Tornado Cash Founders Charged with Money Laundering and Sanctions Violations

A Russian national and a Washington man were charged today with conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed money transmitting business.

According to the indictment, unsealed today in the Southern District of New York, Roman Storm, 34, of Auburn, Washington, and Roman Semenov, 49, of Russia, created, operated, and promoted Tornado Cash, a cryptocurrency mixer that facilitated more than $1 billion in money laundering transactions, and laundered hundreds of millions of dollars for the Lazarus Group, the sanctioned North Korean cybercrime organization. Storm was arrested today in the state of Washington and will be presented later today in the Western District of Washington.

“As alleged in the indictment, the defendants operated a $1 billion scheme designed to help other criminals launder and conceal funds using cryptocurrency, including by laundering hundreds of millions of dollars on behalf of a state-sponsored North Korean cybercrime group sanctioned by the U.S. government,” said Attorney General Merrick B. Garland. “These charges should serve as yet another warning to those who think they can turn to cryptocurrency to conceal their crimes and hide their identities, including cryptocurrency mixers: it does not matter how sophisticated your scheme is or how many attempts you have made to anonymize yourself, the Justice Department will find you and hold you accountable for your crimes.”

“Today’s announcement should remind criminal organizations everywhere in the world that they are neither untraceable nor anonymous,” said FBI Director Christopher Wray. “You can’t hide from us behind a keyboard — whether you’re a hacker or facilitator. Those charged today engaged in a conspiracy to launder money for cybercriminals, including for a North Korean cybercrime organization seeking to evade sanctions. As we have with this operation, the FBI is going to keep dismantling the infrastructure used by cyber criminals to commit and profit from their crimes, and holding anyone who assists those criminals accountable.”

“Cryptocurrency mixers have become the go-to method for criminals to conceal their ill-gotten gains. As alleged, the defendants operated Tornado Cash as a safe haven for criminal actors to obfuscate the trail of funds tied to their criminal activities, such as computer hacking and wire fraud,” said Acting Assistant Attorney General Nicole M. Argentieri of the Justice Department’s Criminal Division. “The Criminal Division will continue to prioritize the investigation and prosecution of those who seek to criminally exploit the cryptocurrency ecosystem.”

“As stated in the indictment, the defendants’ cryptocurrency service facilitated more than $1 billion in illicit transactions and they knowingly allowed a globally sanctioned cybercrime group to launder hundreds of millions of dollars on behalf of the North Korean regime,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “The Justice Department – alongside our domestic and international law enforcement partners – will use every tool in our arsenal to pursue and dismantle the criminal networks that enable U.S. sanctions violations wherever they operate.”

“As alleged, Tornado Cash was an infamous cryptocurrency mixer that laundered more than one billion dollars in criminal proceeds and violated U.S. sanctions,” said U.S. Attorney Damian Williams for the Southern District of New York. “Roman Storm and Roman Semenov allegedly operated Tornado Cash and knowingly facilitated this money laundering. While publicly claiming to offer a technically sophisticated privacy service, Storm and Semenov in fact knew that they were helping hackers and fraudsters conceal the fruits of their crimes. Today’s indictment is a reminder that money laundering through cryptocurrency transactions violates the law, and those who engage in such laundering will face prosecution.”

Storm and Semenov were two of the three founders of the Tornado Cash service, a cryptocurrency mixer that allowed its customers to engage in untraceable transfers of cryptocurrency. The defendants and their co-conspirators allegedly created the core features of the Tornado Cash service, paid for critical infrastructure to operate the Tornado Cash service, promoted the Tornado Cash service, and made millions of dollars in profits from operating the Tornado Cash service. The Tornado Cash service advertised to customers that it provided untraceable and anonymous financial transactions, and Storm and Semenov chose not to implement know-your customer or anti-money laundering programs as required by law. As a result, the Tornado Cash service was used to launder more than $1 billion in criminal proceeds. Storm and Semenov allegedly knew about these money laundering transactions and received complaints and requests for help from victims of hacking and other cybercrimes. However, they refused to implement any controls and continued to operate the Tornado Cash service and facilitate these money laundering transactions.

In April and May 2022, the Tornado Cash service was allegedly used by the Lazarus Group, a sanctioned North Korean cybercrime organization, to launder hundreds of millions of dollars in hacking proceeds. Storm and Semenov allegedly knew that the Tornado Cash service they were operating was engaging in these sanctions-violating transactions. They implemented a change in the service so they could make a public announcement that they were compliant with sanctions, but in their private chats they agreed that this change would be ineffective. They then continued to operate the Tornado Cash service and facilitate hundreds of millions of dollars in further sanctions-violating transactions, helping the Lazarus Group to transfer criminal proceeds from a cryptocurrency wallet that had been designated by the Office of Foreign Assets Control (OFAC) as blocked property.

Storm and Semenov are each charged with one count of conspiracy to commit money laundering and one count of conspiracy to violate the International Economic Emergency Powers Act, each of which carries a maximum penalty of 20 years in prison. They are also each charged with conspiracy to operate an unlicensed money transmitting business, which carries a maximum penalty of five years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

The FBI and the IRS-Criminal Investigation are investigating the case. The Justice Department’s Office of International Affairs provided valuable assistance.

Assistant U.S. Attorneys Thane Rehn and Benjamin Gianforti for the Southern District of New York, and Trial Attorneys Jacques Singer-Emery and Garrett Coyle of the Justice Department's National Security Division are prosecuting the case in partnership with the Criminal Division’s National Cryptocurrency Enforcement Team (NCET).

The NCET was established to combat the growing illicit use of cryptocurrencies and digital assets. Within the Criminal Division’s Computer Crime and Intellectual Property Section, the NCET conducts and supports investigations into individuals and entities that enable the use of digital assets to commit and facilitate a variety of crimes, with a particular focus on virtual currency exchanges, mixing and tumbling services, and infrastructure providers. The NCET also sets strategic priorities regarding digital asset technologies, identifies areas for increased investigative and prosecutorial focus, and leads the Department’s efforts to collaborate with domestic and foreign government agencies as well as the private sector to aggressively investigate and prosecute crimes involving cryptocurrency and digital assets.

An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.