Tornado Cash
A non-custodial mixer on Ethereum and six other chains whose fixed-amount pools use zero-knowledge proofs to break the on-chain link between a deposit and a withdrawal.
LiveMixer
The immutable Ethereum pools were still processing withdrawals on 16 October 2026 and can be reached through the community interface at tornadocash.eth.limo, while the original tornado.cash domain, reportedly used for a phishing copy of the interface in 2026, no longer resolves.
- TVL
- $681.3MDefiLlama, 18 Oct 2026
- Launched
- 2 Aug 2019
- Token
- TORN
- Chains
- Ethereum, BNB Chain, Polygon, Gnosis Chain, Avalanche, Optimism and Arbitrum
How it works
Tornado Cash is a non-custodial mixer: a set of smart contracts, first live on Ethereum in August 2019, that accepts a deposit from one address and lets the depositor withdraw it later to a different address. Each pool takes a single fixed amount, for example 0.1, 1, 10 or 100 ETH, so every deposit in a pool looks the same. On Ethereum there are pools for ETH, DAI, cDAI, USDC, USDT and WBTC, and from June 2021 the contracts were also deployed on other chains: BNB Chain, Polygon, Gnosis Chain and Avalanche for their native coins, and Optimism and Arbitrum for ETH. A separate pool, Tornado Cash Nova, launched in beta on Gnosis Chain in December 2021: it accepts any amount of ETH, ties funds to a registered wallet rather than a note, and allows transfers inside the pool.
When a user deposits, the interface creates a secret note and sends the pool a commitment, a hash of that secret, which is added to a Merkle tree of all the pool's deposits. To withdraw, the user submits a zero-knowledge proof (a zk-SNARK) showing that they know the secret behind one of the commitments in the tree, without revealing which one, together with a nullifier hash that stops the same note being spent twice. The contract then pays the fixed amount to whichever address the user names. A fresh address holds no ETH for network fees, so withdrawals can be sent through a relayer, a third party that pays the fee and deducts it, plus its own charge, from the amount withdrawn; because the proof fixes the recipient and the fee, a relayer cannot redirect the funds. Since a trusted setup ceremony in May 2020 the pool contracts have had no operator, so nobody, including the original developers, can change or stop them.
The pools hide only the link between a deposit and a withdrawal. Anyone can still see which address deposited, into which pool and when, and which address received a withdrawal and when. Privacy therefore depends on how many other deposits share the pool and on how the user behaves: withdrawing soon after depositing, or moving the same unusual set of amounts in and out, such as seven 10 ETH deposits from one address followed by seven 10 ETH withdrawals to another single address, can let an observer match the two sides. The project's guidance advises waiting, spreading withdrawals across several addresses and using Tor or a VPN, because an internet provider can otherwise see that a user is connecting to Tornado Cash, and it warns that browser extensions can link transactions made with the same cookies.
The note works like a bearer key: whoever holds it can withdraw the funds and also learn which address made the deposit, and losing it means losing the funds. The same note can be used with a compliance tool to produce a report linking a user's own deposit and withdrawal, for anyone who needs to show where their funds came from. The community interface is stored on IPFS and linked from the ENS name tornadocash.eth, which TORN holders control through governance, and the pools can also be used through self-hosted copies of the interface or a command-line client.
TVL over time
- $681.3M TVL now
- -5.8% in 30 days
- $1.23B highest daily TVL, 10 Nov 2025
Daily total value locked (TVL) from DefiLlama since 17 Dec 2019, with the current value refreshed every hour. The latest value is from 18 Oct 2026, 04:12 UTC. Removed from the US sanctions list on 21 Mar 2025. Most of its TVL is ETH, so its USD value moves with the ETH price. The series is in protocol-tornado-cash.json, listed on the Data page.
What it hides and what it does not
What it hides
- Which deposit a withdrawal comes from: the proof shows that the withdrawer knows the secret behind one of the pool's deposits, not which one.
What it does not hide
- Which address deposited, into which fixed-amount pool, and when.
- Which address received a withdrawal, and when.
- Patterns of timing and amounts, such as a withdrawal soon after a deposit, or several deposits from one address followed by the same number of withdrawals to another, which can let an observer match the two sides.
- That a user is connecting to Tornado Cash, to their internet provider, unless they use Tor or a VPN.
- The deposit behind a note, to anyone who holds that note, who can also withdraw the funds.
Drawn from how it works, above; the sources are listed at the end of the page. Where privacy still leaks explains the patterns, such as timing and amounts, that can give users of any design away.
