Tornado Cash: How This Ethereum Crypto Mixer Works and Why It Matters

Learn how Tornado Cash processes deposits, pools funds, and hides on-chain links so you can understand this Ethereum privacy mixer’s role in crypto.

Introduction

Tornado Cash is one of the best-known crypto mixers and one of the most controversial blockchain privacy tools ever deployed on a public network. It uses advanced cryptography to break the on-chain link between the address that deposits crypto assets and the address that withdraws them later.

For several years, Tornado Cash functioned as a non-custodial mixer for Ethereum and several ERC-20 tokens, meaning users kept cryptographic control of their funds through smart contracts rather than trusting a centralized operator. However, regulators and blockchain analytics firms linked Tornado Cash to several high-profile hacks and large-scale money laundering, which led to U.S. sanctions in 2022 and the arrest of two core developers in 2023.

This article explains how Tornado Cash works, how it uses zero-knowledge proofs for privacy, why it was sanctioned, and what lessons users can learn about mixers, anonymity, and regulatory risk in the crypto ecosystem.

What Is Tornado Cash? Basic Definition and Context

Tornado Cash is a decentralized, non-custodial mixer on Ethereum designed to enhance transaction privacy by breaking the public link between sending and receiving addresses. It operates through a set of smart contracts that accept deposits of fixed denominations and later allow withdrawals to different addresses without revealing which deposit each withdrawal came from.

The project launched in 2019 as an experimental privacy protocol that applied zero-knowledge proofs (specifically zk-SNARKs) and Merkle trees to Ethereum. Over time, it added support for multiple assets and deployed new versions of its contracts to improve security, decentralization, and governance. The core idea remained simple: allow users to move assets with stronger privacy than standard Ethereum transfers, without requiring a centralized, trusted operator.

Tornado Cash gained significant adoption among privacy-focused users, traders who wanted to hide strategy-related flows, and in some cases individuals and entities trying to obscure the origin of funds obtained through theft or hacks. This mixed user base, together with the protocol’s non-custodial design, became central to later legal and regulatory debates.

How Does Tornado Cash Work on Ethereum?

Core design: non-custodial mixer with fixed denominations

At a high level, Tornado Cash works by pooling deposits of the same fixed size (for example, 0.1 ETH, 1 ETH, 10 ETH, or 100 ETH) into smart-contract-based mixers. When a user deposits into one of these pools, they generate a secret note that represents their claim on the funds. Later, they can withdraw the same amount to a different address by proving, in zero-knowledge, that they own a valid, unspent deposit in the pool without revealing which one.

This design differs from traditional custodial mixers, where a centralized service takes custody of user funds, shuffles them internally, and then returns different coins. In Tornado Cash, the smart contracts hold the pooled funds, while users maintain cryptographic control through their secret notes and zero-knowledge proofs. There is no centralized party with unilateral access to the funds, which is why the protocol is often described as non-custodial.

Step 1: Deposit and commitment generation

When a user decides to use Tornado Cash, they typically follow this process for making a deposit:

• Select a supported asset and denomination, such as 1 ETH or a specific amount of a stablecoin like DAI.
• Generate a random secret and create a cryptographic commitment from this secret, often by hashing the secret along with other values.
• Send a transaction to the Tornado Cash smart contract, including the chosen denomination and the commitment, along with the actual funds.

The smart contract records the commitment as a new leaf in a Merkle tree, which is a data structure that allows efficient verification that a given commitment is part of the set of all deposits. The user receives or stores a “note” that encodes the secret and necessary information, sometimes represented as a long string. This note will later be used to generate a withdrawal proof.

Step 2: Mixing phase and anonymity set growth

After depositing, the user typically waits while other deposits enter the same pool. From a privacy perspective, the goal is to have many deposits of the same denomination so that any withdrawal could plausibly correspond to any one of those deposits. This group of possible senders is known as the anonymity set.

The longer the user waits and the more activity the pool sees, the larger the anonymity set can become. However, waiting too long or using unusual timing patterns can also create distinctive behavior that may be easier for chain-analytics tools to flag. In practice, users often choose withdrawal timing and patterns informed by community guides or personal risk assessments, trying to balance convenience with privacy.

