How do sanctions apply to crypto, and what happened with Tornado Cash?

What sanctions are

In the US, sanctions are run by the Office of Foreign Assets Control (OFAC), part of the Treasury. It enforces economic sanctions against targeted foreign countries, regions, entities and individuals, to further US foreign policy and national security goals.¹ Sanctions can block assets, or restrict financial or trade dealings with a specific person, country, region or government.¹

Treasury says the "ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior".² In October 2021, OFAC published sanctions guidance written for the crypto industry.⁵ It says its sanctions apply "equally" to crypto and to ordinary money.¹

The SDN List

OFAC's most prominent list is the Specially Designated Nationals and Blocked Persons List, or SDN List.¹ In general, US persons may not deal with anyone on it, directly or indirectly, and must block any property they hold in which a listed person has an interest.¹

Two rules make the list wider than it looks:¹

• The 50 Percent Rule. A company owned 50% or more by blocked persons, alone or together, is also blocked, even if it is not on the list.¹
• Crypto addresses. Since 2018, OFAC has added some known crypto addresses to SDN entries as identifying information.¹

US persons include US citizens and permanent residents wherever they are, anyone in the United States, and US companies and their foreign branches.¹ Some non-US firms can also be caught, for example if they cause a US person to break sanctions.¹

Strict liability

OFAC's guidance says civil penalties are "generally based on a strict liability legal standard".¹ That means that, in many cases, a US person "may be held civilly liable for sanctions violations even without having knowledge or reason to know" it was breaking them.¹

OFAC still looks at all the facts when it decides what to do. For example, it may treat a firm's risk-based compliance programme as a reason to go easier.¹

Screening addresses

OFAC recommends, as a best practice, that crypto firms use tools that can identify and block transactions linked to addresses on the SDN List.¹ It also warns that unlisted addresses can carry risk. For example, an address that shares a wallet with a listed one may be linked to a blocked person.¹

When you compare addresses, compare all of them. Scammers make lookalike addresses that match the start and end of a real one, and MetaMask's help pages tell users to "pay particular attention to the middle characters".⁶ Trezor's support pages say "the only way to ensure safety is to carefully check every character of the address".⁷

A lookalike is not a match to the list. But a firm may still want to look into why it appeared, because OFAC says connections to listed addresses can carry risk.¹

Blocking and reporting

If a US person holds crypto that must be blocked, it must deny all parties access to it.¹ It does not have to turn the crypto into dollars.¹ Initial blocked property reports must be filed "within 10 business days following the date that property is blocked", and then once a year while the property stays blocked.¹

Tornado Cash: a designation, a court case, a delisting

Tornado Cash is a crypto mixer on Ethereum. Treasury described it as a service that hides where transactions come from and go to.²

• 8 August 2022: OFAC sanctioned Tornado Cash. Treasury said it had been used to launder more than $7 billion of crypto since 2019, including funds it said were stolen by a North Korean state-sponsored hacking group.²
• 26 November 2024: in Van Loon v. Department of the Treasury, a case brought by Tornado Cash users, the US Court of Appeals for the Fifth Circuit held that Tornado Cash's immutable smart contracts are not "property" of a foreign national or entity. So, it said, they cannot be blocked under the sanctions law used, and OFAC overstepped its authority.³
• 21 March 2025: Treasury said it had used its discretion to remove the sanctions against Tornado Cash.⁴

The court also said OFAC's concerns about illicit foreign actors laundering money "are undeniably legitimate".³ And when it delisted Tornado Cash, Treasury said it remained deeply concerned about North Korean hacking and laundering, and told US persons to "exercise caution" with risky transactions.⁴

Beyond the United States

• United Nations: the Security Council can impose sanctions under Article 41 of the UN Charter. Its website listed 15 sanctions regimes on 22 October 2026.⁹
• European Union: as of 22 October 2026, the EU said it had over 40 sanctions regimes. Some carry out UN decisions and others are the EU's own. They bind EU nationals and people in the EU or doing business there.¹⁰
• United Kingdom: the Office of Financial Sanctions Implementation (OFSI), part of HM Treasury, says cryptoassets are caught by UK financial sanctions.¹¹