Did the Fifth Circuit Just Declare Open-Source Code Immune from US Sanctions Law?

The tension between national security imperatives and the foundational architecture of the decentralized internet has reached a historic legal resolution. For years, the United States government has sought to choke off funding for malicious cyber actors by aggressively applying economic sanctions to digital assets. This effort collided directly with the ethos of open-source development when the Treasury Department targeted Tornado Cash, a privacy-preserving protocol built on the Ethereum blockchain. The core disagreement was fundamental: can a piece of self-executing, uncontrollable software code be classified as sanctionable "property"? The answer, delivered in a landmark ruling by the US Court of Appeals for the Fifth Circuit, has fundamentally reshaped the regulatory landscape for developers worldwide, establishing a clear boundary line where executive branch embargo powers end and decentralized infrastructure begins.[5]

The dispute originated in August 2022, when the Office of Foreign Assets Control (OFAC) took the unprecedented step of sanctioning Tornado Cash, adding the protocol to its Specially Designated Nationals (SDN) list. OFAC invoked its authority under the International Emergency Economic Powers Act (IEEPA), a 1977 statute that empowers the President to block transactions involving "property" in which a foreign entity has an interest. The agency argued that the protocol's smart contracts—the underlying lines of code that automatically pool and shuffle cryptocurrency to obscure transaction histories—constituted property. This designation effectively criminalized any interaction with the open-source code by US persons, sparking immediate backlash from privacy advocates, developers, and civil liberties organizations who argued that the government was unconstitutionally sanctioning neutral technology rather than the bad actors exploiting it.[3][7]

The Fifth Circuit's unanimous decision in Van Loon v. Department of the Treasury dismantled OFAC's legal theory by focusing on the technical reality of how decentralized applications function. The court drew a sharp distinction between traditional assets and "immutable" smart contracts. In the blockchain ecosystem, an immutable smart contract is a program deployed to the network that cannot be altered, paused, or deleted by anyone—not even the developers who originally wrote and deployed it. The appellate panel ruled that because these specific smart contracts operate autonomously and are entirely beyond human control, they lack the essential characteristics of property. To be classified as property under the plain meaning of IEEPA, the court noted, an asset must be capable of being owned and controlled.[1][4]

This judicial determination creates a powerful legal shield for open-source developers, provided they genuinely relinquish administrative control over their creations. By ruling that uncontrollable code is not sanctionable property, the Fifth Circuit has effectively established a "control test" for software. If developers retain the ability to upgrade, patch, or pause a smart contract—making it "mutable"—that code remains subject to US sanctions because it can still be controlled. However, once code is permanently deployed as immutable infrastructure, it transitions from a controllable asset into a neutral, autonomous tool. This distinction protects developers who build foundational decentralized finance (DeFi) primitives from being held strictly liable for how third parties, including state-sponsored hackers, eventually utilize their open-source contributions.[3][5]

The collateral impact of OFAC's initial, overly broad designation was massive, underscoring the dangers of applying legacy financial regulations to novel technologies. The Treasury Department justified its emergency action by pointing to the North Korean Lazarus Group, which allegedly used Tornado Cash to launder hundreds of millions in stolen cryptocurrency. However, the specific illicit funds attributed to the Lazarus Group heist amounted to $455 million. While a staggering sum, this represented only 6.5 percent of the total $7 billion in transaction volume that had been processed by the Tornado Cash protocol since its inception in 2019. By attempting to classify the entire open-source protocol as sanctionable property, OFAC effectively embargoed the remaining 93.5 percent of decentralized activity, sweeping up countless legitimate users seeking financial privacy.[1][2][5]

The Fifth Circuit's ruling relied heavily on recent Supreme Court jurisprudence that curtails the administrative state's ability to stretch statutory definitions beyond their plain text. Citing the landmark Loper Bright decision, which abolished the longstanding Chevron deference doctrine, the appellate court refused to grant "heightened deference" to OFAC's expansive interpretation of the word "property." The panel emphasized that its duty was to interpret the 1977 IEEPA statute independently, rather than allowing an executive agency to unilaterally expand its own jurisdiction to capture modern technologies that Congress never envisioned. The court explicitly noted that while the government's concerns about money laundering are undeniably legitimate, it is the responsibility of the legislative branch, not the judiciary or executive agencies, to update outdated laws.[2][6]

While the decision is a monumental victory for the open-source and cryptocurrency industries, it does not leave the US government powerless to combat illicit finance. The ruling meticulously targeted the classification of the immutable code itself, leaving OFAC's broader enforcement toolkit intact. The agency retains full authority to sanction the specific individuals, hacking groups, and digital wallet addresses associated with criminal activity. Furthermore, developers who operate mutable smart contracts, or who actively run centralized front-end websites that facilitate access to decentralized protocols, remain fully exposed to regulatory scrutiny and criminal prosecution. The ruling forces a strategic pivot: law enforcement must now target the human actors and controllable access points rather than attempting to outlaw the underlying mathematics.[3][4]

Ultimately, the Van Loon precedent ensures that the United States remains a viable jurisdiction for the development of trustless, decentralized technology. Had OFAC's interpretation survived, the chilling effect on software engineering would have been profound, as developers would face the constant threat of sanctions simply for publishing code that bad actors might later abuse. By legally recognizing the difference between human-controlled enterprises and autonomous software, the Fifth Circuit has aligned US sanctions law with the technical realities of the twenty-first century. The decision preserves the government's ability to pursue criminals while safeguarding the foundational building blocks of the next-generation internet from executive overreach.[5][6]