Follow the Money · 05 — The Mixer: Is Code a Criminal?

Follow the Money — Case 05. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Case 04 ended on a machine that stops money — the stablecoin kill switch, a freeze that immobilizes value where it sits. Case 05 is about the machine built to make sure there is nothing left to stop: the tool whose entire purpose is to make the trail disappear before a freeze or a seizure can ever find it. It is the cryptocurrency mixer, and its most famous specimen is Tornado Cash.

Across four cases this register has repeated a founding paradox: the criminal's obfuscation hides the connection but never deletes the record — the ledger remembers. The mixer is where that paradox meets its hardest test. A mixer is a pool. Many users deposit the same fixed amount, and each later withdraws that amount to a brand-new address, proving mathematically that they are owed a withdrawal without revealing which deposit was theirs. On the public ledger, the deposit is visible and the withdrawal is visible — but the link between them dissolves inside the crowd. This is the closest thing in the register to the money genuinely vanishing: not moved, not frozen, not converted, but severed from its own history.

This is the letter about the vanishing, and about the extraordinary legal storm it set off. Because when a machine is this good at erasing the trail, the state stops chasing the money and starts chasing the machine — and then the people who wrote the machine. OFAC sanctioned the code itself. The DOJ indicted its developers. And a federal court eventually told the government it had reached too far. The disposition is VANISHED — and the deepest question of the case is not where the money went, but whether writing the code that hid it is a crime.

1. The Mechanism: how a trail is made to disappear

Start with what a mixer actually does, because the vanishing is engineered, not magical. Europol's crypto-tracing report gives the plain-language version: mixers, or tumblers, are a common obfuscation technique for criminals who want to conceal illicit transactions, enhancing privacy by breaking the links between the original and the final address using several intermediary wallets for a fee. That is the whole product in one sentence: a service that breaks links.

Tornado Cash implemented link-breaking with unusual elegance. It was not a company holding your coins in the middle; it was a set of Ethereum smart contracts — autonomous programs on the blockchain. You deposit a fixed denomination (say, exactly 1 ETH, or exactly 10 ETH) into a common pool along with everyone else depositing that same denomination. Later, you withdraw 1 ETH to a fresh address that has no prior connection to you, and you prove — using a zero-knowledge proof, a piece of cryptography that lets you demonstrate a fact without revealing the underlying data — that you are entitled to withdraw because you previously deposited, without revealing which of the many deposits was yours. The crowd of depositors sharing a denomination is called the anonymity set. If a thousand people have each deposited 1 ETH and you withdraw 1 ETH, an observer knows only that your withdrawal corresponds to one of those thousand deposits — a one-in-a-thousand link, which for tracing purposes is often no usable link at all.

Read that against everything the register has said so far. The ledger still records both events: the deposit is on-chain forever, the withdrawal is on-chain forever. The paradox's promise — the record is never deleted — is technically kept. But the connection between the two, the single fact an investigator needs, is not written anywhere, because it was never committed to the chain in the first place. The zero-knowledge proof establishes the right to withdraw without establishing the identity of the depositor. This is the subtle and important distinction the mixer exploits: the ledger remembers every transaction, but it does not remember what the mixer deliberately never told it. Inside the anonymity set, the link does not hide. It never existed on-chain to begin with.

2. The Disposition: what VANISHED means, precisely

The register's discipline is to name the money's fate exactly, and the mixer forces the most careful naming yet. In Case 01, the money was laundered and spent — it went somewhere real. In Case 03, it was seized and returned. In Case 04, it was frozen — stopped but still sitting visibly at a known address. The mixer produces something different from all of these. The money is not stopped and not recovered; it emerges from the pool fully spendable, at a clean new address, with its history amputated. That is VANISHED: not the coins vanishing — they are right there — but the connection vanishing, the thread back to the crime cut inside the set.

