Evasion Under Blockchain Sanctions

TL;DR

This paper evaluates the effectiveness of OFAC sanctions on Tornado Cash, revealing significant reduction in deposit volume but persistent evasion in security incidents, highlighting structural enforcement challenges.

Contribution

It provides empirical analysis of sanctions impact on Tornado Cash and identifies key structural limitations in current enforcement practices.

Findings

Sanctions reduced Tornado Cash deposits by 71.03%.

78.33% of Ethereum security incidents involved Tornado Cash.

Identified three major structural limitations in sanction enforcement.

Abstract

Sanctioning blockchain addresses has become a common regulatory response to malicious activities. However, enforcement on permissionless blockchains remains challenging due to complex transaction flows and sophisticated fund-obfuscation techniques. Using cryptocurrency mixing tool Tornado Cash as a case study, we quantitatively assess the effectiveness of U.S. Office of Foreign Assets Control (OFAC) sanctions over a 957-day period, covering 6.79 million Ethereum blocks and 1.07 billion transactions. Our analysis reveals that while OFAC sanctions reduced overall Tornado Cash deposit volume by 71.03% to approximately 2 billion USD, attackers still relied on Tornado Cash in 78.33% of Ethereum-related security incidents, underscoring persistent evasion strategies. In this paper, we identify three significant, structural limitations in current sanction enforcement practices: (i) fragmented censorship in blockchain consensus and application layer; (ii) the complexity of obfuscation virtual asset services exploited by users; and (iii) the susceptibility of naive binary sanction classifications to dusting attacks. Our analysis and findings contribute to ongoing discussions around regulatory effectiveness in Decentralized Finance by providing empirical evidence, clarifying enforcement challenges, and informing future compliance strategies in response to sanctions and blockchain-based security risks.