A United States federal prosecutor has formally requested a retrial for Roman Storm, co-founder of the privacy-focused decentralized cryptocurrency mixer protocol Tornado Cash, mere months after his initial trial concluded with a mixed verdict. This development, detailed in court documents filed on March 9, reignites a high-stakes legal battle that carries significant implications for the future of decentralized finance (DeFi), blockchain privacy, and the legal interpretation of software development.

U.S. Attorney Jay Clayton, in a letter addressed to U.S. District Judge Katherine Polk Failla of the District Court for the Southern District of New York, communicated the government’s intent to retry Storm on two specific charges: violating U.S. sanctions and engaging in money laundering. These are the same two counts on which the jury in his highly publicized summer trial was unable to reach a unanimous verdict. Storm had, however, been found guilty on a lesser charge of operating an unlicensed money-transmitting business during the initial proceedings. The U.S. Attorney anticipates that the retrial for the two remaining counts will span approximately three weeks and has requested it commence in October of this year.

The renewed legal pressure prompted an immediate and vocal response from Storm, who took to social media platform X (formerly Twitter) to express his dismay. "A jury of 12 Americans heard 4 weeks of evidence and deadlocked: no verdict on money laundering, and no verdict on sanctions violations. The government’s response? Try again to make writing code a crime," Storm wrote, underscoring his belief that the prosecution is attempting to criminalize software development. He further highlighted the severe potential consequences, noting that a conviction on these two counts could lead to a cumulative prison sentence of up to 40 years.

Storm also seized the opportunity to draw attention to recent regulatory discourse from within the U.S. government that, he argues, offers a more nuanced view of decentralized protocol developers and privacy-enhancing tools. Specifically, he referenced a new report from the U.S. Department of the Treasury to Congress, issued just this week, which states, "Lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains." This statement, he implied, stands in stark contrast to the aggressive prosecution he faces. Additionally, Storm pointed out that the U.S. Treasury had previously removed Tornado Cash from its list of sanctioned entities in March of the prior year, a significant reversal from its 2022 ban on the protocol. The Defiant had reported on this development at the time, noting the subsequent surge in the TORN token’s value.

The Protracted Legal Battle: A Chronology of "The US v. Roman Storm"

The legal saga surrounding Tornado Cash and its developers is a complex narrative that reflects the ongoing tension between financial innovation, individual privacy, and national security concerns in the digital age.

• 2019: Tornado Cash is launched, offering a non-custodial protocol designed to enhance transactional privacy on Ethereum Virtual Machine-compatible blockchains by breaking the on-chain link between source and destination addresses.
• August 8, 2022: The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) adds Tornado Cash to its Specially Designated Nationals (SDN) list, effectively sanctioning the protocol. OFAC alleged that the mixer had been used to launder over $7 billion worth of virtual currency since its inception, including funds stolen by state-sponsored North Korean cybercrime groups like the Lazarus Group. This move sent shockwaves through the crypto industry, sparking widespread debate over the nature of decentralized protocols and developer responsibility.
• August 10, 2022: Alexey Pertsev, another founding developer of Tornado Cash, is arrested in the Netherlands, triggering international condemnation from parts of the crypto community and privacy advocates.
• August 23, 2023: Roman Storm is arrested in the U.S. and indicted by the U.S. Department of Justice (DOJ), alongside co-founder Roman Semenov. The DOJ alleged that Storm and Semenov were aware of the platform’s extensive use by criminal organizations for illicit activities and claimed they were responsible for laundering over $1 billion in crypto, including hundreds of millions on behalf of the Lazarus Group. Semenov, who remains at large, is currently on the FBI’s wanted list, with a federal warrant issued for his arrest.
• Early 2024: Storm’s legal team files a motion to dismiss, arguing that he is a software developer whose "only agreement… was to build software solutions to provide financial privacy to legitimate cryptocurrency users." He pleaded not guilty to all charges.
• Summer 2024: Roman Storm’s initial trial commences. After four weeks of evidence presentation, the jury delivers a mixed verdict: guilty on operating an unlicensed money-transmitting business, but deadlocked on the more severe charges of violating U.S. sanctions and money laundering.
• February 2024: Alexey Pertsev is released from prison in the Netherlands to house arrest after being found guilty in an earlier trial and sentenced to over five years for money laundering related to Tornado Cash. Subsequent appeals in June allowed him to remove his ankle monitor, though his movement remains restricted to the Netherlands, and he is unable to work.
• March 9, 2025: The U.S. federal prosecutor formally requests a retrial for Roman Storm on the two deadlocked counts.

The Technology and the Privacy Debate

Tornado Cash operates as a non-custodial smart contract, meaning it never directly holds users’ funds. Instead, it allows users to deposit cryptocurrency into a large pool and later withdraw an equivalent amount to a different address. By mixing these deposits and withdrawals, the protocol aims to obscure the transactional history on public blockchains like Ethereum, thereby enhancing user privacy. This functionality is crucial for individuals and entities seeking to protect their financial data from public scrutiny, a common practice in traditional finance.

