A jury in Manhattan has found Tornado Cash co-founder Roman Storm guilty of operating an unlicensed money transmission business, while deadlocking on more serious charges of money laundering and sanctions violations tied to the North Korean hacker group Lazarus.
Storm, who was charged in 2023, faced allegations of facilitating over $1 billion in illicit transactions via Tornado Cash, a crypto privacy protocol. Prosecutors claim millions of dollars were laundered through the tool by Lazarus, a sanctioned entity linked to multiple high-profile cyberattacks.
The trial, overseen by Judge Katherine Polk Failla in the Southern District of New York, ended in a partial verdict after days of deliberation. While the jury agreed Storm operated an unlicensed money transmission service, it could not agree on whether he knowingly engaged in money laundering or violated U.S. sanctions law.
Prosecutors argued that Storm was aware of the tool’s use by North Korean actors and profited from it. During closing arguments, they claimed Storm “knew what he was doing” and “made millions.”
Storm’s legal team pushed back, stating that Storm and his co-founders never intended Tornado Cash to be used by hackers. “They dropped F-bombs when they found out,” the defense said, quoting internal reactions after discovering Lazarus’ involvement.
Storm has become a symbolic figure in the crypto community’s broader debate around developer liability and financial privacy.
Prominent voices, including the DeFi Education Fund and Ethereum co-founder Vitalik Buterin, publicly defended Storm, arguing that non-custodial software developers should not be held responsible for how open-source tools are used. The DeFi Education Fund said:
Our position is clear: developers of noncustodial peer-to-peer protocols do not exercise control or custody over user assets. They are not running money-transmitting businesses under the Bank Secrecy Act.
Buterin took a more personal stance:
You created Tornado in significant part because of my suggestion… it would violate basic honor for me to not support you in your hour of need. In Ethereum we protect our own.
The verdict comes in the wake of another major legal blow to crypto privacy tools. Just last week, the founders of Samourai Wallet, a Bitcoin mixer, pleaded guilty to charges related to money laundering.
The Storm case is being closely watched for its impact on future open-source crypto development, particularly around privacy-focused protocols. While the guilty verdict on the unlicensed transmitter charge could carry years in prison, the mistrial on the more severe counts has kept the door open for future legal wrangling.
