Tornado Cash, a cryptocurrency mixer service that can conceal the origin of crypto transactions, gained significant attention when it was sanctioned by the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) in August 2022.
This event sparked a widespread debate about the role of mixers in safeguarding personal financial privacy when utilizing cryptocurrencies.
U.S. authorities have continued to impose sanctions on these services, with Sinbad.io being the most recent major player to face OFAC sanctions. Both Tornado Cash and Sinbad have been shut down by the FBI, with the U.S. Treasury accusing them of facilitating billions of dollars in illicit transactions, particularly those conducted by the North Korea-based hacking group Lazarus.
According to an anonymous representative from the mixing service Mixero, mixers like Tornado Cash and Sinbad are favored by North Korean hackers due to their substantial cryptocurrency reserves, which allow for the transfer of large amounts in a single transaction, saving time.
Despite their reputation, mixers offer a legitimate service by ensuring the privacy of cryptocurrency transactions. However, the use of mixers by criminals to launder millions of dollars may pose a threat to the legitimate use of these services by ordinary users seeking financial privacy when utilizing cryptocurrencies.
The role of mixers in financial privacy
Cryptocurrencies have undergone changes in their characteristics and usage. However, they are still often perceived by the mainstream audience as being exclusively used for illicit activities. This misconception is contrary to the reality that cryptocurrencies are not completely anonymous. The underlying blockchain technology of most top cryptocurrencies operates on an open ledger, where all transactions are publicly visible.
For instance, Bitcoin, the most popular cryptocurrency, is only pseudonymous. Bitcoin addresses do not necessarily reveal the identity of their owners, providing a certain level of privacy. However, if a unique transaction is linked to an individual’s identity, all past and future transactions can be traced back to that person. Crypto mixers, which offer the service of mixing convertible virtual currencies (CVC), were created to address this issue.
There are various situations where individuals may desire financial privacy, such as ordering food delivery and paying with cryptocurrency. In such cases, the courier or delivery company should not have access to information about daily transactions or the total amount of money in one’s wallet. A mixer can help break the connection between the sender and recipient in these scenarios.
More serious examples include individuals not wanting their salary to be public or criminals discovering their total wealth. In extreme cases, a mixer could even save lives by preventing a totalitarian regime from identifying those who donated to LGBTQ+ causes or supported journalists critical of the government.
In these situations, mixers can anonymize cryptocurrencies to provide financial privacy and enhance safety.
Can mixers guarantee safety for financial privacy?
Mixers play a crucial role in enhancing privacy in cryptocurrency transactions by pooling and mixing funds from multiple users. This process makes it difficult to trace the origin of specific coins, effectively breaking the transaction trail. By increasing fungibility and anonymizing the source of cryptocurrencies, mixers contribute to improving user privacy.
However, recent events, such as the closures of Sinbad and Tornado Cash, have demonstrated that authorities can still track the use of these anonymizing technologies. Jason Somensatto, the head of North America public policy at blockchain analytics firm Chainalysis, emphasized that mixers cannot guarantee complete privacy. He explained that Chainalysis can often trace transactions through mixing services and identify a user’s outputs. Additionally, all transactions are permanently recorded on the blockchain, meaning that even if illicit activity is effectively obfuscated today, it may still be traced in the future as tracing technology continues to improve.
Given that blockchain technology inherently operates on a public ledger and mixers may not be impenetrable, one might wonder why criminals still choose to use cryptocurrencies for money laundering. Somensatto explained that bad actors utilize cryptocurrencies for the same reasons as legitimate users: they are easy to use, facilitate cross-border transactions, offer instant transfers, and provide liquidity. Even if criminals understand the transparency and traceability of cryptocurrencies, they may decide that the benefits outweigh the risks.
U.S. policy against mixer services
In October 2023, the Financial Crimes Enforcement Network (FinCEN) of the U.S. Department of the Treasury announced its intention to target mixers as a class of transactions that are of primary concern for money laundering. The policy aims to increase transparency regarding mixers in order to combat their exploitation by malicious actors, including groups such as Hamas, Palestinian Islamic Jihad, and the Democratic People’s Republic of Korea (DPRK), as stated in the document. FinCEN director Andrea Gacki explained that CVC mixing provides a critical service that enables players in the ransomware ecosystem, rogue state actors, and other criminals to fund their unlawful activities and obscure the flow of illicit gains.
