The Tornado Cash Paradox: Why the DOJ Is Retrying a Developer the Rest of Washington Already Exonerated

The U.S. government is arguing with itself — and a developer's freedom hangs in the balance.

On March 10, 2026, federal prosecutors in Manhattan filed a motion requesting an October 2026 retrial for Roman Storm, co-founder of the Tornado Cash cryptocurrency mixer, on two unresolved conspiracy charges that could carry up to 40 years in prison. The request arrived just 24 hours after the U.S. Treasury Department published a report to Congress explicitly acknowledging that crypto mixers have legitimate privacy uses. It came eleven months after Deputy Attorney General Todd Blanche ordered the DOJ to stop "regulation by prosecution" of crypto platforms. And it arrived a full year after the Treasury itself removed Tornado Cash from its sanctions list.

Three branches of the executive government have signaled that the legal theory underpinning Storm's prosecution is either wrong, outdated, or no longer a priority. Yet the Southern District of New York (SDNY) presses forward. Welcome to the most consequential — and contradictory — criminal case in crypto history.

The Timeline That Doesn't Add Up

To understand the paradox, you need to see the full sequence of events compressed into 18 months:

November 2024 — The Fifth Circuit Court of Appeals rules 3-0 that OFAC exceeded its statutory authority when it sanctioned Tornado Cash. The court holds that immutable smart contracts cannot be classified as "property" under the International Emergency Economic Powers Act (IEEPA) because they lack the hallmarks of ownership, control, and exclusivity. More than a thousand volunteers participated in a "trusted setup ceremony" that irrevocably removed anyone's ability to update or control the code.

March 2025 — The Treasury Department officially delists Tornado Cash from the OFAC sanctions list, citing "novel legal and policy issues raised by use of financial sanctions against financial and commercial activity occurring within evolving technology and legal environments."

April 2025 — Deputy Attorney General Todd Blanche issues a sweeping memo titled "Ending Regulation by Prosecution." The memo disbands the National Cryptocurrency Enforcement Team (NCET), instructs prosecutors to stop targeting exchanges, wallets, and "mixing and tumbling services" for end-user conduct, and declares that the DOJ "is not a digital assets regulator."

August 2025 — Despite the policy shift, Storm's trial proceeds. After a four-week trial, a Manhattan jury convicts him on one count: conspiracy to operate an unlicensed money transmitting business (maximum five years). But the jury deadlocks on the two far more serious charges — conspiracy to commit money laundering and conspiracy to violate U.S. sanctions. Storm remains free on a $2 million bond.

March 9, 2026 — The Treasury Department submits a report to Congress under the GENIUS Act acknowledging that "lawful users of digital assets may use mixers to preserve financial privacy on public blockchains, including to shield personal wealth, business payments, charitable donations, and consumer spending habits from public exposure."

March 10, 2026 — One day later, SDNY prosecutors ask the court to schedule Storm's retrial for October 2026 on the two deadlocked counts.

The juxtaposition is staggering. The same government that unsanctioned the protocol, acknowledged the legitimacy of its function, and ordered its prosecutors to stand down is now seeking a second trial that could put its developer in prison for four decades.

A Three-Way Policy Contradiction

The Storm retrial exposes a structural fracture in how the U.S. government approaches crypto enforcement. Three separate arms of the executive branch are pulling in opposite directions:

The Treasury Department now treats crypto mixers as legitimate privacy tools. Its March 2026 report represents a 180-degree turn from the agency that sanctioned Tornado Cash in August 2022 and designated international mixers as money-laundering hubs in 2023. The report recommends that Congress clarify anti-money laundering obligations for DeFi and advance "privacy-preserving digital identity tools" — language that implicitly validates the kind of technology Tornado Cash represents.

The DOJ's leadership has explicitly directed prosecutors away from cases like Storm's. The Blanche memo's instruction to stop targeting mixing services for end-user conduct directly undermines the prosecution's theory — that Storm is criminally responsible for what others chose to do with Tornado Cash.

SDNY prosecutors, operating with significant independence, appear to be treating the deadlocked counts as unfinished business rather than a policy signal. The Southern District of New York has a long history of institutional autonomy, and the line prosecutors on Storm's case may view a partial conviction as validation to push harder, not a reason to retreat.

As one cybercrime consultant noted, the government's approach "appears inconsistent — Treasury is publicly acknowledging lawful uses for mixers even as the DOJ advances an aggressive theory of criminal liability for a Tornado Cash developer."

The Developer Liability Question

At its core, the Tornado Cash case asks a question that has never been definitively answered in American law: Can writing open-source code be a crime?

The prosecution's theory rests on the argument that Storm didn't merely write software — he helped build and maintain a service that he knew was being used to launder billions in illicit funds, including proceeds from the Lazarus Group, North Korea's state-sponsored hacking operation. Prosecutors allege Storm had the ability to implement compliance measures (such as blocking sanctioned addresses) and chose not to.