It is worth being precise about what has and has not disappeared, because overstating it would be dishonest and understating it would miss the point. What has not disappeared: the coins, the deposit transaction, the withdrawal transaction — all permanent, all public. What has disappeared: the specific, provable link between this particular criminal's dirty deposit and this particular clean withdrawal. An investigator staring at the withdrawal address sees money with no visible parent. They can see it came out of Tornado Cash; they cannot see whose deposit it corresponds to. The trail does not go cold gradually, the way it does across a laundering chain of ordinary wallets. It hits a wall — the edge of the anonymity set — and stops.

This is why the mixer is the register's hardest case and its most honest one. For four cases the register has insisted that the ledger's memory is the criminal's undoing; the mixer is the machine engineered specifically to defeat that memory, and to a real degree it succeeds. VANISHED is not a rhetorical flourish here. It is a technical description of a link that, inside the pool, is genuinely absent from the record. The register does not pretend otherwise. It records the vanishing as real — and then, in the sections that follow, shows both what the state did about it and where the vanishing still, quietly, fails.

3. The Earthquake: sanctioning the code itself

When a machine erases the trail this well, the state cannot follow the money, so it turns on the machine. And here the Tornado Cash story becomes legally unprecedented. In August 2022, OFAC added Tornado Cash to the SDN list. Per the US Treasury's DeFi risk assessment, OFAC stated that sanctions applied to the entity known as Tornado Cash, that Tornado Cash uses computer code known as smart contracts to implement its governance, provide mixing services, and facilitate the financial gain of its users and developers, and described its structure as founders and associated developers plus the Tornado Cash DAO. OFAC tied the service directly to the DPRK — the Lazarus Group, APT38, BlueNoroff.

Sit with what was sanctioned. Not a person. Not a company. A set of autonomous smart contracts — code that, once deployed to Ethereum, runs on its own, that no one can switch off, and that will execute for anyone who calls it whether its original authors approve or not. The government had, for the first time, added software to a list historically populated by drug lords, terrorists, and rogue states. A US person transacting with the code was now potentially violating sanctions. And because the code is immutable and permissionless, there was no operator to serve the order on, no company to compel to stop — the sanction fell on the tool as if the tool were an outlaw.

The DOJ went further and turned to the humans. Per the US Treasury's proliferation-financing assessment, in August 2023 the DOJ unsealed an indictment charging a Russian national and a Washington man with creating, operating, and promoting Tornado Cash — a mixer that allegedly facilitated more than $1 billion in money-laundering transactions and laundered hundreds of millions of dollars for the Lazarus Group, allegedly advertising that it provided untraceable and anonymous transactions. The two men, publicly identified in the case as Roman Storm and Roman Semenov, were charged, not convicted — the presumption of innocence applies, and the register holds that line firmly. But the charge itself is the earthquake's epicenter: the government's position that creating, operating, and promoting this code is a crime. There was precedent for pursuing a mixer's operator — FinCEN's 2020 penalty against Larry Dean Harmon of the Helix mixer established that running a mixing service could be prosecutable money transmission. But Helix had an operator who ran it. Tornado Cash's contracts ran themselves. The prosecution asked a genuinely new question: when the service has no operator, can you prosecute the author?

4. The Pushback: the courts draw a line

The state's move against the code did not go unanswered, and the answer came from the federal courts. The designation was challenged, and in November 2024 the US Court of Appeals for the Fifth Circuit ruled, in Van Loon v. Department of the Treasury, that Tornado Cash's immutable smart contracts are not property that OFAC has the statutory authority to sanction — because no one owns them and no one controls them. They are, the reasoning went, not a thing anyone possesses but a set of unchangeable instructions running autonomously; and OFAC's power runs to the property of persons, not to owner-less code. Following the ruling, in March 2025, the Treasury removed Tornado Cash from the SDN list. This is a matter of public record, and the register flags it plainly.