Step 3: Withdrawal using zero-knowledge proofs

To withdraw funds from Tornado Cash, the user must prove to the smart contract that they know a secret corresponding to one of the commitments in the Merkle tree and that this commitment has not yet been used to withdraw.

The withdrawal process usually involves:

• Reconstructing or accessing the Merkle tree of deposits for the relevant pool.
• Using the stored note (secret) to generate a zero-knowledge proof that shows:
  • The user knows a secret that matches one of the recorded commitments.
  • The corresponding commitment has not been spent before (preventing double-spending).
• Submitting the proof to the Tornado Cash contract, along with the recipient address and a nullifier (a derived value used to mark the deposit as spent).

If the proof verifies, the contract sends the fixed denomination of funds from the pool to the specified withdrawal address. The key point is that, on-chain, observers can see that funds left the mixer, but they cannot easily tell which earlier deposit belongs to that withdrawal if the anonymity set is sufficiently large and the user did not leak extra information.

Withdrawal phase, zero-knowledge proofs, and relayers

To withdraw, the user reconstructs the Merkle tree from contract events, then generates a zero-knowledge proof that shows knowledge of a valid commitment in the tree without revealing which one. The proof includes a nullifier hash that the contract checks against a list of previously used nullifiers, which prevents double spending of the same deposit. Once the smart contract verifies the proof and confirms the nullifier is new, it sends the fixed denomination from the pool to the specified recipient address.

Many users rely on external relayers that submit the withdrawal transaction, pay gas fees, and receive a small fee from the withdrawn amount, which avoids linking the withdrawal address to the original funding wallet through fee payments. This structure keeps control with the user's secret note while using relayers only for transaction broadcasting, preserving the non-custodial design.

Typical user flow in three practical steps

In practice, Tornado Cash activity follows three main stages described by technical documentation and research: deposit, mixing, and withdrawal. During the deposit stage, a user selects a supported denomination, generates a secret note, and sends funds plus the commitment to the relevant pool. During the mixing stage, deposits accumulate in the pool, and time passes while the anonymity set grows, often improving privacy compared with immediate withdrawal. During the withdrawal stage, the user or a relayer submits a zero-knowledge proof and nullifier hash, and the contract transfers the same fixed amount to a fresh address that no longer has an obvious on-chain link to the original depositor.

_{Table 1: Tornado Cash Deposit Options and Typical Usage Patterns}

How Do Zero-Knowledge Proofs and Anonymity Sets Provide Privacy in Tornado Cash?

Zero-knowledge proofs in simple terms

Zero-knowledge proofs are cryptographic methods that let one party prove a statement is true without revealing the underlying secret information. In Tornado Cash, the statement is that the user previously deposited a fixed amount into the mixer's pool. The proof convinces the smart contract that the withdrawal corresponds to a valid, unused deposit, while hiding which exact deposit entry the user controls. This property helps separate the on-chain withdrawal transaction from any specific earlier deposit address at the protocol level.

zk-SNARKs and how Tornado Cash uses them

Tornado Cash relies on zk-SNARKs, a type of zero-knowledge proof that is succinct and non-interactive, meaning the proof is short and can be verified with a single on-chain check. The protocol's circuits encode the rules that deposits must follow, including fixed denominations and valid Merkle tree membership for each commitment. When a user withdraws, the zk-SNARK proves that the user knows a secret corresponding to one commitment in the tree and that this commitment has not been spent, all without revealing which leaf it is. This design allows Ethereum nodes and contracts to verify proofs efficiently while keeping deposit identities hidden within the pool.

Anonymity sets and why size matters

Researchers describe the anonymity set in a mixer as the group of all deposits of the same denomination from which a withdrawal could have come. In Tornado Cash, each pool's anonymity set consists of all unspent commitments of that fixed size, so a withdrawal statistically blends into this group. A larger anonymity set usually improves privacy because tracing tools find it harder to link any specific deposit and withdrawal pair with high confidence. Academic studies of zero-knowledge mixers show that practical factors such as user timing patterns and address reuse can still shrink the effective anonymity that users actually achieve.

Merkle trees, commitments, and practical limits of privacy

Tornado Cash stores deposits as commitments in a Merkle tree, which allows efficient proof that a given commitment is part of the set of all deposits. The tree’s root summarizes the entire set, so a user’s zero-knowledge proof only needs to show membership relative to this root, instead of revealing which specific commitment they own. This structure is powerful, but it does not prevent all de-anonymization risks.

