by Sharon Cohen Levin, James M. McDonald, Eric J. Kadel Jr., Anthony J. Lewis, Judson O. Littleton, Adam J. Szubin, Shari D. Leventhal, and Berke B. Gursoy

Court Concludes that Immutable Smart Contracts Are Not “Property” Under Relevant Sanctions Legislation

SUMMARY

In a significant decision issued on November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit held in Van Loon et al. v. Department of the Treasury that the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) exceeded its statutory authority under the International Emergency Economic Powers Act (“IEEPA”) by sanctioning Tornado Cash, a cryptocurrency mixing service that enables users to conduct anonymized cryptocurrency transactions through the use of immutable smart contracts. The case centered on whether these immutable smart contracts could be considered “property,” as required to be sanctionable under IEEPA. Relying on the Supreme Court’s recent decision in Loper Bright Enterprises v. Raimondo, which overruled the longstanding doctrine of Chevron deference to agency interpretations of statutory text, the Fifth Circuit concluded that immutable smart contracts did not constitute property and were therefore not subject to OFAC’s designation authority under IEEPA.

This ruling has potentially significant implications for OFAC’s efforts to sanction parties involved in decentralized finance (DeFi) and could alter the future enforcement landscape for parties and platforms that provide anonymity-enhancing services to cryptocurrency users.

BACKGROUND

Although there are a variety of applicable bases of legal authority to impose economic sanctions, IEEPA serves as the primary statutory basis for the authorization and administration of U.S. economic sanctions.[1] It grants the President broad authority to regulate economic transactions involving foreign entities that he determines pose a threat to U.S. national security. This includes the power to “block … any property in which any foreign country or a national thereof has any interest,” which the President has delegated to OFAC.[2]

OFAC relies on this and other delegated authorities in designating foreign individuals or entities (including their assets) or property as “blocked.” Such actions immediately impose an across-the-board prohibition against transfers or dealings of any kind with regard to property and a prohibition on any transactions with such a person or entity or their property. When OFAC takes action to block a person, entity, or property, the applicable name and identifying information is generally added to OFAC’s List of Specially Designated Nationals and Blocked Persons (“SDN List”).

The designation of Tornado Cash was based on two Executive Orders issued by President Obama in 2015[3] and 2016.[4] The 2015 Executive Order blocked the property of persons identified by the Secretary of the Treasury as having engaged in cyber-enabled activities that threaten the “national security, foreign policy, or economic health or financial stability of the United States.”[5] The 2016 Executive Order blocked the property of the Government of North Korea and delegated authority to the Secretary of the Treasury to block the property and interests in property of individuals determined to have supported the North Korean government.[6] OFAC subsequently issued regulations under both Executive Orders that defined key terms, including “property” (which is defined identically across both regulations).[7]

In August 2022,[8] OFAC sanctioned Tornado Cash, adding it (as an entity) and its immutable smart contracts (by digital currency address) to the SDN List.[9] Tornado Cash is a cryptocurrency mixer that enables users to anonymize their crypto transactions. To achieve such anonymity, Tornado Cash operates a system of “pools” governed by smart contracts—i.e., as described in the Fifth Circuit’s opinion, self-executing programs that automate blockchain transactions.[10] Smart contracts are categorized as either “mutable” or “immutable.”[11] A mutable smart contract can be modified or managed by a party or group, allowing changes to its terms or code. In contrast, an immutable smart contract is permanently fixed and cannot be altered or removed from the blockchain.[12]

The Tornado Cash pools accept token deposits from one address and allow their withdrawal to a different address.[13] These pools receive deposits from multiple users, “mixing” them to obscure the origin of the funds that are later withdrawn and sever the link between the user and the recipient.[14] Once funds are withdrawn to a new address, the on-chain link between the source and destination is broken, effectively anonymizing the withdrawn crypto assets.[15] Although parties may engage in lawful transactions using mixers like Tornado Cash to enhance the privacy of their cryptocurrency transactions, such mixers also reportedly have become a “go-to tool for cybercriminals” seeking to launder stolen cryptocurrency.[16] Indeed, OFAC based its designation of Tornado Cash on allegations that it was used to launder over $7 billion in cryptocurrency, including more than $455 million stolen by North Korea’s “Lazarus Group.”[17]

Tornado Cash’s designation as an SDN prohibited U.S. persons from dealings with “all real, personal, and other property and interests in property” of Tornado Cash.[18] This designation included the immutable smart contracts that Tornado Cash had designed and deployed and effectively banned U.S. persons from engaging with Tornado Cash’s “pool” smart contracts or otherwise using the Tornado Cash mixer.