The ruling matters far beyond one mixer, because it located a boundary. The state's instinct, when money vanishes into a machine, is to sanction the machine — and the court said that instinct has a legal limit when the machine is code no one owns. You can sanction a person who launders. You can sanction a company that runs a mixer. You cannot, the Fifth Circuit held, simply declare a piece of autonomous, unchangeable software to be blocked property, because the sanctions statute was written for property and this is not property in any sense the law recognizes. The vanishing that the mixer performs is real; but the government's most aggressive response to it exceeded what the law allowed.

This is the register's structural point about Case 05, and it is why the mixer is not just another laundering method but a genuine frontier. The earlier cases were about the state chasing money through a system that ultimately remembers. The mixer is about the state, unable to follow the money, reaching instead for the code and the coder — and running into the constitutional and statutory architecture that constrains what a government may do to a tool and to the person who built it. The money vanished into the pool. The law then had to decide how far it could go in pursuit of a vanishing it could not reverse, and a court said: not this far.

5. The Fault Line: is writing code speech?

Underneath the sanctions question runs a deeper one, and it is the reason this case belongs in a forensic register rather than a legal digest: the prosecution of a developer for writing privacy software revives one of the oldest fights of the digital age. Is publishing code an act of expression, or an act of conduct?

The lineage is real. In the 1990s, during the so-called crypto-wars, the government treated strong encryption as a munition and tried to restrict its export; in Bernstein v. United States, a federal court held that source code can be a form of speech for First Amendment purposes, and the effort to suppress the publication of encryption code collapsed. Digital-rights advocates argue that the same principle protects the authors of privacy-preserving financial code: that a developer who writes and publishes permissionless software, which anyone in the world may then use for any purpose, is engaged in protected expression, and that punishing the author for what downstream users do with the published tool criminalizes the tool rather than the crime. On this view, Tornado Cash's code is speech, its authors are speakers, and prosecuting them for the money-laundering choices of anonymous users is a category error with a chilling reach — because every developer of every privacy or security tool would then write under the shadow of liability for strangers' crimes.

The government's position is not frivolous, and the register states it fairly: the charge is not that the men wrote code, but that they created, operated, and promoted a service — that they knowingly built and ran and marketed a laundering machine, advertised its untraceability, took financial gain from it, and continued after they knew the DPRK was using it. That, the government argues, is conduct, not expression: running a laundering business is not made lawful by the fact that the business is made of software. The register does not, and cannot, resolve this. It records that the case sits precisely on the fault line between the tool and the crime, between the coder and the launderer, between speech and conduct — and that where the line falls will shape whether the next privacy tool gets written at all. That is why the mixer is not merely a laundering technique. It is the place where the register's subject — following the money — collides with the question of whether the people who build the roads the money travels can be held to answer for the traffic.

6. The counter-narrative, steelmanned

The strongest case against this letter is that it romanticizes a laundering machine by dressing it in civil-liberties clothes, and it deserves its full hearing.

The argument runs like this. Tornado Cash laundered hundreds of millions of dollars for a nuclear-armed dictatorship's hacking apparatus — this is not a hypothetical privacy tool for dissidents, it is, in documented practice, the DPRK's washing machine, and treating it primarily as a free-speech cause launders the launderer's reputation along with its coins. The "is code speech" framing, the argument continues, conveniently ignores that the developers allegedly did not merely publish code and walk away; they allegedly operated and promoted a running service, took fees, marketed its untraceability, and kept it going with knowledge of who was using it — which is exactly the conduct that makes a person a money-transmitter and a launderer, software or not. And the Van Loon ruling, the argument concludes, was about a narrow statutory question of what counts as sanctionable property, not a grand vindication of mixers; the developers still face criminal charges on the merits, and a register that leans on the delisting risks implying the whole enterprise was cleared, which it was not.

