Crypto Gloss

Roman Storm

Roman Storm is a U.S.-based Russian-American software developer who co-created Tornado Cash with Alexey Pertsev and Roman Semenov, and was arrested by the Department of Justice in August 2023 and charged with conspiracy to commit money laundering, conspiracy to violate sanctions (IEEPA), and conspiracy to operate an unlicensed money transmitting business — charges arising from Tornado Cash’s alleged facilitation of over $1 billion in money laundering for North Korea’s Lazarus Group and other criminal actors — facing a maximum combined sentence of decades in federal prison if convicted.

Background

Roman Storm is a software developer who emigrated to the United States from Russia and became a U.S. resident. With Pertsev and Roman Semenov (the third co-developer, who remains in Russia and has not been extradited), Storm built Tornado Cash as an open-source Ethereum privacy project beginning around 2019.

Charges

On August 23, 2023, Storm was arrested and charged in the Southern District of New York with:

  1. Conspiracy to commit money laundering — Alleged facilitation of $1B+ in laundered funds including $455M attributed to North Korea’s Lazarus Group hacks (Harmony Bridge, Ronin Bridge), the Wintermute and other DeFi hacks, and other criminal actors.
  2. Conspiracy to violate the International Emergency Economic Powers Act (IEEPA) — For providing services to sanctioned entities (North Korean state).
  3. Conspiracy to operate an unlicensed money transmitting business — Accepting and transmitting billions in funds without obtaining U.S. money transmission licenses.

Defense Arguments

Storm and his legal team have argued:

  • Code is free speech — Writing and publishing open-source code is protected First Amendment speech; Storm should not be criminally liable for how others use it.
  • Decentralized protocol — The Tornado Cash smart contracts are autonomous and immutable; Storm could not have prevented their use by criminals.
  • No financial intermediation — Storm did not control user funds; the protocol settled trades automatically without human custody or intervention.
  • No “money transmitting” occurred — Tornado Cash’s smart contracts are not a “money transmitting business” as defined by law because Storm did not hold user funds.

Industry and Precedent Significance

The Storm case (alongside Pertsev’s Dutch conviction) represents the most significant test of whether open-source smart contract developers bear criminal liability for the use of their code by third parties. The crypto industry broadly views this case as potentially chilling to developer activity — if developers are criminally liable for downstream uses of their open-source code, fundamental open-source development in the privacy space could be suppressed.

Several amicus briefs and public letters from crypto policy organizations (Coincenter, EFF) supporting Storm’s position have been filed.

Key Dates

  • 2019 — Tornado Cash launched as open-source Ethereum protocol.
  • August 8, 2022 — OFAC sanctions Tornado Cash.
  • August 10, 2022 — Alexey Pertsev arrested in Netherlands.
  • August 23, 2023 — Roman Storm arrested in the United States; charged in SDNY.
  • 2024 — Trial proceedings; defense motions; crypto industry support organizations file amicus briefs.

Common Misconceptions

  • “Roman Storm held user funds.” — Tornado Cash’s smart contracts held the pooled funds, not Storm or any individual developer. This is central to the defense argument about non-custodial protocols and criminal liability.
  • “Storm’s case is identical to Pertsev’s.” — The U.S. charges and Dutch charges differ in legal theory and jurisdiction; the outcome in the U.S. case may differ from Pertsev’s Dutch conviction.

Last updated: 2026-04

Related Terms