Audits
Five security reviews, oldest first, with what each covered and found. Dates are when each report was issued, unless the entry says otherwise.
| Date | Firm | Scope and findings |
|---|---|---|
| ABDK Consulting | Tornado Cash smart contracts (final version); no critical issues were found, other significant issues were fixed and some minor issues were left for later releases or ignored. |
|
| ABDK Consulting | The circom zero-knowledge circuits (final version); no major issues were found, and a few minor issues were reported, many of them fixed. |
|
| ABDK Consulting | Review of the mixer protocol design and its implementation (version 1.1); its recommendations included using one hash function rather than two, and a stronger curve than BN254, which it put at about 100 bits of security. Sources: Tornado Privacy Solution Cryptographic Review, version 1.1 ; Tornado Cash Privacy Solution (tornado-core README) |
|
| ABDK Consulting | First audit of the anonymity mining ('Tornado Farm') smart contracts and circuits, reviewed from private files; it reported one critical issue in the reward circuit, which it recommended fixing, along with moderate flaws and suboptimal code. |
|
| ZeroPool | Tornado Cash Nova (Tornado Pool) zkSNARK circuits and Solidity contracts, including a version with Optimism (OVM) support, reviewed by an independent reviewer from ZeroPool; it found no critical or major issues and listed seven warnings and two comments. Sources: Tornado pool audit ; Tornado Pool (Tornado Cash Nova) README |
Incidents
12 incidents, oldest first: flaws, exploits, sanctions, prosecutions and other events that affected the project or its users.
-
A security researcher found a flaw in the circomlib MiMC hash circuit used by the pools that would have let anyone forge a proof of deposit and withdraw funds; to protect users, the team used the flaw itself to drain the mixer before anyone else could, then patched the circuits and moved users' funds to new contracts, as described in its post 'Tornado.cash got hacked. By us.'
Sources: It pays to be Circomspect ; Wayback Machine capture index for Tornado Cash's Medium blog (the post 'Tornado.cash got hacked. By us.' was captured on 2019-11-17)
-
Sanction
OFAC added Tornado Cash and associated wallet addresses to the US sanctions list, saying it had been used to launder more than USD 7 billion since its creation in 2019, including over USD 455 million stolen by North Korea's Lazarus Group.
Source: U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash
-
Prosecution
Dutch FIOD investigators arrested Tornado Cash developer Alexey Pertsev in Amsterdam on suspicion of facilitating money laundering through the mixer.
Sources: Arrest of suspected developer of Tornado Cash ; Treasury Designates Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer Tornado Cash ; ECLI:NL:RBOBR:2024:2069, Rechtbank Oost-Brabant, vonnis van 14 mei 2024 (Tornado Cash) ; Tornado Cash developer Alexey Pertsev gets nod for conditional release from prison to work on appeal
-
Sanction
OFAC delisted and at the same time redesignated Tornado Cash under two executive orders, adding North Korea-related grounds after the Lazarus Group used its smart contracts to obscure funds from a March 2022 heist.
-
Governance attack
An attacker passed governance proposal 20, which contained hidden code, used it to grant themselves 1.2 million votes and control of the DAO, and took about 483,000 TORN from the governance vault, selling most of it; the immutable pools could not be drained. On 26 May 2023 TORN holders passed the attacker's own proposal 21 handing control back, with about 517,000 votes in favour and none against.
Sources: Attacker uses malicious proposal to take over Tornado Cash governance ; Tornado Cash DAO passes attacker's proposal to hand back control ; Tornado Cash (privacy project page) ; Tornado Cash governance contract 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce: proposals() and state() read for proposals 18 to 72
-
Prosecution
US prosecutors in New York unsealed an indictment charging co-founders Roman Storm and Roman Semenov with conspiring to commit money laundering, to operate an unlicensed money transmitting business and to violate sanctions; Storm was arrested in Washington State and OFAC designated Semenov the same day.
Sources: Treasury Designates Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer Tornado Cash ; United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries, earliest first (indictment unsealed and arrest on 23 August 2023)
-
Exploit
An interface version pinned through governance contained hidden JavaScript that sent users' deposit notes to an outside server, exposing deposits made through public IPFS gateways from early January 2024; the leak was disclosed in late February 2024 and a governance proposal executed in March 2024 replaced that version.
