Tornado Cash

Our research assessment is adverse. Tornado Cash is privacy infrastructure, not an economic claim or income venue. Its AML, source-of-funds, custody-note, and counterparty-screening requirements put it outside the current firm shelf. That policy conclusion does not depend on yield. Treasury removed Tornado Cash sanctions in March 2025, so this is not an outdated sanctions rejection. The current fact is narrower: DOJ obtained a 2025 conviction for knowingly operating an unlicensed money-transmission business that moved criminal proceeds, while immutable pools provide no counterparty screening.

Review triggers: events that reopen the verdict
• A client-specific privacy mandate is approved by counsel and compliance with documented lawful purpose and transaction-monitoring controls
• The custodian, banking, and tax-reporting counterparties confirm in writing that the proposed flow and compliance report are acceptable
• A proposed-size test preserves the withdrawal note and produces a complete source-of-funds report without an unapproved relayer

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-19.

The research file

Mechanism and client claim

Classic pools accept a fixed-denomination deposit and issue a private note; a zk-SNARK later proves membership without linking the withdrawal address to the deposit address. A relayer can submit the withdrawal and deduct gas and a service fee so the destination need not be pre-funded. Nova supports arbitrary balances and shielded transfers on Gnosis. The deposit itself produces no investment return: value remains idle in the mixer until the note holder withdraws. DefiLlama’s roughly $578M is locked privacy-pool capital, not a lending book or revenue-bearing client claim.

Control, governance, and legal perimeter

The original Classic pool contracts are documented as immutable, while TORN governance controls governance and relayer-registry parameters through proposal thresholds, five-day voting, quorum, and a two-day timelock. Relayers are permissionless after staking, but a relayer handles submission and fee payment; the note is the practical withdrawal credential. Immutable code reduces upgrade-key risk while eliminating an administrator who can remediate a mistaken deposit or screen the counterparty set. Any advisor workflow would need to preserve the note, prove beneficial ownership, screen source and destination exposure, and document why obfuscation served a client purpose.

Incident and operating record

Treasury formally delisted Tornado Cash on 2025-03-21 after litigation over the sanctions theory, and explicitly continued warning about DPRK and illicit-finance risk. On 2025-08-06 DOJ announced Roman Storm’s conviction for conspiring to operate an unlicensed money-transmitting business that transmitted more than $1B in criminal proceeds. Those two facts must be stated together: use is not categorically prohibited merely because the protocol address was once sanctioned, but delisting did not certify ordinary advisor suitability or remove transaction-monitoring obligations and severe provenance risk.

Exit, liquidity, and failure path

Classic withdrawal requires the correct note and a valid zero-knowledge proof; loss or disclosure of the note can strand or transfer practical control. A user can self-submit with gas from the destination or depend on a relayer whose fee and availability vary. Token contracts, destination chains, RPCs and interfaces add separate access paths, while compliance tooling can voluntarily reveal the deposit-withdrawal link for a report. None of these paths guarantees that a custodian, bank, exchange, auditor, or compliance program will accept the resulting funds without enhanced review.

Comparison and decision

Ordinary self-custody preserves on-chain ownership without deliberately breaking transaction linkage. Where privacy is a documented client objective, legal counsel and a purpose-built compliance process must precede any tool selection; a public RIA model cannot infer suitability from Treasury delisting. Yield or portfolio return cannot offset the evidentiary burden, immutable error recovery, relayer dependence, and exposure to illicit pooled flows. Reassess the shelf only for a separately authorized privacy mandate with counsel-approved controls and a reproducible source-of-funds package.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Tornado Cash Documentation — introduction · primary · accessed 2026-08-19
  Supports: deposit and withdrawal mechanism, immutability, supported chains
• Tornado Cash Documentation — governance · primary · accessed 2026-08-19
  Supports: proposal threshold, voting period, quorum, timelock
• Tornado Cash Documentation — compliance tool · primary · accessed 2026-08-19
  Supports: note custody, voluntary linkage report
• U.S. Treasury — Tornado Cash delisting · primary · accessed 2026-08-19
  Supports: March 2025 delisting, continued DPRK warning
• U.S. Department of Justice — Roman Storm conviction · primary · accessed 2026-08-19
  Supports: August 2025 conviction, unlicensed money transmission, criminal proceeds
• DefiLlama — Tornado Cash protocol data · secondary · accessed 2026-08-19
  Supports: protocol category, chain perimeter, current TVL

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.