Case StudyMay 2025 · 5 min read

Tornado Cash: The $7B Mixer That Got Sanctioned

How the most-used crypto mixer works, why OFAC banned it, and what it means for your wallet.

Tornado Cash was a smart contract on Ethereum that mixed transactions — breaking the link between sender and receiver. Before it was sanctioned, it processed over $7 billion in crypto. A significant portion of that came from hackers, ransomware operators, and North Korean state actors.

How it worked

Standard Ethereum transactions are fully public — anyone can trace who sent what to whom. Tornado Cash broke that trail in three steps:

01
Deposit

You deposit exactly 0.1, 1, 10, or 100 ETH into the Tornado contract. It gives you a cryptographic "note" — a secret receipt.

02
Wait

You wait. The longer you wait, the harder the trail is to follow. Your deposit sits pooled with hundreds of others.

03
Withdraw

From a completely fresh wallet with no history, you submit your note. The contract releases the same denomination to your new wallet — with zero on-chain link to the deposit.

Why OFAC sanctioned it in August 2022

The U.S. Treasury's Office of Foreign Assets Control sanctioned Tornado Cash — not just its developers, but the smart contract addresses themselves. This was unprecedented: a piece of code placed on the SDN list.

The reason: OFAC estimated Tornado Cash had been used to launder over $7 billion, including $455 million stolen by North Korea's Lazarus Group and $96 million from the Harmony bridge hack. The mixer was enabling state-sponsored cybercrime at scale.

What it means for your wallet

If your wallet ever sent to or received from Tornado Cash — even once, even years ago — ClearChain will flag it. That interaction is permanently on-chain.

ScenarioClearChain resultRisk level
Wallet directly used Tornado CashMixer interaction signal fires (+25 pts)HIGH
Wallet received funds that passed through Tornado CashHigh-risk counterparty signal (+10 pts)MEDIUM–HIGH
Wallet funded the Tornado Cash deployer addressOFAC SDN match (+40 pts)CRITICAL
No interaction, no counterparty linkNo signal firesLOW
The Tornado Cash sanction is the clearest example of how regulatory action translates directly into ClearChain signals. OFAC adds addresses; ClearChain's list refreshes automatically; any wallet that touched those addresses gets flagged — no manual update needed.
Check a wallet now
Free OFAC screening, risk scoring, and on-chain analysis in seconds.
RUN ANALYSIS →
More from Intel
Case Study
The Bitfinex Hack: $72M Stolen, $3.6B Recovered, 6 Years Later
Case Study
Silk Road: How the FBI Traced $1B in "Anonymous" Bitcoin
Case Study
The Lazarus Group: $3B in Crypto, Stolen by North Korea