The development of financial privacy tools has today been deemed a crime by a Dutch court.

In the Netherlands, open source developers are now responsible for how their software is used.

Alexey Pertsev, a 31-year-old Russian national living in the Netherlands and one of the developers of Tornado Cash, an Ethereum-based privacy tool, was found guilty of money laundering in a Dutch court today. He was sentenced to 64 months in prison. The fact that Pertsev never managed the cryptocurrency flowing through Tornado Cash or even controlled how the smart contracts worked was deemed irrelevant by the judges because he contributed to the development of the software.

Like Dutch prosecutor Martine Boerlage, the court ruled that Tornado Cash was essentially run like a business run by PepperSec, a company founded and run by Pertsev and his two co-founders, Roman Storm and Roman Semenov. The judges said the three men benefited financially by obfuscating illicit funds through the tools they created rather than simply publishing code.

Specifically, the judges found Pertsev personally responsible for laundering $1 billion worth of stolen ETH, including from North Korean hackers known as the Lazarus Group. Pertsev could not have prevented this from happening after the software was released, but the fact that he helped launch the software that made it possible in the first place without including any measures to prevent it was considered sufficient reason to find him guilty .

“Tornado Cache operates in the manner in which defendant and his co-founders developed Tornado Cache,” the judge wrote. “So the surgery is entirely their responsibility.”

tornado cache

Tornado Cash is a smart contract on the Ethereum blockchain. Users can send ETH to a Tornado Cash smart contract, which allows them to withdraw the same amount of ETH from the same contract. Since there is no way to link incoming and outgoing ETH to Tornado Cash, smart contracts act as a privacy tool, allowing users to obfuscate their transaction history.

In addition to the Tornado Cash smart contract itself, PepperSec has helped develop tools that allow users to easily access smart contracts, specifically a graphical user interface (GUI). This part of the mixing infrastructure relied on a separate smart contract that facilitated the payment of withdrawal fees through special entities called “relayers” and was managed through a decentralized autonomous organization (DAO) and its associated TORN token.

According to the judges, DAO did not make a meaningful difference. In reality, PepperSec was still responsible for GUI operations and how the relay system worked.

The Tornado Cash smart contract itself currently operates, and indeed still operates, completely independently of PepperSec. Neither Pertsev nor PepperSec have actually “touched” any of the ETH going through the Tornado Cash smart contract. That is, they did not manage any funds. They simply built software that leveraged Ethereum users to mix their ETH with other users and were unable to prevent this from happening.

Until now, it was generally assumed that this would free developers from applying anti-money laundering measures, but this assumption has been abandoned today.

greater relevance

The ruling could have far-reaching implications for open source software development in general, including Bitcoin software development, at least in the Netherlands.

In Bitcoin, two of the most popular hybrid services were operated by the company: Wasabi Wallet and Samourai Wallet. PepperSec claimed that its operations were technically decentralized through a DAO, while Wasabi Wallet and Samourai Wallet operated more directly, providing centralized coordination through dedicated servers. PepperSec could be held liable for how users use Tornado Cash, so Wasabi Wallet and Samourai Wallet could logically also be held liable.

Accordingly, Keonne Rodriguez and William “TDevD” Hill, founders and developers of Samourai Wallet, were recently indicted by the U.S. Department of Justice on charges of money laundering and operating an unlicensed money transmitter. Although these arrests were made at the direction of the U.S. Department of Justice (DOJ), today’s Dutch ruling provides a glimpse into what lies ahead for the United States. Shortly after Samourai Wallet’s arrest, Wasabi Wallet announced that it would cease operating its mixing service at the end of this month.

Moreover, today’s judgment suggests that even developers who develop privacy tools without a centralized coordinator may be liable in the Netherlands if the tools are used for illegal purposes. Money laundering.

Pertsev’s PepperSec colleagues Storm and Semenov were also indicted in the US last year, with the former (who lives in the US) awaiting trial in September.

Pertsev has the option to appeal the ruling. If so, he will have to wait for an appeal from prison, as he was immediately detained after sentencing.

You can read the full verdict (in Dutch). here.