DOJ Clarifies Developer Liability in Decentralized Tech Prosecutions

The U.S. Department of Justice (DOJ) has signaled a shift in its approach to prosecuting developers of decentralized technologies, clarifying that it will not pursue charges against them for the unintended misuse of their protocols. This clarification follows the recent conviction of Roman Storm, co-founder of the Tornado Cash privacy protocol, on a charge of operating an unlicensed money transmitting business. The DOJ’s position was outlined by acting assistant attorney general Matthew Galeotti at the American Innovation Project (AIP) Summit in Wyoming, where he emphasized that software developers should not be held criminally liable for actions of users who misuse their code [1].

Galeotti’s remarks came amid growing concerns from crypto advocacy groups, who argue that holding developers responsible for third-party misuse of open-source protocols could stifle innovation in the decentralized finance (DeFi) sector. Amanda Tuminelli, executive director of the DeFi Education Fund, welcomed the DOJ’s statement, noting it aligned with longstanding arguments made by the sector [1]. The clarification also followed a DOJ memo issued in April, which stated the department would no longer pursue cases targeting crypto mixers based solely on user behavior or unintentional regulatory violations [1].

The Tornado Cash case has sparked a broader debate about the legal boundaries of developer liability in the crypto space. Storm was convicted under 18 U.S.C. §1960, a federal statute governing unlicensed money transmission. However, jurors were unable to reach a verdict on additional charges related to money laundering and sanctions evasion. Prosecutors have not ruled out the possibility of a retrial. Galeotti clarified that new charges under this law would not be approved in cases where protocols are “truly decentralized” and operate without custody or control of user assets. At the same time, he emphasized that cases involving clear criminal intent would still be subject to prosecution [1].

The industry has expressed concern over the implications of the Tornado Cash verdict, with critics arguing that the money transmission charge mischaracterizes the protocol’s decentralized nature. Supporters of the project worry the conviction could discourage developers from building privacy-enhancing applications, despite their legitimate uses. Prosecutors, meanwhile, have maintained that Storm retained meaningful control over Tornado Cash, challenging the claim that it is a fully decentralized protocol. The platform, originally designed to enhance privacy on the Ethereum network, was reportedly used to launder over $500 million in stolen cryptocurrency in 2022, including funds linked to North Korean hackers [1].

It remains unclear whether the DOJ’s recent clarification would have shielded Storm from prosecution. His legal team has announced plans to appeal the conviction. The outcome of the appeal and future enforcement actions will likely shape the regulatory landscape for decentralized protocols and open-source software. The DOJ’s revised stance suggests a recalibration of its enforcement strategy, with a focus on distinguishing between intentional misconduct and the unintended misuse of code. By setting clearer boundaries around developer liability, the department aims to balance enforcement with the need to support technological innovation [1].

Source: [1] ‘Code Alone Is Not a Crime’: DOJ Clarifies Stance Following Tornado Cash Case (https://cryptodaily.co.uk/2025/08/code-alone-is-not-a-crime-doj-clarifies-stance-following-tornado-cash-case)