On August 8, 2022, the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, prohibiting US persons from using the service. The action was unprecedented: rather than targeting an individual or specific organization, OFAC sanctioned a set of smart contract addresses on the Ethereum blockchain — immutable software code that no individual controls. The cryptocurrency community's reaction was sharp, and in the aftermath, a common question emerged: does this create a legal risk for Monero?
The short answer is no — for reasons that go deeper than simple hope. Monero and Tornado Cash are fundamentally different systems, and understanding why matters for anyone trying to assess the regulatory landscape for privacy coins in 2026.
What Is Tornado Cash?
Tornado Cash is a decentralized, non-custodial privacy application built on the Ethereum blockchain using zero-knowledge proofs. It functions as a cryptocurrency mixer: users deposit Ethereum or ERC-20 tokens into a smart contract, and later withdraw the same amount from a different address — breaking the on-chain link between the depositing and withdrawing addresses.
The key point is what Tornado Cash is not: it is not a cryptocurrency. It is a software layer applied on top of Ethereum — a tool that adds optional, application-level privacy to an otherwise fully transparent blockchain. Ethereum transactions themselves remain visible on-chain; Tornado Cash attempts to obscure which specific ETH moved where by pooling deposits and withdrawals.
What Is Monero?
Monero is an independent cryptocurrency with privacy built into the base protocol. It is not layered on top of a transparent blockchain — it is its own blockchain, and every transaction on that blockchain is private by design. Ring signatures hide senders, stealth addresses protect recipients, and RingCT conceals amounts. There is no "Monero with privacy off" — privacy is mandatory and structural, not optional.
Monero has no central smart contract, no controlling entity, no corporate structure, and no specific address to sanction. It is a distributed protocol maintained by a global community of developers and volunteers.
Why the Regulatory Risk Differs
OFAC's Tornado Cash action targeted specific Ethereum smart contract addresses — identifiable on-chain objects that could be added to the Specially Designated Nationals (SDN) list the same way foreign entities are sanctioned. This was the legal hook: OFAC claimed the smart contracts constituted "property" of a sanctioned foreign national.
Seth for Privacy noted at the time that sanctioning a decentralized protocol like Monero is "a very different thing than sanctioning one specific smart contract on Ethereum." Monero has no equivalent of a sanctionable smart contract address. The protocol itself is distributed code with no central point — it cannot be "owned" or "controlled" by any entity that could be sanctioned.
Crypto advocacy organization Coin Center directly challenged OFAC's authority in court. Jerry Brito and Peter Van Valkenburgh argued that the action was not a traditional sanctions enforcement against a specific bad actor, but the sanctioning of a neutral technology tool — affecting the liberty of all Americans who might use it for lawful privacy purposes without any due process.
What Happened in Court
The legal challenge produced a significant ruling. In November 2024, the Fifth Circuit Court of Appeals determined that OFAC had exceeded its statutory authority under the International Emergency Economic Powers Act (IEEPA) in sanctioning Tornado Cash's immutable smart contracts. The court's reasoning centered on the finding that open-source software code that operates automatically and is not "owned" or controlled by any foreign national does not constitute "property" subject to OFAC sanctions in the way the Treasury argued.
The ruling is significant beyond Tornado Cash specifically: it established a legal precedent limiting how sanctions authorities can be applied to open-source, decentralized software tools. This precedent is directly relevant to any future regulatory action targeting decentralized protocols.
The Broader Privacy Rights Argument
The Tornado Cash controversy crystallized a debate that privacy advocates have long made: the legitimate uses of financial privacy tools are extensive and important, and blanket prohibitions affect ordinary users far more than sophisticated bad actors who have alternative means. The populations who most benefit from privacy in financial transactions include people escaping abusive relationships, journalists in authoritarian countries, activists facing government surveillance, and ordinary individuals who prefer that their financial behavior not be commercially mined and sold.
Monero — like cash — exists as a tool whose privacy properties can be used for lawful or unlawful purposes, exactly like any other financial instrument. The Monero community's position has consistently been that the focus of enforcement should be on specific criminal acts and actors, not on the prohibition of privacy-preserving technology itself.
For individuals who want to hold Monero with full key control and no third-party custody, XMRWallet is free, non-custodial, open-source, and requires no registration.
Frequently Asked Questions
Were any Monero developers arrested in connection with the Tornado Cash case?
No. The criminal proceedings related to the Tornado Cash case targeted individuals associated with the Tornado Cash project specifically — including Roman Storm and Roman Semenov. No Monero developers were implicated. The Monero project's structure — decentralized, with no corporate entity, no single controlling developer, and no commercial relationship with users — is fundamentally different from Tornado Cash's organizational model.
Is Monero on the OFAC sanctions list?
No. Monero (XMR) is not on OFAC's Specially Designated Nationals list. Using Monero is legal for US persons as of 2026. OFAC has not sanctioned the Monero protocol, any Monero wallet address generically, or any entity associated with the Monero project. Individual Monero addresses could theoretically appear on the SDN list if associated with a specific sanctioned individual or entity, as with any cryptocurrency.