The defense counters that Tornado Cash is a set of immutable smart contracts deployed on Ethereum. Once launched, no one — including Storm — could modify or shut down the protocol. Holding a developer responsible for how third parties use code they can no longer control is, defense attorneys argue, like prosecuting the inventor of a door lock because a burglar used the same brand.

The August 2025 jury's split verdict suggests this argument resonated — at least partially. Twelve jurors agreed that Storm operated an unlicensed money transmitting business, but they could not agree that he conspired to launder money or violate sanctions. The distinction matters: the money transmitting conviction treats Storm as a service operator, while the unresolved charges would treat him as a criminal accomplice.

The retrial forces the same question back before a new jury, with potentially different results. And whatever happens in October 2026 will almost certainly be appealed, pushing the final resolution of developer liability to the Second Circuit — and possibly the Supreme Court.

The Global Dimension: Pertsev's Parallel Path

Storm is not the only Tornado Cash developer facing the consequences of writing privacy software. In the Netherlands, co-developer Alexey Pertsev was convicted of money laundering in May 2024 and sentenced to 64 months in prison by a Dutch court that found him responsible for laundering $1.2 billion in illicit assets through the protocol.

Pertsev was released in February 2025 under electronic monitoring as he awaits his appeals trial in the s-Hertogenbosch Court of Appeal. His defense team has indicated they will use the U.S. Fifth Circuit's ruling — that immutable smart contracts are not "property" and cannot be sanctioned — as part of their appeal strategy.

The two cases are creating a transatlantic feedback loop. A favorable appeals ruling for Pertsev could strengthen Storm's defense narrative, while a Storm acquittal on the retrial charges could influence European courts grappling with the same questions about code and culpability.

Congress Steps In

The policy contradictions have not gone unnoticed on Capitol Hill. On February 26, 2026, Representatives Scott Fitzgerald (R-WI), Ben Cline (R-VA), and Zoe Lofgren (D-CA) introduced the bipartisan Promoting Innovation in Blockchain Development Act of 2026, designed to shield open-source developers from criminal liability under federal money transmission laws (Section 1960).

The bill clarifies that Section 1960 applies only to entities that "control customer assets and transmit funds on behalf of customers" — not developers who write or distribute open-source software. The DeFi Education Fund noted the fundamental absurdity of the current regime: "Software developers are told by their federal regulator (FinCEN) that they are not required to obtain a license, yet are subsequently prosecuted by line prosecutors for failure to obtain one."

The legislation cites a chilling statistic: the U.S. share of open-source blockchain developers fell from 25% in 2021 to 18% in 2025, driven by regulatory uncertainty. Whether or not the bill passes, its bipartisan introduction signals that at least some lawmakers understand the economic cost of prosecutorial ambiguity.

What October's Retrial Means for Crypto

The Storm retrial is not just about one developer. It will establish — or fail to establish — several precedents that will shape the crypto industry for years:

For DeFi builders: If Storm is convicted on the money laundering or sanctions charges, it would establish that developers can be held criminally responsible for protocol misuse even when they cannot modify or shut down the code. This would effectively criminalize a class of open-source development and accelerate the migration of blockchain talent to friendlier jurisdictions.

For privacy technology: A conviction would validate the theory that building privacy tools creates an affirmative duty to police their use — a principle that, if applied broadly, would implicate the developers of VPNs, encrypted messaging apps, and even the Tor network.

For regulatory coherence: The trial will test whether SDNY can sustain a prosecution that contradicts both the DOJ's own stated policy and the Treasury Department's publicly acknowledged position on mixers. A second deadlocked jury — or an acquittal — would be a powerful signal that the government's internal contradictions have real consequences.

For institutional confidence: Institutions entering crypto need legal clarity. A case where the government simultaneously acknowledges the legitimacy of privacy tools and prosecutes their developers is the opposite of clarity. The outcome will either resolve or deepen a contradiction that has chilled investment in privacy-preserving infrastructure.

The Bigger Picture

The Tornado Cash saga reflects a deeper tension in how democracies regulate emergent technology. Privacy is a recognized right. Money laundering is a recognized crime. When a single tool can serve both purposes, the law must draw a line — and the Storm retrial is where that line will be drawn.

What makes this case extraordinary is not the legal complexity but the policy incoherence. The Fifth Circuit said Tornado Cash's smart contracts cannot be sanctioned. The Treasury removed the sanctions. The DAG said prosecutors should stop targeting mixers. The Treasury told Congress that mixers serve legitimate purposes. Congress introduced legislation to protect developers.

And yet, on October 2026, Roman Storm will sit in a Manhattan courtroom while prosecutors argue that building Tornado Cash was a criminal act worthy of 40 years in prison.

However the jury decides, the verdict will be less about one man than about the kind of technological society America wants to be. One where writing code can make you an accomplice — or one where the law distinguishes between the tool and its misuse.

The crypto industry, open-source developers worldwide, and the future of financial privacy are all watching.