FinCEN will pursue any of these services, whether they are within or involve jurisdictions outside the United States. The U.S. has already taken action internationally, as demonstrated by the controversial arrest of the developer of Tornado Cash in Amsterdam and collaboration with Dutch authorities to dismantle Sinbad.io.
For U.S. authorities, the issue may not solely be the mixer service itself, but rather its largest clients. According to Chainalysis’s on-chain data analysis, Sinbad has handled over $24 million in stolen funds from the Lazarus Group, including Ether and BTC obtained from the Axie Infinity and Horizon Bridge hacks.
Taking down an international mixer is a challenging task. While many clearnet websites (accessible through conventional web browsers) no longer exist, Sinbad’s dark website is still operational. Tornado Cash has also been relaunched on the clearnet, although it has modified its approach and introduced some compliance mechanisms. However, with U.S. authorities pursuing them, users of illicit mixers may have already migrated, indicating the possible demise of Sinbad.
In February 2023, Sinbad founder Mehdi, who remains pseudonymous, described the mixer as a legitimate project focused on preserving privacy. He compared its service to privacy-focused cryptocurrencies like Monero or Zcash, as well as anonymity-enhancing crypto wallet software such as Wasabi or the Tor browser, which encrypts user traffic and routes it through multiple servers to conceal people’s identities.
The creators of mixers are driven by the desire to protect financial privacy rights. A representative from Mixero expressed the view that the U.S. sanctions targeting mixers like Tornado Cash and Sinbad are not only unjustified but also infringe upon human privacy rights. Additionally, it is perplexing why mixers are singled out, especially considering the existence of fully anonymous cryptocurrencies like Monero. This raises questions about the rationale behind these actions against mixers.
Protecting privacy: Can mixers address misuse?
Total freedom, as desired by pure libertarians, comes with a cost. A mixer that follows a zero-control policy may have legitimate purposes but can also be exploited by sanctioned groups like DPRK hackers, which attracts regulatory scrutiny to the mixer.
So, should ordinary users avoid mainstream mixers? What if mixers could implement barriers to block certain groups, such as the Lazarus Group, that draw attention from U.S. authorities? Is this feasible?
According to a spokesperson from Mixero, the only way to satisfy legislators would be to implement Know Your Customer (KYC) standards, but this contradicts the fundamental purpose of a mixer.
On the other hand, Somensatto mentioned that mixers can implement mechanisms, such as using Chainalysis tools to monitor transactions and receive notifications about exposure to illicit sources. He also stated that mixing service providers can avoid enforcement actions by implementing a robust Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) program. This program serves as a mechanism to prevent money laundering by illicit actors and sanctioned entities.
The representative from Mixero expressed that adopting these methods would go against their policy. Once again, the ideology of anonymity clashes with tools for preventing money laundering.
Financial privacy as a human right
Many individuals in the cryptocurrency community view financial privacy as a fundamental human right. However, currently, only a few governing bodies officially recognize it as such.
The United Nations has an extensive list of rights that are inherent to all human beings. While financial privacy is not explicitly mentioned, the right to privacy is included. Some argue that financial privacy could be reasonably considered an extension of privacy rights. But what about the law?
According to Suzanne Ulrich, a privacy lawyer and consultant based in the Netherlands, there are solid laws that apply to financial privacy. In Europe, people are protected by various laws, such as the Convention for the Protection of Human Rights and Fundamental Freedoms and the General Data Protection Regulation. Additionally, many countries have included privacy rights in their constitutions. In the United States, there is also a right to privacy, although financial privacy is generally less protected compared to Europe. In the United States, financial privacy is regulated through federal and state laws.
While the law does firmly protect the human right to privacy, the concept of financial privacy may be less defined. Therefore, the question arises: are privacy protection laws sufficient to justify the existence and legitimacy of mixer services?
Over the years, mixers have garnered an unfavorable reputation as they have allowed anyone to use their services without restrictions. To improve their image, mixers may need to implement strategies to prevent illicit actors from accessing their services, as their survival may depend on it.