In practice, privacy can be weakened by factors such as:

• Depositing and withdrawing the same amount at unique or unusual times, making transactions stand out.
• Reusing addresses, or sending withdrawn funds directly to an exchange or service that has Know Your Customer (KYC) data.
• Using rare denominations or pools with very low activity, which results in a small anonymity set.

As a result, experts often emphasize that tools like Tornado Cash provide probabilistic privacy, not guaranteed anonymity. Users must understand both the cryptographic guarantees and the behavioral patterns that analytics systems monitor when assessing their privacy risks.

Tornado Cash Governance, Decentralization, and Front-End Services

Tornado Cash smart contracts and decentralization claims

From its early versions, Tornado Cash developers emphasized that the protocol’s smart contracts were deployed in a way that removed upgrade control from any single party. Once the contracts were finalized and verified on Ethereum, no central operator could change their code or freeze user funds. This immutability was a key part of the project’s decentralization claims.

The core idea was that, even if websites or interfaces went offline, anyone could still interact directly with the contracts via Ethereum transactions or alternative user interfaces. In theory, this separation between the front-end interfaces and the on-chain contracts meant that Tornado Cash functioned more like a public utility than a traditional company-run service.

Tornado Cash DAO and the TORN governance token

Tornado Cash launched a governance token, TORN, to allow community members to participate in decisions related to protocol parameters, development funding, and other ecosystem initiatives. The TORN token was distributed among community members, early users, and project contributors, and it could be used in a decentralized autonomous organization (DAO) to vote on proposals.

Holders of TORN could create and vote on governance proposals, including adjustments to mining rewards, relayer incentives, and other ecosystem components. This DAO structure supported the narrative that Tornado Cash was a community-governed protocol rather than a centrally controlled business, although regulators and courts later examined how much decentralization actually existed in practice.

Front-end websites, relayer networks, and supporting infrastructure

Despite the on-chain contracts being permissionless, most users interacted with Tornado Cash through front-end websites that provided a more accessible interface. These sites allowed users to generate notes, select pools, connect wallets, and submit transactions without manually crafting low-level Ethereum transactions. Some of these interfaces and infrastructure components were run by identifiable developers or organizations.

In addition to front-ends, the protocol depended on relayer networks that helped users withdraw funds without linking their new addresses to their original ones through gas-fee payments. Relayers would submit withdrawal transactions on behalf of users, collecting a small fee for their service. These relayers, along with web hosts and infrastructure providers, became potential regulatory touchpoints once sanctions and enforcement actions began.

Legitimate Uses of Tornado Cash and Other Mixers

Financial privacy for individuals

Supporters of Tornado Cash often emphasize that financial privacy is a legitimate concern for ordinary users, especially on transparent blockchains where anyone can inspect transaction histories. Without privacy tools, paying someone from a personal address can reveal the payer’s entire balance and previous activity.

Some examples of legitimate use cases for mixers like Tornado Cash include:

• Individuals who receive salaries or freelance payments in crypto and want to avoid exposing their full income and holdings to every counterparty.
• People living under oppressive regimes who fear that public transaction histories could be used to target them for political or social reasons.
• Users who simply prefer not to broadcast their spending habits, charitable donations, or investment strategies to the entire world.

In these scenarios, a mixer can function similarly to how traditional banking systems provide some level of confidentiality compared with visible-on-chain transfers.

Protecting on-chain trading and DeFi strategies

Traders and DeFi users sometimes use mixers to reduce the risk that other market participants will track and copy their strategies. For example, a large trader who regularly moves funds between exchanges, lending protocols, and liquidity pools might not want competitors or front-runners to easily see their every move.

Routing funds through a mixer can make it harder to link a trader’s various wallets and activities. While this can improve competitive privacy, it must still be balanced against compliance obligations for entities operating in regulated environments, such as funds, custodians, or exchanges that are subject to anti-money laundering (AML) rules.

Donations, activism, and dissident protection

Another area where privacy tools come into play is donations and activism. Public donations to sensitive causes can expose donors and recipients to retaliation, harassment, or surveillance. Using a mixer can help obscure the link between donor addresses and recipient wallets, potentially offering greater safety.

