Connect with us
DAPA Banner

Crypto World

DOJ Says Tornado Cash Developer Made 250 Changes to the Protocol: Is the Immutable Code Defense Dead?

Published

on

DOJ Says Tornado Cash Developer Made 250 Changes to the Protocol: Is the Immutable Code Defense Dead?

The DOJ core legal theory in the Roman Storm crypto case has never been that writing code is a crime. It’s that exercising operational control over a platform that processes more than $1 billion in illicit funds – while explicitly declining to implement feasible anti-money-laundering controls – constitutes running a criminal business.

That distinction is the mechanism that makes this case matter far beyond Tornado Cash.

Prosecutors filed a letter Tuesday rejecting Storm’s attempt to leverage a March Supreme Court ruling in Sony Music v. Cox Communications as grounds for dismissal.

The DOJ called the analogy “inapposite” – and the reasoning behind that rejection defines exactly what level of developer involvement triggers federal criminal liability under the current enforcement framework.

Advertisement

The unresolved question: where is the legal floor for DeFi developers who upgrade protocols, manage governance, and selectively respond to compliance inquiries? After Tuesday’s filing, that floor is still undefined – and prosecutors are pushing to make Storm’s retrial the place where it gets drawn.

Key Takeaways:
  • The Dismissal Attempt: Storm’s attorneys cited the Supreme Court’s Cox ruling – which shielded the ISP from liability for users’ copyright infringement – as precedent for dismissing criminal charges. DOJ prosecutors rejected the parallel as inapplicable to Storm’s conduct.
  • The Control Argument: Prosecutors documented over 250 changes made to the Tornado Cash infrastructure during the charged period, directly contradicting Storm’s defense that the protocol was immutable code beyond his control. That operational record is central to the money laundering conspiracy charge.
  • The Partial Conviction: A jury in August 2025 convicted Storm on conspiracy to operate an unlicensed money-transmitting business but deadlocked on money laundering conspiracy and sanctions evasion – the two charges prosecutors now want retried in October 2026.
  • The Privacy Protocols Precedent: DOJ’s framing – that developers who implement changes and knowingly forgo compliance measures are operators, not bystanders – applies directly to any upgradeable DeFi protocol with identified founders or core teams.
  • The Exposure: Storm faces up to 40–45 years in prison if convicted on all counts. The retrial scope covers the two deadlocked charges; the money transmitting conviction stands.
  • What to Watch: The conference between Storm’s defense and Judge Katherine Polk Failla’s court will determine whether October 2026 becomes a firm retrial date – the specific scheduling order is the next legal trigger that confirms or compresses the timeline.

Explore: The best pre-launch token sales with asymmetric upside potential

What the DOJ’s Cox Rejection Actually Establishes – and Why the ‘Immutable Code’ Defense Is Running Out of Road

Storm’s legal team drew a specific parallel: the Supreme Court found Cox Communications shouldn’t be held liable for its users’ infringing activity because Cox had a robust, 98%-effective termination policy for repeat infringers.

Advertisement

The argument was that Storm, like Cox, was a neutral infrastructure provider. Prosecutors dismantled that comparison in a single filing.

The DOJ’s letter to Judge Failla emphasized that Cox actively discouraged the illegal conduct occurring on its network – while Storm and his co-conspirators at Tornado Cash did the opposite.

Source: DOJ

Prosecutors stated that Storm “actively lied in response to inquiries from victims, telling them he had little control over the protocol when in fact he and his co-conspirators implemented over 250 changes to Tornado Cash infrastructure during the charged time period and explicitly discussed – but forwent – feasible measures to curb criminality on their platform.”

That last clause is the legal weight-bearing element. Under the money laundering and unlicensed money transmission statutes at issue, the question isn’t whether a developer wrote code – it’s whether they operated a system they knew was being used for money laundering, had the capacity to limit that use, and chose not to.

The Bank Secrecy Act’s anti-money-laundering compliance obligations attach to operators, not passive bystanders. Prosecutors’ position is that Storm was an operator by every functional measure.

Advertisement

“In short, the defendant’s reaction to criminal use of his company was window dressing at best and outright misdirection at worst” – prosecutors’ letter to Judge Failla, filed Tuesday.

The August 2025 jury conviction on the unlicensed money transmission count already rejected Storm’s passive-developer framing once.

The October 2026 retrial targets the money laundering conspiracy and sanctions evasion charges directly – the counts where the jury deadlocked, not where it acquitted. That distinction matters: deadlock means twelve jurors couldn’t reach unanimity, not that the evidence was insufficient to convict.

