Defending Privacy in Crypto

Tl;dr: Coinbase is funding a lawsuit brought by six people challenging the U.S. Treasury Department’s sanctions of the Tornado Cash smart contracts and asking the Court to remove them from the U.S. sanctions list. The sanctions exceed Treasury’s authority, harm innocent people, remove privacy and security options for crypto users, and stifle innovation.

By Brian Armstrong, CEO and Cofounder

Today we’re announcing that Coinbase is funding a lawsuit brought by six people challenging the United States Treasury Department’s sanctions of the Tornado Cash smart contracts and asking the Court to remove them from the U.S. sanctions list.

Tornado Cash is an open source piece of software running on the Ethereum blockchain that preserves privacy by allowing users to deposit assets from one crypto address and withdraw them using a different crypto address.

Last month, Treasury sanctioned the Tornado Cash software because it was being used by criminals — including North Korean hackers. We have no issue with the Treasury sanctioning bad actors and we take a hard stance against unlawful behavior. But in this case, Treasury went much further and took the unprecedented step of sanctioning an entire technology instead of specific individuals. The problem here is twofold: (1) there are legitimate applications for this type of technology and as a result of these sanctions, many innocent users now have their funds trapped and have lost access to a critical privacy tool, and (2) we believe the Treasury exceeded its authority, given by Congress, by sanctioning a technology.

At Coinbase, we’ve been fighting illicit activity since the very beginning, and while we share Treasury’s commitment to fighting crime, we believe this action harms innocent people and threatens the future of decentralized finance (DeFi) and web3 specifically.

The nature of the blockchain — where every transaction is public — makes crypto more secure. But it can also create privacy concerns. If you receive your salary in crypto, for example, you might not want the world to know how much money you make, or how you choose to spend it.

That’s why the individuals we’re supporting in this case used Tornado Cash in the first place:

• One person used Tornado Cash to anonymously donate money to Ukraine. Afterwards, his wallet received potentially malicious air drops. But because he anonymized his crypto before donating, he avoided attacks against his personal accounts. He has funds trapped in Tornado Cash.
• Another person is an early crypto adopter with a large online presence and a public ENS name linked to his Twitter profile. He used Tornado Cash to protect his personal security while transacting. Now he also has funds trapped in Tornado Cash.
• A third person operates an Etherum staking business. At one point, a stranger working near where he engages in staking asked how much money he was earning. He started using Tornado Cash to protect his assets and his personal safety.

Sanctioning open source software is like permanently shutting down a highway because robbers used it to flee a crime scene. It’s not the best way to solve a problem. It ends up punishing people who did nothing wrong and results in people having less privacy and security.

We believe law abiding citizens have a right to privacy, especially with some of their most sensitive data: their finances.

The second problem is that, while Treasury is allowed to sanction people (along with their property), Congress never gave it the power to sanction open source software. That’s why these plaintiffs are going to court to ask that this software be removed from the U.S. sanctions list. You can read more about our legal argument here.

Finally, sanctioning open-source code has a chilling effect on innovation.

Right now, developers are worried that they could be held responsible for something they had nothing to do with, and no ability to control. At a time when we should be encouraging innovation, this kind of fear and uncertainty will do the opposite — making developers wonder if, by pushing the industry forward, they could be putting themselves at risk.

As one of the largest companies in crypto, we have a responsibility to defend the crypto industry against actions that go too far, and treat crypto on an uneven playing field. It’s not enough to just say we disagree and sit on the sidelines. That’s why we’re funding and supporting this lawsuit.

We will fully comply with the law while we await the court’s decision. But we’re hopeful that these sanctions will be reversed, allowing innocent crypto users to regain access to their funds and making it possible for anyone to use privacy tools to protect themselves.

Defending Privacy in Crypto was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.