Tornado Cash Co-founder Roman Storm's Retrial Postponed to April 2027, Court to Examine 'Is Code a Crime?'

[Block Media Reporter Ham Ji-hyun] The retrial of Roman Storm, co-founder of the digital asset mixing protocol Tornado Cash, on charges of money laundering and violations of North Korean sanctions has been postponed to April next year. This case is drawing significant attention from the industry as it goes beyond determining the criminal responsibility of a single developer to assessing how far decentralized protocols and open-source software developers can be held accountable for users' criminal activities.

On the 25th (local time), Judge Katherine Polk Failla of the U.S. District Court for the Southern District of New York postponed Storm's retrial date from October 26, 2026, to April 26, 2027. This decision comes as Storm's motion for judgment of acquittal is still pending, and the defense requested a postponement of the retrial.

The court stated in its order, "Considering Storm's pending motion for judgment of acquittal and the related request to postpone the retrial to the end of April 2027, the retrial is postponed to April 26, 2027."

Only Guilty of Illegal Remittance... No Conclusion on Core Charges of Sanctions Violations

This case dates back to August 2023. The U.S. Department of Justice (DOJ) charged Storm and co-founder Roman Semenov with three counts: conspiracy to commit money laundering, conspiracy to operate an unlicensed remittance business, and conspiracy to violate North Korean sanctions under the International Emergency Economic Powers Act (IEEPA).

The prosecution claims that Tornado Cash was used to launder over $1 billion in criminal proceeds and that the North Korean-linked hacking group Lazarus used it to launder hundreds of millions of dollars in hacking funds.

The first trial, which began in July 2025, lasted about four weeks. The jury returned a guilty verdict only on the charge of conspiracy to operate an unlicensed remittance business, among the three charges applied to Storm in August of the same year. The maximum penalty for this charge is five years in prison. The prosecution argued that Storm continued to operate the service despite knowing that large amounts of criminal proceeds were being transferred through Tornado Cash.

However, the jury was unable to reach a unanimous conclusion on the more serious charges of conspiracy to commit money laundering and conspiracy to violate North Korean sanctions, each of which carries a maximum sentence of 20 years. Ultimately, a hung jury was declared on these two charges, allowing the prosecution to seek a retrial.

Storm's side has requested a not guilty verdict on the remaining charges, arguing that the evidence is insufficient for the prosecution to prove guilt. The court has heard arguments from both sides regarding this request but has not yet reached a conclusion.

Separately, the prosecution maintains its position to have the jury reassess the charges of money laundering and sanctions violations, which the jury could not conclude. The court initially scheduled the retrial for October 26 this year but accepted Storm's request for a postponement to April next year.

Can Developers Be Held Responsible for 'Code Used by Criminals'?

The key focus for the market in this retrial is not Tornado Cash itself but the legal liability of decentralized software developers.

Tornado Cash is a non-custodial protocol that enhances transaction privacy by breaking the connection between deposit and withdrawal addresses using Ethereum smart contracts.

The crux of Storm's argument lies here. The question is whether a developer can be held responsible simply because a third party used the distributed code for criminal purposes after its release. The defense argues that smart contracts cannot even be controlled by the developer.

In contrast, the prosecution's argument goes beyond merely stating that "the code was written." They assert that Storm and others developed Tornado Cash's core functions, bore the infrastructure operating costs, promoted the service, profited from it, and continued to provide the service despite knowing that large amounts of criminal funds were being transferred. They particularly criticized Storm for failing to take effective blocking measures after realizing that the Lazarus group was using Tornado Cash.

Thus, depending on the retrial's outcome, the criteria for assessing regulatory risks for decentralized finance (DeFi), privacy protocols, as well as wallets and various open-source blockchain infrastructure developers may change.

Changing Dynamics Outside the Court... U.S. Treasury Officially Lifts Sanctions on Tornado Cash

The heightened attention on Storm's trial is also due to the changing narrative from the U.S. government regarding Tornado Cash outside the courtroom.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Tornado Cash for sanctions in 2022. However, the Fifth Circuit Court of Appeals ruled in November 2024 that Tornado Cash's immutable smart contracts cannot be owned, controlled, or changed by anyone, and thus do not constitute "property" that can be sanctioned under IEEPA. They viewed the ability to sanction malicious users as separate from the ability to sanction the code itself, which no one can control.

Subsequently, the U.S. Treasury officially lifted economic sanctions against Tornado Cash in March 2025. However, they clarified that this does not mean a relaxation of concerns regarding North Korea's digital asset theft and money laundering or the enforcement of sanctions.

This is a separate matter from Storm's criminal trial. The appellate court's limitation on OFAC's sanctioning authority over Tornado Cash's smart contracts does not automatically eliminate Storm's charges of money laundering and operating an unlicensed remittance business. However, the same question of how to legally distinguish between "autonomously operating code" and "the developers and operators of that code" permeates both cases.

The shift in the U.S. government's criminal enforcement policy regarding digital assets since Storm was first charged in 2023 is also a variable.

Todd Blanch, Deputy Attorney General, issued guidelines in April 2025 titled "Ending Regulation By Prosecution," stating that the DOJ should not act as a regulatory agency for digital assets. Consequently, the DOJ disbanded the National Cryptocurrency Enforcement Team (NCET) and shifted its policy to focus investigative resources on clear criminal activities such as investor fraud, terrorism, drug offenses, and hacking rather than simple regulatory violations by operators.

In particular, this guideline aims to curb the expansion of criminal liability for service providers like exchanges and mixers based on the actions of end users. It also emphasizes that regulatory crimes such as operating an unlicensed remittance business or violations of the Bank Secrecy Act (BSA) should focus on cases where intent can be sufficiently proven.

Despite this, the Southern District of New York continues to pursue the Storm case. Notably, the retrial includes charges related to sanctions violations involving the North Korean Lazarus group, supporting the prosecution's argument that this case differs from digital asset regulatory cases.

Industry and government perspectives on this retrial are mixed.

Ethereum co-founder Vitalik Buterin has publicly supported Storm. In January of this year, Buterin stated, "I strongly believe in the importance of privacy" and advocated for the necessity of privacy technologies like Tornado Cash. He even praised Storm for the fact that the application continued to operate after he stepped away.

Miller Whitehouse-Levine, CEO of the Solana Policy Institute, described the prosecution's push for a retrial as "a sad thing." The Solana Policy Institute supports Storm's legal defense, arguing that the case could determine the legal liability of open-source developers.

Internally, the U.S. Department of Justice does not view writing code as a crime. However, they maintain that if a developer is directly or indirectly involved in money laundering and sanctions evasion, they cannot escape responsibility.

Matthew Galeoti, a member of the DOJ's Criminal Division, stated last year, "Writing code is not a crime," but emphasized that "if a developer intentionally commits fraud, money laundering, or sanctions evasion, or assists in such actions, they will be held criminally liable."