Roman Storm, co-founder of the Ethereum-based privacy protocol Tornado Cash, will face a retrial in April 2027 on two serious criminal charges that a New York jury failed to decide last year.

The case is being heard in the Southern District of New York before Judge Katherine Polk Failla. Storm's first trial, held in August 2025, ended in a split outcome: he was convicted on one count of conspiracy to operate an unlicensed money-transmitting business, but the jury deadlocked on the two weightier charges of conspiracy to commit money laundering and conspiracy to violate IEEPA (the International Emergency Economic Powers Act) sanctions.

Each of those two counts carries a maximum sentence of 20 years; the convicted count carries up to five years. Sentencing on the conviction has been paused until the remaining charges are resolved.

The April 2027 date represents a significant delay from what federal prosecutors originally requested. In March 2026, the Department of Justice asked Judge Failla to schedule a retrial as early as October 5 or 12, 2026. The retrial may not happen at all. On April 9, 2026, Judge Failla heard arguments on a defense motion for a judgment of acquittal on all remaining charges. That ruling is still pending. If she grants it, the retrial is off. During that April hearing, the judge offered a pointed signal to prosecutors after assistant U.S. attorney Ban Arad argued that maintaining a cryptocurrency mixer constitutes criminal behavior.

"You were doing better before you started talking," she told him. She also cautioned observers against reading her questions as a signal of her thinking: "If my mind was made up one way or the other, I wouldn't drag you all in."

Defense attorneys Brian Klein of Cooley and David Patton have anchored part of their acquittal argument on a dramatic shift in government policy. In early 2026, Acting Attorney General Todd Blanche issued guidance titled "Ending Regulation by Prosecution," stating that the DOJ "is not a digital assets regulator" and that prosecutors should no longer pursue enforcement actions targeting mixing and tumbling services for the acts of their end users or for unwitting regulatory violations. Patton separately argued that holding a developer liable for how others use neutral tools is comparable to prosecuting a telephone manufacturer for conversations carried over its network. The U.S. Treasury has separately acknowledged that crypto mixers can serve legitimate financial privacy purposes. Klein told the court: "Maintaining your cryptocurrency mixer... that would also be legal. I think that's an important starting point here." The DOJ has not withdrawn the Storm prosecution despite this policy change, and the legal effect of Blanche's memo on pending cases remains contested.

Tornado Cash is a non-custodial privacy protocol, meaning it operates without a central custodian or controlling company. It uses zero-knowledge cryptography to break the traceable link between sending and receiving wallet addresses on public blockchains. The U.S. Treasury's Office of Foreign Assets Control sanctioned the protocol in August 2022, alleging it had processed more than $7 billion in cryptocurrency including roughly $600 million stolen by North Korea's Lazarus Group through the Axie Infinity Ronin bridge hack. Those sanctions were lifted on March 21, 2025, after a federal appeals court found that immutable smart contracts cannot constitute "property" under IEEPA, the International Emergency Economic Powers Act.

Despite the sanctions removal, the criminal case against Storm continued. Tornado Cash co-founder Alexey Pertsev was convicted in the Netherlands in May 2024 and sentenced to 64 months in prison. A third co-founder, Roman Semenov, remains internationally wanted, though the specific jurisdiction and nature of the outstanding warrant have not been confirmed in publicly available records.

Tornado Cash's total value locked across eight chains stood at approximately $548.6 million as of late August 2026, according to DefiLlama. That figure is well below the protocol's post-sanctions-removal peak of around $1.5 billion reached in late 2025. The protocol has also faced notable internal pressures during that period. In late June 2026, researchers flagged a suspicious governance proposal as a potential attempt to seize control of a governance address holding approximately $23 million in TORN tokens, raising questions about the integrity of the protocol's decentralized autonomous organization. A separate volume surge driven by wallets linked to the PulseChain ecosystem temporarily pushed total value locked toward $1.2 billion earlier in the year. The governance token TORN was trading near $5.55 as of August 17, 2026.

For developers outside the United States, the April 2027 retrial carries stakes that go well beyond one defendant.

The core legal question, whether writing and publishing open-source privacy software can make a developer criminally responsible for how third parties use it, remains unsettled across most jurisdictions, according to legal analysts including those at Mayer Brown, who have described the Storm prosecution as the most prominent test case globally for open-source developer liability.

In South Asia and sub-Saharan Africa, where blockchain developer communities are large and expanding, a conviction on the money-laundering and sanctions counts would add concrete legal risk to anyone contributing to privacy-focused protocols. India's blockchain developer community is among the largest in the world by GitHub activity.

Compliance teams at African exchanges are already navigating tightened regulatory frameworks. Nigeria's Investments and Securities Act 2025 brought virtual asset firms under SEC oversight, and the country's 2022 Money Laundering Act extended anti-money-laundering duties to crypto businesses. South Africa introduced a zero-threshold travel rule for crypto transfers, and the OECD's Crypto-Asset Reporting Framework took effect on March 1, 2026.

In regions where financial privacy serves practical purposes including protection from currency instability and state surveillance, the question of whether building neutral tools constitutes criminal conspiracy is not abstract.

Judge Failla has not indicated a timeline for her acquittal ruling. If she denies the motion, both sides will prepare for what will effectively be a second full trial on the two most serious charges, with a verdict unlikely before mid-2027 at the earliest.

The Storm case lays bare a contradiction at the heart of current U.S. crypto enforcement. The Department of Justice has formally declared, through written policy guidance, that it will no longer pursue the developers of mixing services for the acts of their users. Yet the same department is actively prosecuting Roman Storm for precisely that conduct. Whether that contradiction is resolved in a courtroom or through a further policy retreat, the outcome will shape how developers worldwide calculate the legal risk of writing privacy-preserving code.