Sources: Malicious code in Tornado Cash governance proposal puts user funds at risk ; Tornado Cash (privacy project page) ; Tornado Cash governance contract 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce: proposals() and state() read for proposals 18 to 72
-
Prosecution
The Rechtbank Oost-Brabant in 's-Hertogenbosch convicted developer Alexey Pertsev of money laundering and sentenced him to 64 months in prison, finding that ETH stolen in hacks and worth about USD 1.2 billion, a lower bound, had passed through the pools. He was released under electronic monitoring in February 2025 pending his appeal, and no appeal ruling had been published by 16 October 2026.
Sources: ECLI:NL:RBOBR:2024:2069, Rechtbank Oost-Brabant, vonnis van 14 mei 2024 (Tornado Cash) ; Tornado Cash developer Alexey Pertsev gets nod for conditional release from prison to work on appeal ; Rechtspraak Open Data: published criminal rulings of the Gerechtshof 's-Hertogenbosch dated 1 January 2025 to 16 October 2026, results 1 to 1,000 of 1,053 (no Tornado Cash ruling found) ; Rechtspraak Open Data: published criminal rulings of the Gerechtshof 's-Hertogenbosch dated 1 January 2025 to 16 October 2026, results 1,001 to 1,053 (no Tornado Cash ruling found)
-
Prosecution
After a four-week trial in New York, a jury convicted Roman Storm of conspiring to operate an unlicensed money transmitting business but could not reach a verdict on the money laundering and sanctions conspiracy charges, on which the court declared a mistrial.
Sources: Founder of Tornado Cash crypto mixing service convicted of knowingly transmitting criminal proceeds ; United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries for 1 to 12 August 2025 (partial verdict; jury verdict, Dkt. 224) ; Order denying Mr. Storm's motion to dismiss Counts One and Three, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 303
-
Governance attack
Proposal 67, whose contract code had not been verified and which L2BEAT flagged as malicious, was rejected by TORN holders, with about 623,000 votes against and none in favour when voting closed on 30 June 2026.
Sources: Tornado Cash (privacy project page) ; Tornado Cash governance contract 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce: proposals() and state() read for proposals 18 to 72
-
The project's original tornado.cash domain, which had lapsed, was reportedly registered by others and used for a copy of the interface built to capture deposit notes; one user reportedly lost about 1,010 ETH, a figure from community reports that had not been independently confirmed. TORN holders then added a phishing warning to the community interface and in October 2026 voted to pay 1,000 TORN to two people for having the fraudulent site taken down.
Sources: Tornado Cash phishing attack exploits expired domain for ETH theft ; Tornado Cash (privacy project page) ; Tornado Cash governance contract 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce: proposals() and state() read for proposals 18 to 72 ; DNS lookup for tornado.cash (status 3, NXDOMAIN: the name does not exist)
-
Prosecution
The court adjourned Storm's retrial on the two undecided charges to 26 April 2027, citing his pending motion for acquittal, argued on 9 April 2026, and on 10 September 2026 it denied his request to dismiss those charges under the Speedy Trial Act. The motion for acquittal was still undecided in October 2026, when both sides were still filing letters on it, and he had not been sentenced.
Sources: Order adjourning the retrial to 26 April 2027, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 300 ; Order denying Mr. Storm's motion to dismiss Counts One and Three, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 303 ; Letter for Roman Storm responding to the government's supplemental authority on venue in his pending Rule 29 motion, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 306 ; United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries, latest first ; Roman Storm's Tornado Cash Retrial Pushed to April 2027
Milestones
Eight milestones, oldest first.
-
Tornado Cash began operating on Ethereum, and was introduced that month in a blog post announcing private transactions on Ethereum, according to the Dutch court's findings.
Sources: ECLI:NL:RBOBR:2024:2069, Rechtbank Oost-Brabant, vonnis van 14 mei 2024 (Tornado Cash) ; Van Loon v. Department of the Treasury, No. 23-50669, opinion ; Wayback Machine capture index for Tornado Cash's Medium blog (the post 'Introducing private transactions on Ethereum now!' was captured on 2019-08-24)
-
A trusted setup ceremony with 1,114 contributions produced the proving keys, the pools' operator address was set to zero so the pool contracts became immutable, and the interface moved to IPFS hosting.
Sources: Introduction to Tornado Cash (documentation) ; ECLI:NL:RBOBR:2024:2069, Rechtbank Oost-Brabant, vonnis van 14 mei 2024 (Tornado Cash) ; Van Loon v. Department of the Treasury, No. 23-50669, opinion ; Tornado Cash (privacy project page)
-
Early users of the ETH pools could redeem an airdrop of the new TORN governance token from this date, with 10% of the supply set aside for a year of anonymity mining and 55% for the treasury of a DAO that governs the protocol's peripheral contracts.