Discover: The Best Crypto Presales Live Right Now

Advertisement

The post DOJ Says Tornado Cash Developer Made 250 Changes to the Protocol: Is the Immutable Code Defense Dead? appeared first on Cryptonews.

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Web3 Projects Lost $464.5M in Q1 2026 as Hacks Shift Beyond Code: Hacken

Published

on

Cryptocurrencies, Phishing, Smart Contracts, Cybercrime, Cybersecurity, Hacks

Web3 projects lost $464.5 million to hacks and scams in the first quarter of 2026, while multi-billion-dollar “mega hacks” gave way to a larger number of mid-sized incidents, according to blockchain security company Hacken.

According to Hacken’s Q1 2026 report, phishing and social engineering attacks dominated the period, accounting for $306 million in losses in a quarter that saw 43 incidents overall. A single $282 million hardware wallet scam in January was responsible for 81% of the quarter’s damage.

Smart contract exploits totaled $86.2 million, with access control failures, including compromised keys and cloud services, driving an additional $71.9 million in losses.

The losses place this quarter as the second-lowest first quarter since 2023, with the absence of a single mega hack on the scale of Bybit, which lost $1.46 billion in Q1 2025, the primary driver of the year-over-year decline.

Advertisement

Hacken’s incident mapping shows the largest failures increasingly occurring outside onchain code, in operational and infrastructure layers that traditional audits rarely touch. Yev Broshevan, chief executive and co-founder at Hacken, told Cointelegraph the most expensive failures “happen outside the code layer entirely.”

Related: Aethir halts bridge exploit, promises compensation after $90K loss

According to Hacken, that shift is drawing greater scrutiny from regulators and institutional counterparties, with frameworks such as the Markets in Crypto-Assets Regulation (MiCA) and Digital Operational Resilience Act (DORA) in the European Union moving further into enforcement and raising expectations around continuous security monitoring and incident response.

Legacy code, fake VC calls and key compromises 

Broshevan pointed to $306 million in phishing, a $40 million North Korea-linked fake venture capitalist (VC) call against Step Finance, and a $25 million AWS key management service compromise at Resolv Labs. Even where smart contracts were at fault, the costliest bugs often sat in legacy deployments and known vulnerability classes. Truebit lost $26.4 million to a bug in a Solidity contract deployed around five years ago, while Venus Protocol was hit by a donation attack pattern documented since 2022.

Advertisement
Cryptocurrencies, Phishing, Smart Contracts, Cybercrime, Cybersecurity, Hacks
Q1 2025 compared to Q1 2026. Source: Hacken.

Six audited projects, including Resolv with 18 audits and Venus with five separate firms, still accounted for $37.7 million in losses. On average, that was more than their unaudited peers because higher total value locked (TVL) protocols attract more sophisticated attackers and exploits.

Global watchdogs harden incident response expectations

In Q1, MiCA and DORA in the EU shifted further into active enforcement, Dubai’s regulator, the Virtual Assets Regulatory Authority, tightened expectations around its Technology and Information Rulebook, Singapore enforced Basel-aligned capital and one-hour incident notification rules, and the United Arab Emirates’ new Capital Market Authority took over federal digital asset oversight with broader powers and higher penalties.

Cryptocurrencies, Phishing, Smart Contracts, Cybercrime, Cybersecurity, Hacks
Total crypto losses per quarter. Source: Hacken

Related: Crypto hackers steal $169M from 34 DeFi protocols in Q1: DefiLlama

Hacken ties those regimes to a new benchmark for “regulator-ready” stacks that includes proof-of-reserves attestations backed by daily internal reconciliation, 24/7 onchain monitoring across treasury wallets and privileged roles, automated circuit-breakers on minting and governance functions and incident notification clocks calibrated to the strictest applicable standard. 

The report highlights “realistic” targets of awareness within 24 hours, labeling within four hours, and blocking in 30 seconds, with “aspirational” goals as low as 10 minutes for detection and 1 second to block, based on guidance from Global Ledger’s 2025 Laundering Race data.

At the human layer, Hacken flags North Korean clusters as the most consistent operational threat, with Step Finance’s $40 million loss and Bitrefill’s infrastructure breach extending a playbook of fake VC outreach, malicious video call tooling and compromised employee endpoints that extracted roughly $2.04 billion from the sector in 2025.

Advertisement

Magazine: XRP yet to ‘price in’ 3 bullish catalysts, Bitcoin to $80K? Trade Secrets