2022 was the year the U.S. Treasury’s Office of Foreign Assets Control (OFAC) formally put mixers on the Specially Designated Nationals (SDN) list. The actions against Blender.io and Tornado Cash signaled that privacy infrastructure can be sanctioned just like banks if it allegedly facilitates nation-state hacking.
Blender.io (May 2022)
OFAC’s press release accused Blender.io of laundering more than $20 million for North Korea’s Lazarus Group following the Axie Infinity Ronin bridge exploit. Treasury listed dozens of deposit and withdrawal addresses and prohibited U.S. persons from providing funds, goods, or services to the mixer.
The designation also highlighted how the Treasury works with blockchain analytics firms. Investigators traced the stolen Ronin funds through Blender, then froze them at compliant exchanges. That public attribution made Blender radioactive overnight.
Tornado Cash (August 2022)
In August, OFAC sanctioned Tornado Cash, listing smart contract addresses on Ethereum, BSC, and other chains. Treasury alleged that Tornado processed $455 million for Lazarus and hundreds of millions more for ransomware crews.
Because Tornado is a non-custodial smart contract, the sanctions triggered unprecedented side effects: GitHub removed the repository, Infura/Alchemy blocked RPC calls, and Circle froze USDC held inside the pools. Developers Alexander Pertsev and Roman Storm were arrested in Europe and the U.S., respectively, leading to ongoing court challenges.
Compliance Takeaways
- Check the SDN list before interacting with any mixer or privacy service; the list now contains dozens of crypto addresses.
- If you operate infrastructure (RPC endpoints, hosting, wallets), implement controls to block sanctioned addresses or risk secondary sanctions.
- Devs should document their lack of control over immutable smart contracts and consider geofencing U.S. IP addresses.
Aftermath
The sanctions forced privacy projects to reassess their threat models. Custodial mixers tightened KYC screening or shut down entirely, and CoinJoin coordinators began monitoring SDN updates to avoid relaying sanctioned coins. Even Bitcoin-only services that never touched Tornado Cash felt the effect as exchanges expanded their screening lists to include any CoinJoin or mixer reference.
Legal battles are still playing out. A Fifth Circuit decision in 2024 narrowed OFAC’s Tornado Cash ban, but the Treasury hasn’t removed the addresses, and the criminal cases against the developers continue.
Sources
BitMixList publishes these updates for awareness, not to encourage sanctions evasion. Follow the law where you live.
Author
NotATether
Bitcoin privacy researcher and maintainer of BitMixList. Focused on mixer history, enforcement timelines, and practical privacy workflows for users operating in high-friction jurisdictions.