Six users of Tornado Cash sued the Department of Treasury in the Western District of Texas, arguing that OFAC’s designation violated the Administrative Procedure Act. In particular, plaintiffs alleged that “OFAC lacked the authority to designate Tornado Cash as an SDN because (1) Tornado Cash is not a foreign ‘national’ or ‘person,’ (2) the immutable pool smart contracts are not ‘property,’ and (3) Tornado Cash cannot have a property ‘interest’ in the immutable smart contracts.” The district court disagreed, holding that Tornado Cash and the smart contracts were properly subject to OFAC’s sanctioning authority.[19] The plaintiffs appealed.

THE FIFTH CIRCUIT’S DECISION

The Fifth Circuit held that Tornado Cash’s immutable smart contracts were not “property” under IEEPA and, therefore, could not be sanctioned under the Act. To start, the Fifth Circuit rejected the district court’s “heightened deference” to OFAC’s interpretation of the term “property” set forth in IEEPA. Citing Loper Bright, the Fifth Circuit emphasized that it must “determine the ‘best’ reading” of the statute, not merely a permissible one, and should not defer to the agency’s reading.[20]

Applying dictionary definitions of “property,” the court ruled that Tornado Cash’s immutable smart contracts were not property “because they are not capable of being owned,” and “no one can ‘exclude’ anyone” from using them. As the court explained, “because these immutable smart contracts,” once set up, “are unchangeable and unremovable, they remain available for anyone to use.” In fact, “‘the targeted North Korean wrongdoers are not actually blocked from retrieving their assets,’ even under the sanctions regime. Simply put, regardless of OFAC’s designation of Tornado Cash, the immutable smart contracts continue operating.”[21] The court concluded that this determination was sufficient to resolve the case, because “[t]he plain meaning of ‘property’ in the Act does not support the Department’s designation of Tornado Cash.”[22]

The Fifth Circuit further held that, even applying OFAC’s own regulatory definition, immutable smart contracts still would not appropriately be considered “property.” The court reasoned that OFAC’s definition “embraces the plain meaning of ‘property,’” and provides “a laundry list of illustrative examples, all of which are items typically understood as belonging to individuals or entities.”[23] The court held that these examples, which include “money, checks, drafts, … services of any nature whatsoever, contracts of any nature whatsoever,” may include intangible items but are all things in which individuals or organizations may own rights. Applying a longstanding principle of interpretation, the court held that a catch-all term in the regulation should not be read to broaden the definition beyond the types of items specifically listed. In short, because immutable smart contracts are not capable of being owned, the court held that they did not meet this standard.

The court also rejected OFAC’s attempt to compare smart contracts to intellectual property such as patents and copyrights, based on two principal distinctions. First, “Tornado Cash doesn’t profit from the immutable smart contracts at issue in this appeal.” Second, while patents and copyrights are intangible, they are still “inherently ownable because someone retains the rights to their protections and benefits.” As the court pointed out, “the same cannot be said for these smart contracts.”[24]

The court further concluded that immutable smart contracts do not qualify as “contracts” under OFAC’s regulatory definition because “contracts require an agreement between two or more parties,” whereas smart contracts involve only one party insofar as “there is no smart-contract operator on the other side of the transaction to accept or make a counteroffer—just software code.”[25]

Finally, the court determined that immutable smart contracts do not qualify as “services” under OFAC’s definition, because services inherently require “human effort.”[26] Immutable smart contracts, the court observed, are “nothing more than lines of code” and are better understood as tools used to perform a service rather than services themselves.[27]

While acknowledging that the U.S. government has legitimate interests in curtailing tools being used by illicit actors to move and launder money, the court declined to engage in what it described as “judicial lawmaking” by stretching the statutory terms to apply in this context. The court emphasized that Congress, not the courts, must address the gaps in IEEPA’s applicability to decentralized technologies.[28]

IMPLICATIONS

The Fifth Circuit’s decision narrows OFAC’s designation authority under IEEPA by placing immutable smart contracts—autonomous, uncontrollable protocols—outside of IEEPA’s definition of “property.” While the court limited OFAC’s reach over immutable smart contracts, it left several key issues unresolved:

First, the ruling’s rationale does not explicitly extend to mutable smart contracts, which may remain subject to OFAC’s jurisdiction due to their potential for human control and ownership. The Firth Circuit’s opinion indicates that although immutable technologies are beyond OFAC’s jurisdiction, other decentralized systems involving control or ownership could still be subject to regulation.

