Roman Storm remains convicted as DOJ’s expansive theory raises concerns about developer liability

Roman Storm, co-founder of the Ethereum-based privacy mixer Tornado Cash, stands convicted of conspiracy to operate an unlicensed money transmitting business. The conviction, handed down in August 2025 by a jury in the Southern District of New York, carries a maximum sentence of five years. But the real story isn’t the conviction itself. It’s the legal theory the DOJ used to get there, and where that theory could logically travel next.

The jury deadlocked on two additional, far more severe charges: conspiracy to commit money laundering and conspiracy to violate sanctions. Each of those carries up to 20 years. The DOJ isn’t letting that go quietly, pushing for a retrial on the deadlocked counts as early as October 2026.

The case against writing code

Tornado Cash launched in 2019 as a non-custodial mixer. In plain terms, it’s a smart contract on Ethereum that lets users deposit crypto and withdraw it later in a way that breaks the on-chain link between sender and receiver. It uses zero-knowledge proofs to verify transactions without revealing details. No company holds your funds. No human intermediary touches them.

That distinction, non-custodial versus custodial, sits at the heart of this case. Traditional money transmitters like Western Union or PayPal take possession of customer funds and move them on the customer’s behalf. Tornado Cash’s smart contracts execute autonomously on the Ethereum blockchain. Storm’s defense has argued, repeatedly, that writing and deploying code that runs without human intervention is fundamentally different from operating a money transmitting business.

The DOJ disagrees. Prosecutors alleged that Tornado Cash facilitated over $1 billion in transactions linked to illicit activities, including funds tied to North Korean hackers. The protocol was sanctioned by the Treasury Department’s Office of Foreign Assets Control (OFAC) in August 2022, and Storm was indicted a year later in August 2023.

Storm himself has pushed back publicly on the DOJ’s reasoning, drawing comparisons to mainstream technology platforms. If deploying a tool that bad actors can misuse makes you criminally liable, he’s argued, then Google and OpenAI should be having similar conversations with federal prosecutors.

Why the legal theory matters beyond Tornado Cash

A motion for acquittal was filed by Storm’s defense and heard on April 9, 2026. The outcome of that motion, along with any retrial on the deadlocked counts, will help define where the line sits between building neutral technology and facilitating crime.

The OFAC sanctions against Tornado Cash in August 2022 already demonstrated that smart contract addresses themselves could be sanctioned, a novel and controversial application of the Treasury Department’s authority. Storm’s conviction adds criminal liability for the humans behind those contracts.

The retrial on the deadlocked counts, if it proceeds in October 2026, will be the next major inflection point. A conviction on money laundering or sanctions violations would dramatically increase Storm’s potential sentence and further cement the precedent.