The core of the legal and philosophical debate surrounding Tornado Cash lies in the dual nature of such privacy-enhancing technologies. While proponents argue that financial privacy is a fundamental right and a necessary feature for legitimate users in a world of pervasive surveillance, prosecutors contend that such tools become instruments for criminals to launder illicit funds with impunity. The U.S. government’s stance has been that even if a tool has legitimate uses, developers can be held liable if they knowingly facilitate or fail to prevent its use for illegal activities.

The defense, on the other hand, emphasizes the "code is speech" argument, asserting that writing and deploying open-source software should not be criminalized, especially when the software itself is neutral and non-custodial. They argue that holding developers responsible for how third parties use their code sets a dangerous precedent that could stifle innovation in the entire software development ecosystem, particularly in decentralized technologies where direct control over user actions is inherently limited.

Broader Regulatory Landscape and Precedents

The case against Roman Storm is not isolated; it is part of a broader, intensifying global crackdown on cryptocurrency mixers and other perceived facilitators of illicit financial activity. The U.S. Treasury’s recent report acknowledging the legitimate uses of mixers for financial privacy, while a glimmer of hope for privacy advocates, highlights the complex and often contradictory nature of current regulatory approaches. It suggests a recognition that not all privacy-seeking behavior is illicit, yet the enforcement actions against developers persist.

The U.S. government has also pursued similar cases against other mixer protocols. In November of the previous year, the co-founders of Samourai Wallet, Keonne Rodriguez and William Lonergan Hill, were found guilty in a U.S. federal court for "a conspiracy to operate a money transmitting business in which they knowingly transmitted criminal proceeds." They were subsequently sentenced to five and four years in prison, respectively. While Samourai Wallet differs from Tornado Cash in its architectural specifics (being more of a custodial service in some respects), the conviction signals a clear intent from U.S. authorities to prosecute those involved in operating services that facilitate money laundering, regardless of their claims of privacy enhancement.

The international dimension is equally significant, as evidenced by Alexey Pertsev’s conviction and imprisonment in the Netherlands. This demonstrates a concerted effort by law enforcement agencies across jurisdictions to target individuals associated with these protocols, reflecting a global concern over financial crime facilitated by cryptocurrencies.

Industry Reaction and Implications for DeFi

The crypto industry has largely rallied in support of Roman Storm and Alexey Pertsev, viewing their prosecutions as an attack on core principles of decentralization, open-source development, and financial privacy. Organizations like the DeFi Education Fund have actively supported Storm’s defense, arguing that the outcome of this legal battle will profoundly influence the future trajectory of decentralized finance, especially within the U.S.

One of the most critical implications revolves around the concept of developer responsibility. If developers can be held liable for the illicit actions of users on their decentralized, non-custodial protocols, it could set a chilling precedent. This could deter innovators from building privacy-enhancing tools or any open-source software that could potentially be misused, even if the primary intent is legitimate. It blurs the line between creating a tool and being responsible for every use of that tool, a distinction traditionally understood in software and hardware development.

Furthermore, the case tests the "code is speech" doctrine, a First Amendment argument that views computer code as a form of expression protected by free speech rights. If writing code that can be used for illicit purposes is deemed a crime, regardless of intent or control over its subsequent use, it could redefine the boundaries of free expression in the digital realm.

The ongoing legal uncertainties also contribute to a climate of regulatory ambiguity, which can impede innovation and push crypto development to jurisdictions with clearer or more permissive legal frameworks. This could undermine the U.S.’s position as a leader in technological innovation.

Looking Ahead: The Retrial and Its Stakes

The upcoming retrial for Roman Storm on the charges of sanctions violations and money laundering will be a pivotal moment. The prosecution will likely aim to present a more compelling case, perhaps with additional evidence or a refined strategy, to convince a new jury that Storm had the requisite intent or knowledge to be held criminally liable for the illicit use of Tornado Cash. They will likely focus on the specific instances of illicit funds, particularly those linked to the Lazarus Group, and attempt to establish a direct connection between Storm’s actions (or inactions) and these criminal activities.

Storm’s defense, conversely, will continue to emphasize his role as a software developer, the open-source nature of Tornado Cash, and the inherent impossibility of controlling every user’s actions on a truly decentralized protocol. They will likely leverage the U.S. Treasury’s recent report to bolster their argument that privacy tools have legitimate uses and that the government’s stance on such technology is evolving.

The outcome of this retrial will extend far beyond Roman Storm himself. A conviction on the remaining charges would solidify a legal precedent that could dramatically reshape the landscape for DeFi developers and privacy protocols globally, potentially forcing them to implement extensive know-your-customer (KYC) and anti-money laundering (AML) measures, even if it compromises the decentralized and private nature of their offerings. Conversely, an acquittal or another hung jury could empower developers and privacy advocates, signaling a need for more nuanced regulatory approaches that balance innovation and individual rights with national security concerns. The legal battle of "The US v. Roman Storm" is thus not just about one individual; it is a defining moment for the future of digital privacy and decentralized technology.