The register grants the force of all of it and holds its ground. Yes, the DPRK use is real, documented, and central — this letter states it in Section 3 and does not minimize it; the vanishing served a weapons-financing operation, and that is damning. Yes, the distinction between publishing code and operating a service is exactly the government's strongest point, and the register presents it as such rather than assuming the developers are shielded — they are charged, the charges are serious, and their guilt or innocence is for a court. Yes, Van Loon was a narrow property ruling and not an absolution — the register says so explicitly, flagging the delisting as a statutory limit on sanctions authority, not a verdict on the men. What the register will not concede is that the fault line is therefore illusory. The point is not that the mixer is innocent; it is that a machine which genuinely makes money vanish forces the state to the edge of its power — to sanction code, to prosecute coders, to decide whether the tool or the crime is the target — and that those edges are where free societies either hold their shape or lose it. The DPRK's use makes the mixer a legitimate target. It does not make every question about how the state may pursue it a settled one. Both halves are true, and an honest register carries both.

7. Disposition — VANISHED

Case 05 followed the money to the one machine built specifically to end the chase: the mixer, which pools deposits and issues clean withdrawals so that on the public ledger the link between a criminal's dirty coins and their spendable ones dissolves inside the anonymity set. The money did not stop and did not come home. It came out the other side of the pool with its history severed, and the investigator staring at the withdrawal saw money with no visible parent.

The disposition — the money's fate — is VANISHED. Not the coins, which remain on-chain forever, but the connection: the single provable thread from crime to cash, cut inside the set and never written to the record at all. This is the closest the register comes to the paradox failing — the one case where the ledger's perfect memory is defeated not by hiding the transaction but by never committing the link to the chain in the first place. And because the money could not be followed, the state turned on the machine: OFAC sanctioned the autonomous code, the DOJ indicted the developers, and then the Fifth Circuit ruled that owner-less immutable code is not sanctionable property and the Treasury delisted the service. The vanishing was real; the state's most aggressive answer to it exceeded the law; and the deepest question — whether writing the code is a crime — remains open in a courtroom, where the developers stand charged and presumed innocent.

Hold the two truths this case will not resolve away. The mixer is, in documented fact, a laundering machine that washed hundreds of millions for a hostile state's hackers — that is real, and the register centers it. And the mixer is also published, permissionless privacy code whose prosecution reaches into the ancient question of whether software is speech, and whose sanctioning a court found unlawful — that is also real. The honeypot beneath these words watches attackers who crave exactly this: a way to make the trail end. The mixer is the closest anyone has built to giving it to them, and the ledger, for once, cannot fully answer — the link is not hidden in the record, it is absent from it. But the vanishing is not total: the deposits and withdrawals are still on-chain, the anonymity set is only as strong as its honest users, and at the on/off ramps where crypto meets a real name, the paradox reasserts itself. Judge the launderer who fed a weapons program through the pool. Then sit with the harder thing the register cannot decide for you: whether the person who wrote the pool is a criminal, or a coder — because the money vanished, and the law is still deciding what to do about the hands that built the place it vanished into.

Follow the Money continues. Case 05 disposition: VANISHED. Confidence: HIGH on the documented facts — the mixer mechanism (Europol), OFAC's August 2022 sanctioning of Tornado Cash's smart contracts and the DPRK/Lazarus nexus (US Treasury DeFi assessment), the August 2023 DOJ indictment of the developers and the >$1B / hundreds-of-millions-for-Lazarus figures (US Treasury proliferation-financing assessment), and the Helix/Harmon precedent (FinCEN) are matters of record. The Fifth Circuit's Van Loon v. Treasury ruling (Nov 2024) and the March 2025 delisting are public record and flagged as such. The named developers are charged, not convicted; the presumption of innocence applies and is stated. The code-as-speech analysis (Bernstein lineage) is argued as analysis, and the counter-narrative — the DPRK use, the operate-vs-publish distinction, the narrowness of Van Loon — is steelmanned in full. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the launderer, the vanishing, and the open question of whether the code is a crime.