This week’s verdict against Tornado Cash co-founder Roman Storm signals that crypto developers may face increased legal risks when working on one of the areas the industry arguably needs most: privacy.
Roman Storm, the co-founder of crypto privacy tool Tornado Cash, was found guilty on Wednesday of one criminal charge in a case that could reshape how the law treats developers in decentralized finance (DeFi).
The trial centered on allegations that Storm knowingly enabled money laundering through Tornado Cash, despite publicly promoting it as a privacy tool. The New York jury ultimately convicted him of conspiracy to operate an unlicensed money-transmitting business and was unable to reach a verdict on two other charges: violating U.S. sanctions and engaging in money laundering.
“If contributing to open-source code, especially something that protects privacy, becomes a crime, that’s a slippery slope,” said Shady El Damaty, the co-founder and CEO of human.tech by Holonym. “What we should be encouraging is responsible innovation, systems that preserve privacy and decentralization but still support transparency and accountability.”
The outcome could force privacy-focused crypto projects to add more rules, like checking users’ identities and tracking transactions. These changes could ultimately discourage developers from building new tools, changes that run counter to DeFi’s core idea of creating open, permissionless systems.
“Roman Storm built a privacy tool, not a criminal empire. The real issue is that privacy itself is being framed as a threat, and that’s chilling for anyone who’s ever worked on decentralized systems,” said Kadan Stadelmann, CTO of Komodo Platform. “If this verdict stands, we’re basically telling devs to stop innovating or lawyer up.”
Public blockchains keep a public record of transactions, which means that users’ financial history is accessible and visible. That’s a problem for individuals who don’t want to expose their transactions, and also for institutions. Top executives from firms inclusing BlackRock and EY have said the lack of privacy in public blockchains has been a key roadblock for adoption.
Money Laundering Allegations
The charge was brought by the U.S. government, which claimed that Storm and his co-founder Roman Semenov – who was sanctioned by the U.S. in August 2022 and remains at large – knew the platform was being used to conceal illicit funds.
Prosecutors allege that over $1 billion was laundered through Tornado Cash, including hundreds of millions linked to Lazarus Group, a North Korean hacking organization.
It’s important to note that although Storm was convicted, his legal team reportedly plans to appeal, meaning that the verdict is not final yet.
Threat to DeFi
But it’s not just privacy-focused projects that would be under threat. Following the case made by the prosecution, developers of any non-custodial permissionless system would now have to worry about whether their protocol is being used for illicit actions.
Legal experts and industry advocates say Storm’s conviction could set a dangerous precedent in which developers can be held liable for how their software is used – even if they don’t profit from or run the service directly.
“Longstanding guidance at the federal level from FinCEN has been that money transmission requires ‘custody or control.’ But the theory pursued by the DOJ (and accepted by the court) in this case disregards that standard,” John McCarthy, the General Counsel at Morpho, told The Defiant. “It raises, but does not resolve, critical questions about how non-custodial infrastructure can be built legally.”
Ross Ulbricht Comparison
Stadelmann compared the situation to Ross Ulbricht, founder and operator of Silk Road, the darknet market active from 2011 to 2013. The FBI described the Silk Road as a “digital bazaar for illegal goods and services.” It was accessible only through Tor, a browser designed to hide users’ locations and identities.
Ulbricht was ultimately convicted on several charges, including operating Silk Road, engaging in a continuing criminal enterprise, narcotics distribution via the internet, money laundering conspiracy, and more. He was sentenced to life in prison but served 12 years before being pardoned earlier this year by U.S. President Donald Trump.
“We’ve seen this before with Ross Ulbricht. A young builder gets used as a scapegoat for a system the government doesn’t fully understand, and instead of thoughtful regulation, we get maximum punishment to ‘set an example’,” Stadelmann said. “It’s short-sighted and destructive.
“Tornado Cash was a protocol, not a person. And if we’re not careful, we’re going to kill the very innovation that could have made these systems safer, fairer, and more transparent in the first place,” he said.
Repercussions Beyond Crypto
Meanwhile, Brandon Ferrick, a contributor to Pyth Network, warned that the consequences of a potential conviction could go even beyond crypto.
“If Storm is convicted, it eviscerates software developers’ rights and is not limited to just crypto. It could choke innovation without Congressional or Presidential intervention,” Ferrick told The Defiant. “It could chill the most radical crypto advocates, the ones who advocate for full self-sovereignty and autonomy away from centralized governments.”
A Fundamental Divide
Jason Rozovsky, Head of Legal & Policy at Interop Labs (builder of the Axelar network), told The Defiant that the case also highlights a growing disconnect between how decentralized software is viewed and how it actually functions.
“The ruling around Roman Storm illustrates that there may be a fundamental divide in understanding between custodial and non-custodial decentralized software,” Rozovsky said. “The innovation in the space revolves around the ability for open-source, permissionless software to operate at scale to drive maximum value to users and the financial industry as a whole.”
Rozovsky explained that DeFi represents a new paradigm in both the financial and technology sectors and requires a fresh approach to regulation.
“As an industry, we need to ensure that regulatory bodies and judges alike understand how DeFi protocols work – the concern from the community is justified,” he said.
What’s next?
The Department of Justice (DoJ) may still pursue a retrial on the unresolved charges. Storm, who remains free while awaiting sentencing, currently faces up to five years in prison on the count for which he was convicted.
“Next steps are an appeal on the 1960 Conspiracy claim and wait for the prosecution to file a retrial for the hung jury matter,” Ferrick said, adding that there are deadlines for both of these. “Tough to say whether we will see an appeal given Trump’s posture on crypto; that tends to trickle down the whole executive branch.”
Meanwhile, Eli Cohen, General Counsel at Centrifuge, and Chief Compliance Officer at Anemoy, said that the big question is whether the DOJ will retry on the two charges where the jury deadlocked.
“It is a strange verdict where the Trump admin won on the weakest charge, but jury trials can be a bit random especially when dealing with innovative technology,” Cohen said. “Certainly there will be an appeal by the Roman Storm legal team so there’s no precedent yet until a final verdict.”
He added that we will learn more about the approach of the Trump administration and “whether they are as crypto friendly as everyone thinks.”
Brian Klein, a partner at Waymaker and a member of Storm’s defense team, said in a post on X on Wednesday that the team “would not stop fighting for Roman and expect him to be fully vindicated.”
