Tornado Cash and the cryptography of on-chain privacy

The deposit

A deposit into Tornado Cash starts in the user's browser, not on the chain. The client generates two random values, conventionally called the nullifier and the secret, and hashes them together into a single value called the commitment. Only the commitment is sent to the contract along with the money. Tornado Cash inserts that commitment as a leaf in an incremental Merkle tree and records the new tree root. The pair of random values is written into a string the user must save, the deposit note, which functions as the only key to those funds.

The withdrawal

To withdraw, the user takes the note, reconstructs the secret values, and builds a zero-knowledge proof off-chain. The proof asserts that the person holds a note whose commitment sits somewhere in the tree, without saying where. Along with the proof, the client publishes the hash of the nullifier. Tornado Cash checks the proof against a stored root, checks that this nullifier hash has never been seen before, marks it as spent, and pays out the denomination to whatever recipient address the proof commits to. Because the recipient is bound inside the proof, nobody can intercept a withdrawal and redirect it.

$ deposit
  commitment    = pedersenHash(nullifier, secret)
  tree.insert(commitment)          # depth 20, MiMC hashing
  note          = "tornado-eth-1-1-0x<nullifier><secret>"   # keep offline

$ withdraw
  proof         = prove(root, nullifierHash, recipient, relayer, fee)
  require(isKnownRoot(root))
  require(!nullifierHashes[nullifierHash])
  nullifierHashes[nullifierHash] = true
  send(denomination - fee -> recipient)

What the proof actually proves

In plain language, the statement verified by Tornado Cash is: "I know the secret values behind one of the commitments in this tree, and I have not spent it before." Nothing in that statement identifies the leaf. The verifier learns only that the claim is true, which is the defining property of a zero-knowledge proof. The circuit is proved with Groth16 over the BN254 curve, chosen because verification is cheap enough to run inside an Ethereum transaction while proof generation stays feasible on a laptop.

Setup and immutability

Groth16 requires a one-time parameter generation step per circuit, and a party that keeps the leftover randomness could forge proofs. Tornado Cash addressed this with a public multi-party ceremony in which many independent contributors each added entropy, so the setup stays sound as long as at least one participant destroyed their share honestly. It is a real assumption, and anyone auditing Tornado Cash should treat the ceremony as part of the trust model rather than a footnote.

The core pool contracts of Tornado Cash were deployed without an owner, an upgrade path, or a pause function. That decision was deliberate, and it later turned out to be the most consequential engineering choice in the project's history: when governments, hosting providers, and front-end operators withdrew support in 2022, the contracts themselves kept accepting deposits and honoring withdrawals exactly as written, because there was nobody left with the power to stop them.

There is a subtle failure mode in any private withdrawal: someone has to pay gas. If a brand new address has to be funded with ETH before it can submit a withdrawal, whoever funded it has just written the link that the whole scheme was supposed to erase. Tornado Cash handles this with relayers, third parties who broadcast the withdrawal transaction on the user's behalf and take a fee out of the withdrawn amount. Relayers in Tornado Cash are not custodians and never touch the pooled balance, so the recipient address needs no prior funding and never appears as the transaction sender.

Relayers cannot cheat, because the recipient address and the fee are both fixed inside the zero-knowledge proof; a relayer that alters either one produces an invalid transaction. What a relayer can do is observe metadata, such as the IP address that submitted the proof and the timing of the request, which is why relayer choice and network-level hygiene were always part of using Tornado Cash properly. Later versions of the protocol added an on-chain relayer registry with staked TORN, intended to make it costlier to run relayers that harvest user data or advertise dishonestly.

The cryptography inside Tornado Cash is not the weak point. Users are. The proof hides which leaf a withdrawal spends, but it cannot hide the shape of a user's behavior, and chain analysis firms built a whole practice around exactly that gap. The relevant measure is the anonymity set: the number of deposits in the same pool that a given withdrawal could plausibly correspond to, once every observable clue has been used to eliminate candidates.

Several patterns shrink that set dramatically. Depositing and withdrawing within a few minutes narrows the candidates to whoever was active in that window. Withdrawing an unusual combination of denominations, such as one 100 ETH note plus three 10 ETH notes, produces a fingerprint that may match only a single depositor. Sending funds straight from the withdrawal address back to a known exchange account, or reusing an address that already has a public history, reintroduces the link at the other end. None of these leaks come from a flaw in Tornado Cash itself; they live entirely outside the circuit, on either side of the pool.

Anyone studying Tornado Cash as a case study in privacy engineering should take away the general lesson rather than the specific tool. Cryptographic unlinkability is fragile at the edges, and it degrades toward zero as soon as the surrounding metadata is distinctive. The documented practices for keeping an anonymity set large were straightforward but demanded patience, which is a poor match for how most people actually transact.