Some Tornado Cash supporters have argued that blanket sanctions or restrictions on the protocol could chill legitimate political expression and charitable giving. They point to past examples where activists, journalists, or dissidents relied on privacy tools to receive support without revealing identities or funding sources to hostile actors. However, regulators have often focused more on large-scale illicit use than on these edge cases in their public statements.

Illicit Use, Hacks, and Money Laundering Allegations

High-profile hacks linked to Tornado Cash

Blockchain analytics firms and law enforcement agencies have repeatedly reported that Tornado Cash was used to launder proceeds from major DeFi hacks and other crypto thefts. One of the most cited examples is the March 2022 Ronin Network hack, which resulted in the theft of over $600 million in crypto assets primarily linked to the Axie Infinity ecosystem.

According to public reports, a significant portion of the stolen funds was routed through Tornado Cash in an attempt to obscure their origin before being moved to other wallets or services. Other hacks, including attacks on protocols like Horizon Bridge and Nomad Bridge, were also alleged to have used Tornado Cash as part of their laundering process. These high-profile incidents brought the protocol under increasing scrutiny from regulators and policymakers.

Lazarus Group and state-linked cybercrime allegations

U.S. authorities, including the Treasury Department, have stated that North Korea–linked hacking group Lazarus Group used Tornado Cash to launder large sums of stolen crypto assets. The group has been tied to multiple cyberattacks on exchanges, DeFi protocols, and other crypto infrastructure, with alleged proceeds helping to fund North Korea’s weapons programs.

These allegations played a central role in the decision to sanction Tornado Cash, as officials argued that the protocol had become a key piece of infrastructure for state-sponsored cybercrime. Critics of this view countered that many neutral tools, including public internet services and traditional financial channels, are used by both legitimate users and criminals, and that punishing the infrastructure itself sets a risky precedent.

Volume estimates and law enforcement concerns

Various analytics reports have attempted to estimate how much illicit volume flowed through Tornado Cash relative to legitimate use. Some studies have claimed that a substantial share of deposits could be linked to hacks, scams, or sanctioned entities, while others emphasize that many users appear to have no obvious ties to criminal activity.

Law enforcement agencies argue that mixers complicate investigations by obscuring funds that could otherwise be traced more easily on public ledgers. They contend that this obstruction justifies treating some mixers as money laundering tools, especially when they appear to be widely used by known threat actors. Privacy advocates respond that strong privacy can coexist with targeted enforcement, and that tools themselves should not be equated with criminal intent.

U.S. Sanctions Against Tornado Cash: OFAC Actions and Legal Fallout

OFAC designation of Tornado Cash

In August 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) added Tornado Cash to its Specially Designated Nationals (SDN) list. This designation effectively prohibited U.S. persons and many companies with U.S. exposure from interacting with Tornado Cash’s sanctioned addresses, including certain smart contracts associated with the protocol.

The sanctions announcement stated that Tornado Cash had been used to launder billions of dollars’ worth of virtual currency since its creation, including funds associated with the Lazarus Group and other cybercriminal activity. By targeting the protocol itself rather than specific individuals or entities, OFAC took an unprecedented step that raised questions about how far sanctions powers extend in the context of decentralized software.

Immediate impacts on users, developers, and infrastructure

Following the sanctions, major infrastructure providers and platforms took swift action. Some front-end websites for Tornado Cash went offline or restricted access, and node or API providers blocked calls to sanctioned addresses for users in certain jurisdictions. Centralized exchanges began to monitor and sometimes freeze funds that appeared to be linked to Tornado Cash activity, even when they came from so-called “dusting” attacks where small amounts were sent to wallets without their owners’ consent.

Developers associated with the project faced increased legal and personal risk. In at least one case, a developer was arrested in Europe on allegations related to money laundering and facilitating criminal use of the protocol. These events sparked broader debates about the liability of open-source developers who write code that others may use for illicit purposes.

Legal challenges and constitutional debates

The OFAC designation of Tornado Cash triggered multiple legal challenges from industry groups, advocacy organizations, and affected individuals. Plaintiffs argued that sanctioning an open-source protocol and its immutable smart contracts exceeded OFAC’s statutory authority and violated constitutional rights, including free speech and due process protections.

