes, and the interaction with the sanctioned address.
5. Account Closure: Following consultation with internal legal counsel, the exchange permanently closes the customer's account and archives all compliance records for a minimum of five years.

Common Exam Traps

• Trap 1: Overstating the Tornado Cash Precedent in Either Direction: The Fifth Circuit held in Van Loon (2024) that immutable smart contracts are not "property" under IEEPA, and Treasury delisted Tornado Cash in March 2025. That does not put mixers beyond sanctions: OFAC can still designate the people and entities behind them and the addresses they control, as it did with Blender.io and Sinbad.io.
• Trap 2: Returning Sanctioned Funds to the Sender: Assuming that when a VASP blocks an illicit deposit, the correct procedure is to "reject" the transaction and send the cryptocurrency back to the origin address. Under OFAC regulations, returning property to a sanctioned entity constitutes an illegal unlicensed transaction. Sanctioned funds must be frozen and placed into a blocked custodial account.
• Trap 3: Conflating OFAC Blocked Property Reporting with FinCEN SAR Filing: OFAC and FinCEN are separate bureaus with separate reports. Under FinCEN guidance, a blocked property report (31 CFR § 501.603) satisfies the SAR obligation only for the sanctions match itself; where other facts make the activity suspicious, the institution must also file a SAR (31 CFR § 1022.320 for MSBs).
• Trap 4: Overreacting to Unsolicited Dusting: When activists sent "dust" from Tornado Cash addresses in 2022, OFAC said in FAQ 1076 that it would not prioritize enforcement against people who merely received such unsolicited transfers. Firms should handle dust under a documented, proportionate procedure rather than freezing whole accounts by reflex.