The US Department of the Treasury has added the Tornado Cash crypto mixer to a list of sanctioned organizations, barring all US citizens from interacting with it and requiring that US assets belonging to Tornado Cash be reported to the Office of Foreign Assets Control.

The announcement was made on Monday morning by the Treasury in a press release that cited Tornado Cash’s role in laundering cryptocurrency stolen in major hacks, especially those linked to North Korean hacking groups. In March, $625 million was stolen from the blockchain behind the Axie Infinity crypto game and laundered through Tornado Cash — a heist that the FBI has attributed to the North Korea-based Lazarus Group.

The dramatic move from the Treasury is the latest escalation in a series of enforcement actions against Tornado Cash and other crypto mixers, which help to obfuscate cryptocurrency transactions by pooling funds together and then redistributing them to contributors. In a statement, Brian E. Nelson, under secretary of the Treasury for terrorism and financial intelligence, said that the mixer had not taken adequate steps to prevent its services from being used by some of the most prolific cybercriminals.

“Today, Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States,” Nelson said. “Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks.”

“Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them,” Nelson said.

Tornado Cash is now the second cryptocurrency mixer to find itself effectively cut off from the US financial system. In May, the Treasury added Blender.io to its sanctions list, also citing Blender’s use by North Korean hacking groups as well as global ransomware gangs like Conti and Trickbot.

Though there are legitimate privacy-focused uses of cryptocurrency mixers, tools like Tornado Cash and Blender undoubtedly play a central role in helping organized criminal gangs launder the proceeds of crime in a way that cannot be traced by standard blockchain tracking techniques. In January 2022, blockchain analysis firm Chainalysis reported that the usage of crypto mixers had reached an all-time high, with year-on-year increases driven largely by input transactions coming from wallet addresses linked to cybercrime.

In a possible attempt to evade regulation, Tornado Cash was set up as a decentralized finance product, meaning that the software code that runs the service is distributed across the Ethereum network rather than running on servers based in one particular country. However, the Treasury’s sanctions list entry for Tornado Cash targets the mixer by specifying a number of Ethereum addresses linked to it, forbidding US entities of any kind from transacting with these addresses.

While the sanctions against Tornado Cash are a severe reprimand from the Treasury Department, the accompanying press release seems to leave the door open for a change in policy should the mixer operate in closer compliance with guidance given by regulators.

“The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior,” the statement ends.