Federal prosecutors in New York formally rejected a new motion to dismiss charges against Roman Storm, co-founder of the Ethereum privacy protocol Tornado Cash, filing a letter on April 7 that called his legal argument "inapposite" and pushed the case toward a retrial expected in October 2026.

Storm's attorneys had cited a recent Supreme Court ruling in Cox Communications, Inc. v. Sony Music Entertainment to argue that knowingly providing a service that others misuse does not, on its own, establish criminal intent. The defense position rests on what lawyers call the "mere knowledge" standard: that awareness of potential misuse falls short of the culpable intent required for a criminal conviction. Prosecutors pushed back immediately, arguing the Cox decision addresses civil copyright liability and has no bearing on criminal statutes governing money laundering and sanctions violations.

US Attorney Jay Clayton of the Southern District of New York was direct in his assessment, arguing that "the defendant's conduct simply is not comparable to the conduct at issue in Cox." Clayton also contended that Storm showed "window dressing at best and outright misdirection at worst" when it came to anti-money-laundering compliance.

Where the Case Stands

Storm's legal situation is layered. An August 2025 jury convicted him on one count of operating an unlicensed money transmitting business but deadlocked on two others: money laundering conspiracy and sanctions violations conspiracy. Prosecutors are seeking a retrial on those two unresolved counts, with proposed dates of October 5 through 12, 2026. Oral arguments on a separate motion for acquittal (known procedurally as a Rule 29 motion) on the unlicensed money transmitting count are scheduled for April 9. Storm remains free on a $2 million bail bond. A conviction on all remaining counts would carry a maximum sentence of up to 40 years.

The protocol at the center of the case, Tornado Cash, was launched in 2019 by Storm alongside Roman Semenov and Alexey Pertsev. It uses zero-knowledge cryptography to break the traceable link between sending and receiving addresses on the Ethereum blockchain. The US Treasury's Office of Foreign Assets Control sanctioned the protocol in August 2022, citing more than $7 billion in alleged laundered funds since the protocol's 2019 launch. That total included hundreds of millions attributed to North Korea's Lazarus Group following the Ronin Bridge hack. OFAC removed Tornado Cash from its sanctions blacklist in March 2025, following a Fifth Circuit ruling in November 2024 that found immutable smart contracts do not qualify as "property" subject to sanction. However, Storm's criminal case continued.

Tornado Cash's total value locked peaked near $1.195 billion in late 2025 and has remained above $1 billion since, according to data from Phemex and DefiLlama. The protocol processed roughly $2.5 billion in ETH-equivalent volume through 2025. Its governance token, TORN, remains active but trades well below its 2022 highs.

The Developer Liability Question

The legal theory underlying Storm's prosecution carries implications well beyond this single case. The DOJ's position is that Storm's knowledge of illicit use is itself evidence of criminal intent, even though he did not hold custody of user funds. Legal analysis from Mayer Brown suggests the conviction underscores that developers must determine whether they operate a money transmitting business and obtain proper licensing. That compliance obligation, if broadly applied, would require open-source developers to assess their legal exposure before building or maintaining tools capable of transferring value.

Lawmakers have taken notice. Representatives Scott Fitzgerald, Ben Cline, and Zoe Lofgren introduced the Promoting Innovation in Blockchain Development Act of 2026, a bipartisan bill that would clarify federal money transmission statutes to target custodians rather than programmers. The bill has not yet passed.

The DOJ's continued pursuit of a retrial is itself notable against the backdrop of a stated policy shift. In April 2025, Acting Deputy Attorney General Todd Blanche issued a memo titled "Ending Regulation by Prosecution," signaling that the department would step back from prosecuting regulatory violations in the digital assets space. The decision to press forward with Storm's retrial despite that directive has drawn scrutiny from legal observers tracking the administration's enforcement posture, and it is the tension between that memo and this prosecution that makes the case politically significant.

Regional Exposure

For developers and users outside the United States, the case functions as a live stress test of how far US enforcement jurisdiction reaches into open-source software development.

In India, where crypto gains face a 30% flat tax and regulatory scrutiny of financial privacy tools is significant, developers contributing to DeFi or privacy infrastructure must now weigh whether awareness of potential misuse could expose them to criminal liability under a US legal framework that some legal observers argue could be applied extraterritorially. Nigeria, home to the continent's highest crypto adoption volumes and an increasingly active Ethereum user base, faces a parallel concern: Storm was prosecuted despite a decentralised architecture and no direct custody of user funds, which is precisely the model many African protocol builders use. For Nigerian users sending remittances across borders and trying to shield transaction data from local surveillance, the continued prosecution signals that regulatory delisting does not equal legal safety.

In Pakistan, where regulators are transitioning from blanket crypto bans toward a formal licensing framework under a new Virtual Assets Regulatory Authority, the Storm case raises the question of whether contributing to open-source mixing protocols could trigger cross-border liability before domestic rules are even finalized.

The regional stakes extend further across Sub-Saharan Africa and South Asia. In Ghana, the Bank of Ghana is developing a virtual asset service provider regulatory framework, and enforcement actions like Storm's prosecution may be cited as justification for restrictive treatment of privacy protocols. In Bangladesh, one of Asia's most restrictive crypto environments, the case illustrates that a protocol's removal from a sanctions list does not eliminate criminal liability for those who built or maintained it. Across Sub-Saharan Africa more broadly, privacy tools like Tornado Cash serve a dual function: financial data protection and a mechanism for cross-border payments in high-surveillance or underbanked environments. The outcome of Storm's case will shape how developers and users in those markets understand their own exposure.

What Comes Next

The April 9 oral arguments on whether Storm's sole conviction should be thrown out will offer the first courtroom signal since the new dismissal motion was rejected. If that motion fails, the October retrial becomes the main event. Netherlands-based co-founder Alexey Pertsev, convicted in the Netherlands in May 2024 and sentenced to more than five years in prison for money laundering, has already seen his conviction upheld on appeal. That outcome, a parallel proceeding in a separate jurisdiction, is one that Storm's defense will be closely aware of as it prepares its case. Third co-founder Roman Semenov remains abroad and continues to appear on the OFAC sanctions list.