Sources: TORN (documentation) ; Governance (documentation)
-
Tornado Cash contracts began to be deployed beyond Ethereum, on chains that came to include BNB Chain, Polygon, Gnosis Chain, Avalanche, Optimism and Arbitrum.
-
Tornado Cash Nova launched in beta on Gnosis Chain as a governance-upgradeable pool that accepts any amount of ETH, with deposits initially capped at 1 ETH, and allows shielded transfers inside the pool.
Sources: Introduction to Tornado Cash (documentation) ; Tornado Pool (Tornado Cash Nova) README
-
The Tornado Cash interface began blocking addresses on the US sanctions list using a Chainalysis oracle contract, a change that applied only to the interface and not to the immutable contracts.
Sources: Ethereum mixer Tornado Cash blocks sanctioned addresses from its frontend ; Treasury Designates Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer Tornado Cash
-
The US Court of Appeals for the Fifth Circuit held in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts are not the property of a foreign national or entity and so cannot be blocked under IEEPA.
Source: Van Loon v. Department of the Treasury, No. 23-50669, opinion
-
The US Treasury removed Tornado Cash from the sanctions list, citing its review of the novel legal and policy issues raised by sanctioning it, while saying it would keep monitoring transactions that may benefit North Korea or malicious cyber actors.
Source: Tornado Cash Delisting
Funding
Three sources of funding, oldest first. Amounts are in US dollars; a dash means the sources give no US dollar figure.
| Date | Round | Amount | Investors |
|---|---|---|---|
| Not dated | Gitcoin Grants crowdfunding (about 5,500 DAI raised by 1 April 2020, the date of an archived grant page shown at trial; the archived records were incomplete and the donation dates are not given) |
$5,500 | Gitcoin Grants contributors |
SAFE with a token warrant Sources: Court exhibits (trial transcripts), United States v. Storm, No. 23-cr-430 (KPF), Dkt. 225, testimony on PepperSec and its funding (transcript pages 1208, 2036 to 2046 and 2100) ; Dragonfly exec says US government is considering charges against the venture firm for its early support of Tornado Cash |
$900,000 | Dragonfly | |
| Not dated | Convertible note |
$50,000 | The LAO |
Risks
Privacy depends on how busy each pool is and on user discipline. On Ethereum the ETH pools are large: on 16 October 2026 the 0.1, 1, 10 and 100 ETH pools held about 624, 4,267, 22,570 and 226,100 ETH, and L2BEAT counted about 9,700 Ethereum deposits in the previous 30 days. The other deployments are far smaller: DefiLlama puts BNB Chain at about USD 57 million, Arbitrum at about USD 550,000 and Polygon, Optimism, Avalanche and Gnosis Chain at under USD 60,000 each, so deposits there have few others to hide among. Timing, amounts and address reuse can link a deposit to its withdrawal without any break in the cryptography, and a lost or exposed note means lost funds or lost privacy. The core pools cannot be changed, but TORN governance controls peripheral contracts such as the pool and relayer registries, the upgradeable Nova pool and the interface pinned to tornadocash.eth: a malicious proposal took over governance in May 2023, an interface version pinned through governance leaked deposit notes in early 2024 and a proposal flagged as malicious was voted down in June 2026, so users who load the interface from a public gateway trust that process. Copies of the interface on other sites are a further risk: the lapsed tornado.cash domain was reportedly used for one in 2026. The proofs rest on the 2020 trusted setup and on the BN254 curve, which ABDK's 2019 review put at about 100 bits of security, an attack capacity it said no one then had. Legal and compliance exposure remains: developers have been convicted in the Netherlands and the United States, though both cases are still being challenged; the Dutch court found in 2024 that ETH of criminal origin worth about USD 2.2 billion, almost 30% of all ETH deposited, had passed through the pools; exploit proceeds were still arriving in 2026, including about 23,000 ETH, some USD 44 million, that the attacker behind the 1 April 2026 Drift Protocol exploit, which Mandiant linked to a North Korean group, moved through the mixer in July 2026; and Treasury's delisting statement says US persons should exercise caution before transactions that may benefit North Korea or malicious cyber actors.
Sources
The documents this profile rests on. Each audit, incident, milestone and funding round above also links its own sources.
