The case has become a global test case for open-source developers.
Ethereum co-founder Vitalik Buterin has thrown his public support behind Tornado Cash developer Roman Storm — who was convicted last August of a money transmitting charge — arguing that privacy-preserving software is a fundamental human right, and that Storm’s work should not be criminalized simply because it can be misused.
“I have supported Roman Storm’s work from the beginning both as a strong believer in the importance of privacy, and as an active user of privacy tools, including those developed by Roman,” Buterin wrote on X on Friday, sharing a letter of support he had written for Storm.
“In the 21st century, we are all faced with risks from all corners of the world, both online and offline. If someone has information about you, they have the [ability to] exploit you — socially, commercially, or even physically,” Buterin continued. “Being able to choose with whom we share information about our personal lives, our communications with friends and colleagues, our whereabouts and our finances, is an essential protection against this.”
Tornado Cash, a crypto mixer that helps obscure the path of transactions, was placed on the U.S. Treasury’s sanctions list in 2022 after officials said it had been used by North Korea’s Lazarus Group and other criminals to launder billions of dollars in stolen digital assets.
Tornado Cash was used to wash proceeds from major hacks, including the $622 million Ronin Bridge exploit and a $100 million theft from Harmony Bridge, with blockchain analytics firm Elliptic estimating that more than $1.5 billion in illicit crypto flowed through the mixer before it was sanctioned. Around $7 billion in total assets went through the platform.
The Office of Foreign Assets Control barred Americans from using the service, though the sanctions were lifted in March 2025.
Storm was charged in 2023 with conspiracy to commit money laundering, conspiracy to violate sanctions, and conspiracy to operate an unlicensed money transmitting business. Last August, a Manhattan jury convicted him on the unlicensed money transmitting count, but deadlocked on the others.
Several weeks later, Matthew Galeotti, head of the DOJ’s criminal division, said software developers would no longer be convicted under the charge for which Storm had been convicted.
Storm has not yet been sentenced and has filed a motion for an acquittal, which prosecutors have opposed. He faces up to five years in prison.
Another Tornado Cash developer, Alexey Pertsev, also faced criminal proceedings. Dutch authorities arrested the Russian national in 2022, and a court later found him guilty of laundering $1.2 billion in illicit assets through the mixer, sentencing him to more than five years in prison. Pertsev has since been released to house arrest while he appeals.
The Ethereum Foundation pledged $1.25 million toward Pertsev’s legal defense.
In Storm’s case, Buterin added that privacy is necessary for many parts of our society — including culture and politics — to function without devolving into social games or outright coercion.
“Many have the implicit viewpoint that privacy from the public is fine, but surely governments and police and intelligence agencies should be able to see everyone’s information to ensure safety,” he said.
Buterin said he strongly disagreed with this approach, as government databases can be hacked and information lands in the hands of foreign adversarial actors.
“Agencies routinely outsource their work to private corporations, who sell the data behind everyone’s back. Cell phone companies, who have everyone’s location data, often casually sell it to anyone who asks, which often leads it to end up in the hands of hostile foreign governments,” he explained.
“Roman, and I, want to see a world where basic protections of our rights, that were an unquestioned default in the previous millennium, stay with us in the next,” he added. “And for that, I support him.”
