Tornado Cash processed roughly $2.5 billion in 2025 despite US sanctions

According to Bitrace, the cryptocurrency mixer Tornado Cash processed roughly $2.5 billion worth of Ethereum tokens in 2025. This is despite the privacy platform being under regulatory sanctions until March 2025.

Before and after the sanctions, however, activity has been non-stop on the fund mixing service.

Tornado Cash faced serious sanctions in 2022 from many Western countries, led by the United States, which placed sanctions on the privacy mixing platform that enables users to obscure transactions and make detection more difficult.

How did regulators react to Tornado Cash?

The U.S. Treasury’s Office of Foreign Assets Control alleged that Tornado Cash facilitated money laundering of over $7 billion, including $455 million stolen by North Korea’s Lazarus Group, and has since prosecuted the founders, who to date are still fighting legal battles.

One of the founders, Alexey Pertsev, has already been sentenced to 64 months in prison. Cryptopolitan has reported that Roman Storm, another co-founder, is waiting to be sentenced, and the third co-founder is currently at large.

The sanctions placed on the platform resulted in a reduction in activity, but operations continued due to Tornado Cash’s decentralized architecture. The protocol has since then gained more notoriety as the go-to platform for people who want to obscure transactions for legitimate privacy reasons or bad actors who want to launder funds.

What’s the technology behind the privacy revolution?

The technological foundation enabling these privacy protocols lies in zero-knowledge proofs (ZKP), a cryptographic technique that allows verification of information without revealing the data behind it.

It was first proposed by some MIT researchers in 1985, and since then, ZKP technology has moved from just a theoretical concept to a practical infrastructure supporting billions in transactions.

In Tornado Cash’s operating mechanism, users deposit cryptocurrency into smart contracts that pool funds from multiple sources. When withdrawing to a different address, users provide zero-knowledge proofs that show their ownership without revealing which deposit originated the withdrawal.

This makes it very difficult for external observers to trace fund movements, effectively breaking the transparent audit trail that is usually a feature in most blockchain transactions.

The privacy protocol ecosystem has also grown beyond Tornado Cash. Railgun, frequently mentioned by Ethereum founder Vitalik Buterin, saw net inflows of $1.4 billion in 2025, according to Bitrace.

Institutional players made considerable investments in privacy solutions in 2025, with Zcash receiving a lion’s share of those investments. The cryptocurrency, which is built with the same code as Bitcoin but with an added layer of privacy, caught the attention of users who wanted more privacy in their transactions.

The Zcash token has since increased by over 750% year-to-date, with a market capitalization of over $6.45 billion.

Another privacy platform, Monero, also saw considerable investments and now has a market capitalization of over $9.1 billion. However, these platforms are not crypto mixers like Tornado Cash, which may also contribute to their appeal.

The compliance challenge for Web3 entities

The sanctions on Tornado Cash were lifted following a federal appeals court ruling that immutable smart contracts do not qualify as property under US law, establishing that regulators lacked authority to sanction the software itself.

However, this has not brought an end to the ongoing litigation and conversations regarding the protocol.

The fundamental question facing the industry is whether privacy can be reconciled with regulatory requirements. The current trajectory points to growing adoption of zero-knowledge proof technology across legitimate use cases, from confidential business transactions to privacy-preserving identity verification.

However, there is also increased usage by bad actors, and that is what regulators and other industry stakeholders must find a way to address without throwing the baby out with the bathwater—in other words, solve without taking steps that affect legitimate users.