Second, the court also left open the question of whether Tornado Cash qualifies as an “entity” under OFAC’s regulations. The court concluded that it did not need to resolve this question because it had already determined that OFAC exceeded its statutory authority to prohibit access to “property.” In the court’s view, since this determination conclusively invalidated OFAC’s actions, there was no need to consider any further issues, including whether Tornado Cash qualifies as an “entity” subject to designation authority.[29]

Third, there is also a similar case pending before the Eleventh Circuit, Coin Center, et al. v. Secretary, U.S. Department of the Treasury, et al., No. 23-13698 (11th Cir. filed Nov. 7, 2023) (challenging the district court’s upholding of OFAC’s designation of Tornado Cash’s immutable smart contracts), which might result in a different outcome and/or create a circuit split on the issue.

FOOTNOTES

[1]           In issuing Executive Orders relating to economic sanctions, including the Executive Orders relevant to this case, the President invokes the authority vested in the President by the Constitution in addition to IEEPA and other statutory authorities. The Fifth Circuit’s decision only addressed the statutory authority under IEEPA.

[2]           50 U.S.C. § 1702(a)(1)(B).

[3]          Exec. Order No. 13,694, 80 Fed. Reg. 18,077 (Apr. 2, 2015).

[4]          Exec. Order No. 13,722, 81 Fed. Reg. 14,943, 14,944 (Mar. 18, 2016).

[5]           Exec. Order No. 13,694, 80 Fed. Reg. 18,077 (Apr. 2, 2015).

[6]          Exec. Order No. 13,722, 81 Fed. Reg. 14,943, 14,944 (Mar. 18, 2016).

[7]          31 C.F.R. §§ 510.323, 578.314 (defining “property” to “include money, checks, drafts, bullion, bank deposits, savings accounts, debts, indebtedness, obligations, notes, guarantees, debentures, stocks, bonds, coupons, any other financial instruments, bankers acceptances, mortgages, pledges, liens or other rights in the nature of security, warehouse receipts, bills of lading, trust receipts, bills of sale, any other evidences of title, ownership, or indebtedness, letters of credit and any documents relating to any rights or obligations thereunder, powers of attorney, goods, wares, merchandise, chattels, stocks on hand, ships, goods on ships, real estate mortgages, deeds of trust, vendors’ sales agreements, land contracts, leaseholds, ground rents, real estate and any other interest therein, options, negotiable instruments, trade acceptances, royalties, book accounts, accounts payable, judgments, patents, trademarks or copyrights, insurance policies, safe deposit boxes and their contents, annuities, pooling agreements, services of any nature whatsoever, contracts of any nature whatsoever, and any other property, real, personal, or mixed, tangible or intangible, or interest or interests therein, present, future, or contingent.”).

[8]         87 Fed. Reg. 49, 652 (designating Tornado Cash as an SDN).

[9]          The initial August 2022 designation targeted the website Tornado.Cash and 37 Tornado Cash smart contracts (including at least 20 immutable smart contracts). OFAC updated its designation in November 2022 to include 53 Ethereum addresses associated with Tornado Cash’s smart contracts. 87 Fed. Reg. 68, 578 (Nov. 15, 2022) (re-designating Tornado Cash as an SDN).

[10]           Alex Wade et al., How does Tornado Cash work, Coin Center (Aug. 25, 2022), https://www.coincenter.org/education/advanced-topics/how-does-tornado-cash-work/; Van Loon v. Dep’t of the Treasury, 2024 WL 4891474, at *4 (5th Cir. Nov. 26, 2024).

[11]          Van Loon, 2024 WL 4891474 at, *3.

[12]          Id.

[13]         Id.

[14]         How does Tornado Cash work?, TornadoCash (Apr. 2024), https://docs.tornadoeth.cash/‌generals/‌how-does-tornado-cash-work.

[15]          Wade et al., supra note 9.

[16]         Chainalysis, Mixer Usage Reaches All-Time Highs in 2022 (July 14, 2022), https://www.chainalysis.com/‌blog/crypto-mixer-criminal-volume-2022/.

[17]        U.S. Dep’t of the Treasury, Press Release, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (Aug. 8, 2022).

[18]        Van Loon, 2024 WL 4891474, at *6.

[19]         Van Loon v. Department of Treasury, 688 F. Supp. 3d 454 (W.D. Tex. 2023).

[20]          Van Loon, 2024 WL 4891474, at *7.

[21]         Id. at *9.

[22]        Id. at *10.

[23]        Id.

[24]        Id. at *11.

[25]        Id. at *12.

[26]        Id. at *13.

[27]       Id.

[28]       Id. at *14.

[29]        Id.

Sharon Cohen Levin, James M. McDonald, Eric J. Kadel Jr., Anthony J. Lewis, and Judson O. Littleton are Partners, Adam J. Szubin and Shari D. Leventhal are Of Counsel, and Berke B. Gursoy is a Law Clerk at Sullivan & Cromwell LLP. This post first appeared as a client alert for the firm.

The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).