- Tornado Cash interface (tornadocash.eth)
- DNS lookup for tornado.cash (status 3, NXDOMAIN: the name does not exist)
- ENS name lookup for tornadocash.eth (manager: the Tornado Cash governance contract; registrant: a 1-of-1 Safe)
- Safe 0xb04E030140b30C27bcdfaafFFA98C57d80eDa7B4, listed in the documentation as the community fund (threshold 1; sole owner the governance contract)
- Tornado Cash governance contract 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce: proposals() and state() read for proposals 18 to 72
- tornadocash organisation repositories (all archived, last pushed in August 2022)
- Tornado Cash Privacy Solution (tornado-core README)
- Introduction to Tornado Cash (documentation)
- How does Tornado Cash work? (documentation)
- Tips to remain anonymous (documentation)
- Compliance tool (documentation)
- How to become a relayer? (documentation)
- Tornado Cash smart contracts (documentation, pool addresses)
- TORN (documentation)
- Governance (documentation)
- Tornado Pool (Tornado Cash Nova) README
- ABDK Consulting audits: tornado folder
- Tornado Cash Smart Contracts Audit, final version
- Tornado Circuit Audit, final version
- Tornado Privacy Solution Cryptographic Review, version 1.1
- Tornado Farm Smart Contracts and Circuits. Audit
- Tornado pool audit
- Wayback Machine capture index for Tornado Cash's Medium blog
- It pays to be Circomspect
- Ethereum mixer Tornado Cash blocks sanctioned addresses from its frontend
- U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash
- Arrest of suspected developer of Tornado Cash
- Treasury Designates DPRK Weapons Representatives
- Attacker uses malicious proposal to take over Tornado Cash governance
- Tornado Cash DAO passes attacker's proposal to hand back control
- Treasury Designates Roman Semenov, Co-Founder of Sanctioned Virtual Currency Mixer Tornado Cash
- Malicious code in Tornado Cash governance proposal puts user funds at risk
- ECLI:NL:RBOBR:2024:2069, Rechtbank Oost-Brabant, vonnis van 14 mei 2024 (Tornado Cash)
- Van Loon v. Department of the Treasury, No. 23-50669, opinion
- Tornado Cash developer Alexey Pertsev gets nod for conditional release from prison to work on appeal
- Tornado Cash Delisting
- Dragonfly exec says US government is considering charges against the venture firm for its early support of Tornado Cash
- Founder of Tornado Cash crypto mixing service convicted of knowingly transmitting criminal proceeds
- Court exhibits (trial transcripts), United States v. Storm, No. 23-cr-430 (KPF), Dkt. 225, testimony on PepperSec and its funding (transcript pages 1208, 2036 to 2046 and 2100)
- United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries, earliest first (indictment unsealed and arrest on 23 August 2023)
- United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries for 1 to 12 August 2025 (partial verdict; jury verdict, Dkt. 224)
- United States v. Storm, No. 23-cr-430 (S.D.N.Y.), docket entries, latest first
- Order adjourning the retrial to 26 April 2027, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 300
- Order denying Mr. Storm's motion to dismiss Counts One and Three, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 303
- Letter for Roman Storm responding to the government's supplemental authority on venue in his pending Rule 29 motion, United States v. Storm, No. 23-cr-430 (KPF), Dkt. 306
- Roman Storm's Tornado Cash Retrial Pushed to April 2027
- Rechtspraak Open Data: published criminal rulings of the Gerechtshof 's-Hertogenbosch dated 1 January 2025 to 16 October 2026, results 1 to 1,000 of 1,053 (no Tornado Cash ruling found)
- Rechtspraak Open Data: published criminal rulings of the Gerechtshof 's-Hertogenbosch dated 1 January 2025 to 16 October 2026, results 1,001 to 1,053 (no Tornado Cash ruling found)
- Tornado Cash phishing attack exploits expired domain for ETH theft
- Drift opens exploit recovery claims with initial payouts of just over 1% of user losses
- Tornado Cash Logs 968 Deposits in Busiest Day of 2026, L2Beat Says
- Tornado Cash (privacy project page)
- Tornado Cash 0.1 ETH pool on Ethereum, balance read
- Tornado Cash 1 ETH pool on Ethereum, balance read
- Tornado Cash 1 ETH pool on Ethereum, recent transactions
- Tornado Cash 10 ETH pool on Ethereum, balance read
- Tornado Cash 10 ETH pool on Ethereum, recent transactions
- Tornado Cash 100 ETH pool on Ethereum, balance read
- Tornado Cash TVL (protocol data)