A governance token called TORN was introduced in late 2020, with an airdrop to early users of the ETH pools, and on-chain governance began operating in 2021. Token holders could lock TORN to vote on proposals covering the relayer registry, treasury spending, incentive parameters, and new deployments. Importantly, this governance never gained authority over the original pool contracts of Tornado Cash, which remained immutable, so votes could shape the periphery but not the core.

One of the more interesting mechanisms attached to Tornado Cash was anonymity mining. Because privacy improves when deposits sit in a pool for a long time, the protocol rewarded depositors with anonymity points that scaled with how long their notes stayed unspent, redeemable for TORN through a shielded accounting system so that claiming a reward did not itself reveal the deposit. It was a genuine attempt to pay users for producing a public good, and it also showed how hard it is to add token incentives to a privacy system without opening new correlation channels. Anonymity mining was eventually wound down, but it remains one of the more original ideas Tornado Cash produced.

Governance also produced the project's sharpest self-inflicted wound. In May 2023 an attacker slipped malicious logic into a proposal that looked routine, passed it, and briefly took control of the governance contract and a large block of voting power before control was returned. The episode is now a standard reference for how proposal review, not just contract audits, belongs in the threat model of any decentralized organization, and it happened to Tornado Cash while the protocol was already under intense legal pressure.

Privacy and secrecy are not the same thing, and Tornado Cash tried to make that distinction concrete. Because the deposit note is the only object that ties a deposit to its withdrawal, the note holder can choose to reveal that connection to a specific counterparty. The Tornado Cash compliance tool let a user turn a note into a report proving that a particular withdrawal came from a particular deposit, which an exchange, auditor, or tax authority could verify against the chain.

This is what cryptographers call selective disclosure: the user, not the network, decides who learns the link. In practice adoption was limited, since compliance departments were rarely set up to evaluate a proof of that kind, and after 2022 many institutions simply refused any funds that had touched Tornado Cash regardless of documentation. The mechanism still matters as design precedent, because it demonstrates that a privacy pool does not have to be an all-or-nothing black box.

On August 8, 2022, the U.S. Treasury's Office of Foreign Assets Control added Tornado Cash and a long list of associated Ethereum addresses to the Specially Designated Nationals list. The announcement stated that more than seven billion dollars in virtual currency had been laundered through the protocol since 2019, including hundreds of millions stolen by the North Korea-linked Lazarus Group. It was the first time the sanctions regime had been pointed at autonomous software rather than a person, a company, or a vessel, and OFAC re-designated Tornado Cash later that year under authorities tied to North Korea.

The practical effects arrived within days. Code repositories and developer accounts were taken down, the project's chat server disappeared, some infrastructure providers stopped serving requests to the contracts, a stablecoin issuer froze balances at sanctioned addresses, and mainstream applications began blocking wallets that had received funds from the pools. A stunt followed in which small amounts were sent from Tornado Cash to the public addresses of celebrities, illustrating that anyone could taint anyone else's wallet without consent. Critics also disputed the headline figure, noting that it measured all volume through the pools rather than the criminal share of it.

Prosecutions

Developer Alexey Pertsev was arrested in the Netherlands in August 2022 and convicted of money laundering by a Dutch court in May 2024, receiving a sentence of 64 months; he was later released under electronic monitoring while pursuing an appeal. In the United States, prosecutors charged Roman Storm and Roman Semenov in August 2023 with conspiracy counts including money laundering, sanctions violations, and operating an unlicensed money transmitting business. Storm's trial ended in August 2025 with a conviction on the unlicensed money transmitting count and a deadlocked jury on the rest. Semenov, who was also sanctioned individually, has not been in U.S. custody. The charges in both countries target people who built and promoted Tornado Cash, not the users of the pools.

Meanwhile the designation itself was challenged in court. In November 2024 the U.S. Court of Appeals for the Fifth Circuit ruled in favor of plaintiffs who argued that the immutable smart contracts behind Tornado Cash are not "property" and cannot be owned or controlled by anyone, and therefore fall outside the statutory authority OFAC had used. In March 2025 the Treasury removed Tornado Cash and the associated addresses from the SDN list, an unusual reversal that turned the case into the reference point for how sanctions law applies to unowned code.

The legal story around Tornado Cash split into two separate questions that are easy to confuse: whether a set of ownerless contracts can be sanctioned, and whether the individuals who wrote and promoted the software bear criminal responsibility for how others used it. The first was answered in the negative on appeal. The second is still being worked out.

None of this is legal advice, and the delisting did not make the surrounding rules disappear. Anti-money-laundering obligations, other jurisdictions' regimes, and the risk policies of individual exchanges all continue to apply independently. Many compliance systems still score funds that passed through Tornado Cash as elevated risk, which means a technically legal transaction can still result in a frozen account or a rejected deposit.