Coinbase is funding a six-person lawsuit against the U.S. Treasury for imposing sanctions on Tornado Cash smart contracts, which have come under scrutiny for their misuse by North Korean cybercriminals who rely on them to conceal cryptocurrency transactions, helping the Hermit Kingdom indirectly fund its nuclear program. The largest crypto exchange in the U.S. says the government overstepped its authority in going after open-source technology and needs to declare unlawful its decision to sanction code.
Tornado Cash, which was created in 2019, is a crypto privacy mixer that removes traceability on digital ledgers by pooling cryptocurrencies from multiple sources prior to a user's withdrawal of their digital tokens. North Korean hackers and other criminals have laundered over $7 billion of transactions using the service in the last three years, according to the Treasury.
In August, the Treasury’s Office of Foreign Assets Control blacklisted Tornado Cash and said the service was a critical part of North Korea's overseas collection of funds to support its nuclear program. In an unprecedented move, it added Tornado Cash and associated services to the Specially Designated Nationals and Blocked Persons List, triggering an outcry from the wider blockchain and crypto industry. Vitalik Buterin, the founder of the Ethereum blockchain which Tornado Cash smart contracts run on, said he had used Tornado Cash to donate to Ukraine. Other advocates said the government's move violated free speech protections enshrined in the U.S. Constitution.
On Friday, two Coinbase employees and four crypto investors filed a legal challenge against the U.S. Treasury in Waco, Texas, saying that the government was violating free speech clause of the First Amendment and the due process clause by going after a piece of code. Coinbase argues there are alternative routes that the government can take to prevent bad actors in North Korea and elsewhere from misusing privacy mixing services.
“We have no issue with the Treasury sanctioning bad actors and we take a hard stance against unlawful behavior,” Coinbase said. “But in this case, Treasury went much further and took the unprecedented step of sanctioning an entire technology instead of specific individuals.”
“Tornado Cash smart contracts are neither person nor property, Coinbase said. "They are lines of code, not humans, corporations, or organizations... They are a privacy tool, a technology, that is neither human nor an entity."
The company added that many crypto investors rely on privacy mixers like Tornado Cash to protect themselves against hackers and thieves. In that sense, Coinbase said, "the sanctions against Tornado Cash have not only blocked this open source technology to U.S. persons, but cryptographers and developers have also been scared away from contributing to other important privacy projects, fearful that their code will be sanctioned in the future."