What To Expect This Week In Tornado Cash
New exhibits suggest that the prosecution may have misrepresented Storm's state of mind. Two witnesses from the blockchain surveillance firm Chainalysis are meant to testify to running a Tornado Cash relayer.
This article was updated to reflect that a Chainalysis witness may plead the 5th after a phone call with the Government.
Last week, the prosecution attempted to paint a picture of Roman Storm as having deliberately built Tornado Cash to serve criminals. We saw testimony from Philip Werlau of Anchain AI, who suggested that Tornado Cash could have retained user's private keys to help stop illicit activity – a proposal about as sensible as suggesting to build Signal without end-to-end encryption –, convicted criminals taking the stand to testify to their use of Tornado Cash in hope for a lesser sentence, endless emails sent to the Tornado Cash team with requests to help recover funds aimed at painting Storm's inability to return criminal proceeds as deliberate and intentional, and sporadic mention of North Korea's Lazarus group, intended to prove that Storm was aware that the DPRK's funds flowed through his protocol – and chose to do nothing about it.
But defense's motion filed last night paint a drastically different picture.
Sage D. Young
New Evidence to Storm's State of Mind
To obtain a conviction, the Government has to prove mens rea: that Storm was of a guilty mind while developing Tornado Cash. This week, the defense will attempt to make the case that Storm did not, in fact, build Tornado Cash with criminals in mind. To do so, the defense has filed a motion to introduce new evidence aimed at debunking the prosecution's case, containing various chat messages sent by Storm.
In one of the messages, Storm discussed media coverage of the Harmony Horizon hack with Hasseb Quereshi, a partner at Dragonfly Capital, which invested in the Tornado Cash parent entity PepperSec. Harmony Horzion's bridge allowed users to exchange tokens from Ethereum to the Binance Smart Chain and was exploited by North Korea's Lazarus Group in 2022. The hacked funds had been traced back to Tornado Cash by the blockchain analysis firm Elliptic.
"I'm glad those fuckers are detected," Storm told Quereshi.
Quereshi issued a public statement on Storm's prosecution on Friday, after it was revealed that SDNY may consider pressing charges against the investors. "We had no contact with any malicious users, we always encouraged our portfolio companies to follow the law, and we maintain that Tornado Cash itself has a lawful right to exist," Quereshi wrote on X. It continues to be unclear whether Dragonfly Capital executive Tom Schmidt will be testifying in Storm's defense.
Additional messages to be introduced show that the Government's representation of Storm being unwilling to help victims whose funds flowed through Tornado Cash may not be fair.
Last week, the prosecution displayed messages sent by Storm to BitMart lawyer Joseph B. Evans, in which he stated that the Tornado Cash team was unable to help the hacked exchange recover funds. But the messages may not portray the full picture. In follow up messages, the Tornado Cash team suggested several solutions to BitMart, such as to contact entities like Infura and Etherscan, which may have records of user's IP Addresses. The Tornado Cash team additionally referred the BitMart team to Chainalysis, suggesting that the blockchain analysis firm may be able to assist BitMart in the recovery process. According to the defense's motion, the court had previously ruled to disallow the follow up messages into evidence, which the defense now argues are vital to display Storm's state of mind.
The defense also plans to introduce evidence debunking Philip Werlau's testimony, who argued that Storm could have taken several steps to prevent criminal activity on Tornado Cash, including the retention of private keys as well as the introduction of KYC/AML frameworks, and consciously chose not to. Werlau's testimony was given under limiting instructions to the jury, as Storm was not required to implement KYC/AML into the protocol. Rather, Werlau's testimony was, again, meant to speak toward Storm's state of mind while developing the service.
The defense's motion now attempts to introduce a blog post published by Tornado Cash in 2020, in which the developers state that financial privacy is essential to preserving financial freedom, but that it should not come at the cost of non-compliance. The blog post introduces a Tornado Cash compliance tool that allowed users of the service to provide cryptographically verified proof of ownership of Tornado Cash notes.
L0la L33tz
Chainalysis to Take the Stand
Chainalysis' involvement in the prosecution of Roman Storm has been debated since pretrial proceedings. In pretrial motions, the defense asked the prosecution to produce "any and all work product in which the government has relied on Chainalysis for attribution of hacks to the DPRK." The basis for the defense's request was an updated figure on funds Chainalysis attributed to North Korea.
While the indictment alleged that "a minimum of $1 Billion was laundered through Tornado Cash [...] for a host of cyber criminals, including a sanctioned cybercrime organization that used the service to launder hundreds of millions of dollars’ worth of cryptocurrency for North Korea’s weapons of mass destruction program," Chainalysis reduced the volume of funds it attributed to North Korea by almost half, from $1 Billion down to $660.5 Million.
Additionally, the defense requested "any statement made by Chainalysis personnel in which they discuss any errors related to their analysis of Tornado Cash." On Thursday, the court stated that the defense had gotten the documents it wants, though it is unclear what documents precisely the court was referring to. Chainalysis counsel states that it has produced over 7,500 pages to the parties, consisting of transactional data as well as email communications between Chainalysis employees regarding Tornado Cash. Chainalysis counsel notes that the firm merely acted as a records custodian in the matter, having provided the Government over 650 pages of records over the course of the investigation.
The defense now aims to introduce a Chainalysis custodian, as well as a percipient witnesses in Roman Storm's defense. The witnesses are expected to testify to a Tornado Cash relayer which Chainalysis is said to have operated. In a previous motion, the defense had highlighted that the prosecution has argued that Storm was forming a conspiracy not just with his alleged indicted co-conspirators, but also with "others who participated in the overall service, such as the relayers."
On Friday, the defense stated that one of the Chainalysis witnesses now plans on pleading the Fifth – meaning that the witness may refuse to testify to avoid self-incrimination. According to the defense, this decision was made after a phone call between Chainalysis and the Government. The defense has asked the court to inquire on the details of what was said, stating that it was "deeply concerned," as the witnesses potential decision came "out of the blue." Chainalysis counsel, Mr. DeFillippis, did not disclose to the defense what was discussed on the call after multiple inquiries, the defense alleges.
"We'd ask that there be an inquiry made with both Mr. DeFilippis and whatever prosecutors were on that line so we can understand what happened," the defense requested.
The defense may additionally call an already disclosed witness to rebut tracing done by IRS Special Agent George of the Government's first witness' funds Hanfeng "Katie" Lin, which, quite frankly, appears to have been an absolute dumpsterfire.
L0la L33tz
Quarrels Over Jury Instructions
The parties are still debating instructions the jury is meant to receive. As Amanda Tuminelli of the DeFi Education Fund points out on X, the instructions proposed by the Department of Justice are "limitless."
The prosecution is arguing that there is no prerequisite for Storm to have had a direct connection to criminal actors, claiming that it should be enough that Storm provided "a valuable service" to a sanctioned entity. "The ability to move funds that were the subject of great worldwide attention [...] is the most valuable service that that sanctioned entity could have asked for," the prosecution states.
"You don't see them going after Apple for the iPhone, Google for its tech suite, etc., even though these tech tools are used by the DPRK," Tuminelli argues. "That's because this is a gross distortion of the law."
Tuminelli additionally points out that the DeFi Education Fund reviewed over 100 sanctions cases, finding that in every case, there was some evidence that the defendant was directly tied to the sanctioned entity or created a tool specifically for a sanctioned entity.
The Government has further asked the court to instruct the jury that it must only prove that Storm believed that illicit funds to have flowed through Tornado Cash – not that the Government must prove that such transactions did in fact take place.
Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation. If you would like to note a correction to this article, please email corrections@therage.co