Courts have so far delivered mixed responses. Some rulings have upheld OFAC’s actions, reasoning that Tornado Cash operates as an association or service that can be sanctioned, while other legal analyses remain skeptical of this framing. The final legal and regulatory treatment of open-source privacy protocols is still evolving, and outcomes in Tornado Cash–related cases may set important precedents for the broader crypto space.

Risks, Compliance Considerations, and Exchange Policies

Regulatory and legal risks for users

Using Tornado Cash or similar mixers can carry significant legal risk, especially for users subject to U.S. or allied jurisdictions that enforce sanctions and strict AML rules. Interacting with sanctioned addresses, even inadvertently, can expose individuals and companies to potential penalties, investigations, or loss of access to financial services.

In some cases, receiving funds that have passed through a sanctioned mixer has led to frozen accounts or additional compliance checks at exchanges and custodians. While not all jurisdictions treat mixers identically, there is a clear trend toward closer monitoring of privacy tools and greater expectations that regulated entities screen for mixer-associated activity.

Exchange and service-provider responses

Many centralized exchanges and service providers have implemented enhanced monitoring around Tornado Cash and similar protocols. This can include:

• Flagging deposits that originate from known mixer contracts.
• Requiring additional verification or explanations from customers whose funds show links to mixers.
• Blocking or reversing transactions when regulations or internal policies demand it.

These practices aim to reduce exposure to illicit funds and regulatory sanctions but can also affect legitimate users who value privacy. Some providers have publicly shared their approach to handling mixer-related deposits, while others implement policies internally without detailed public disclosures.

Compliance frameworks and risk-based approaches

Compliance experts often encourage a risk-based approach to privacy tools in crypto, recognizing that not all mixer use is inherently illicit. Instead of imposing categorical bans, some frameworks propose differentiated treatment based on factors like transaction size, user profile, and broader behavioral patterns.

However, for protocols that have been explicitly sanctioned, such as Tornado Cash in the U.S., many regulated entities feel obligated to treat any direct interaction as prohibited. This tension between nuanced risk assessment and bright-line rules is an active area of discussion among compliance professionals, policymakers, and civil liberties advocates.

Alternatives to Tornado Cash and the Future of On-Chain Privacy

Other mixers and privacy protocols

Even before Tornado Cash, there were other mixing services and privacy protocols across different blockchains. On Bitcoin, for example, CoinJoin-based tools and other collaborative transaction schemes aim to break deterministic links between inputs and outputs. On Ethereum and other smart contract platforms, projects have experimented with shielded pools, stealth addresses, and privacy-preserving rollups.

After the sanctions on Tornado Cash, some developers and users shifted focus to other privacy solutions that might be less exposed to enforcement actions or that incorporate compliance features such as selective disclosure. Nonetheless, any protocol that meaningfully enhances transaction privacy can attract regulatory scrutiny, particularly if it gains significant adoption.

Layer-2 solutions, rollups, and application-specific privacy

As Ethereum scales through layer-2 networks and rollups, new privacy designs are emerging. Some rollups aim to offer default privacy for all transactions within their environment, while still allowing certain forms of auditing or compliance when needed. Others plan to integrate zero-knowledge proofs at the protocol level, enabling private transfers, trades, or identity attestations.

These developments suggest that privacy may become more fragmented across different layers and applications, rather than being concentrated in a single mixer protocol. Users may interact with dApps that provide built-in privacy features, bridging assets into and out of private environments without necessarily using standalone mixers like Tornado Cash.

Regulatory trends and potential compromise models

Future regulatory approaches to on-chain privacy may involve more nuanced distinctions between tools that enable targeted, controllable privacy and those that provide broad, hard-to-monitor anonymity. Policymakers are exploring ideas such as zero-knowledge proofs for compliance, where users can prove they meet certain requirements (for example, KYC checks or sanctions screening) without revealing their full identity or transaction history.

At the same time, there is an ongoing debate about whether such compromise models truly protect user privacy or primarily serve institutional interests. The Tornado Cash case is often cited by privacy advocates as evidence that aggressive enforcement against privacy tools can overreach, while regulators see it as a necessary step to combat sophisticated money laundering schemes. How these tensions are resolved will shape the long-term future of privacy in public blockchain ecosystems.

FAQ

References / Sources