The War on Financial Privacy: Privacy Coins, Mixer Regulation, and the State's Ambition to Make Every Transaction Legible
In November 2024, Roman Storm, a co-founder of Tornado Cash — the Ethereum smart contract protocol that allowed users to break the on-chain link between sending and receiving wallet addresses — was convicted in a Manhattan federal court on charges of money laundering conspiracy, sanctions violations, and operating an unlicensed money transmitting business. The prosecution argued, and the jury accepted, that operating open-source software designed to provide financial privacy was itself a criminal act when that software was used by sanctioned actors — including North Korea's Lazarus Group, which had routed approximately $455 million through Tornado Cash before OFAC designated the protocol's smart contract addresses in August 2022. Storm was sentenced to eight years in federal prison. His co-defendant, Roman Semenov, remains a fugitive. The third co-founder, Mikhail Chalopin, cooperated with prosecutors.
The Tornado Cash prosecution is the most significant criminal enforcement action in the history of cryptocurrency privacy, and its implications extend far beyond the specific case. It established, as a matter of US federal law, that the authors of privacy-preserving software can be held criminally liable for the uses to which third parties put that software — a departure from the intermediary liability frameworks that have governed internet platform law since the 1990s, and a precedent with direct consequences for the developers of Monero, Zcash, and any other protocol designed to provide the financial privacy that most cash transactions have historically afforded as a matter of course.
The broader regulatory architecture surrounding cryptocurrency privacy is, in 2026, the most rapidly evolving area of digital financial regulation — and the one with the sharpest implications for the question of whether digital money can serve the functions of physical cash, including the function of transacting without leaving a permanent, searchable, state-accessible record.
The Mixer as Infrastructure: What Is Being Regulated
A cryptocurrency mixer, or "tumbler," is a service or protocol that pools cryptocurrency from multiple users and returns equivalent amounts from the pool — minus a fee — thereby severing the blockchain's normally transparent link between sending and receiving addresses. The privacy rationale is straightforward: in a system where every transaction is permanently recorded on a public ledger, the default assumption of transactional pseudonymity is undermined by the trivial ability to link wallet addresses to real-world identities through exchange KYC records, IP address analysis, and transaction graph analysis. Mixers restore the functional equivalent of the privacy afforded by cash — not perfect anonymity, but the reasonable expectation that your purchase of a medication, your donation to a political organisation, or your payment to a sensitive service provider is not permanently legible to anyone with access to blockchain analysis tools.
The prosecution of Tornado Cash elided this privacy rationale with deliberate consistency. The DOJ framing presented Tornado Cash as an instrument purpose-built for money laundering, emphasising the Lazarus Group transactions while declining to quantify what proportion of total Tornado Cash volume was attributable to illicit use. Independent blockchain analysis firms estimated that illicit volume through Tornado Cash represented between 10 and 34% of total transactions — a figure that is both non-trivial and consistent with the illicit use proportion of large cash currency denominations in the physical financial system. The hundred-dollar bill facilitates more illicit transactions, in absolute dollar terms, than any cryptocurrency mixer has ever processed — but no one has proposed criminalising the Federal Reserve's printing of large-denomination notes.
It reflects a convergence of state interest in transaction surveillance — for tax enforcement, sanctions compliance, and law enforcement — with financial sector interest in maintaining the AML/KYC infrastructure through which compliance revenue is generated. The "travel rule" mandated by the Financial Action Task Force, which requires virtual asset service providers to collect and transmit identity information on transactions above a threshold, mirrors the Bank Secrecy Act's suspicious activity reporting regime — a regime that, as researchers have documented, generates massive volumes of compliance data with limited demonstrated law enforcement utility.
Monero and the Architecture of Privacy
Monero is the cryptocurrency most technically equipped to provide genuine financial privacy, and consequently the most aggressively targeted by regulatory action. Unlike Bitcoin, where pseudonymity is achieved through wallet address separation but is frequently defeated by blockchain analysis, Monero incorporates three cryptographic privacy mechanisms at the protocol level: ring signatures, which blend a transaction's inputs with dummy inputs to obscure the sending address; stealth addresses, which generate a one-time receiving address for each transaction; and confidential transactions (RingCT), which hide transaction amounts. The result is a system in which external observers cannot determine who sent a transaction, who received it, or how much was transferred — privacy properties that are not achievable on Bitcoin or Ethereum even with mixer protocols.
The regulatory response has been to treat Monero's privacy properties as evidence of criminal intent by design. Major regulated exchanges — Coinbase, Kraken, Binance, and their European equivalents — have delisted Monero across most jurisdictions under regulatory pressure, citing the inability to implement effective AML monitoring on a privacy-by-design blockchain. South Korea, Australia, and the UK have issued guidance effectively prohibiting the listing of privacy coins on regulated platforms. The FATF's updated virtual asset guidance, published in 2023, specifically flagged "enhanced anonymity features" as a red flag requiring enhanced due diligence — a designation that has functioned, in practice, as a near-universal delistment mandate.
The consequence, as Shoshana might frame it, is the privatisation of financial privacy's elimination: states that are constitutionally constrained from mandating the surveillance of physical cash transactions have achieved equivalent surveillance of digital transactions by mandating that regulated exchanges — which serve as the on-ramps between fiat currency and cryptocurrency — refuse to handle privacy-preserving assets. The ban on Monero on regulated exchanges does not eliminate Monero; it eliminates the convenient pathway between Monero and the conventional financial system, ensuring that privacy-seeking cryptocurrency users must either accept the surveillance of transparent blockchains or operate at the margins of the regulated financial system.
The FATF Ratchet and Global South Financial Privacy
The FATF's travel rule extension to virtual assets, and its mutual evaluation process that grades countries on their implementation of FATF standards, creates a ratchet mechanism that systematically globalises the most restrictive financial surveillance norms regardless of whether individual countries have chosen them through democratic deliberation. Countries that receive poor FATF grades face the prospect of being "grey listed" — a designation that restricts their correspondent banking relationships and imposes significant costs on cross-border commerce. The incentive structure effectively forces regulatory adoption of FATF's virtual asset standards as the price of continued access to the dollar-denominated correspondent banking system.
For countries in the Global South — where remittance flows, often to and from politically sensitive destinations, are a crucial economic lifeline, and where the state's surveillance capacity is often deployed in the service of political rather than criminal enforcement — the FATF ratchet imposes a particular cost. The privacy-preserving features of Monero and analogous cryptocurrencies are not merely a convenience for wealthy privacy enthusiasts in Western jurisdictions; they are a meaningful protection for labour migrants sending money home through channels that authoritarian governments might otherwise surveil and interrupt, for political activists whose financial support networks are targets of state persecution, and for the estimated 1.4 billion adults globally who remain unbanked and for whom the formal financial system's KYC requirements represent an exclusion barrier rather than a protection.
Ruha Benjamin's concept of technology encoding pre-existing power hierarchies is operative in the privacy coin regulatory architecture: the regulatory framework presents financial surveillance as a neutral public safety measure while its enforcement falls disproportionately on the populations — Black Americans, migrants, politically marginalised communities — who have the most structural reason to seek financial privacy from institutions that have historically used financial data against them.
Stakes: The Legibility Imperative and Its Discontents
The regulatory trajectory in 2026 is toward comprehensive financial legibility: a world in which every digital transaction above a minimal threshold is logged, identified, and available to regulatory and law enforcement access. This is presented, through the FATF and FinCEN framing, as an anti-money-laundering and counter-terrorist-financing imperative — a public safety argument that is difficult to contest in the abstract without appearing to defend criminal financing.
What the public safety framing systematically obscures is the cost side of the ledger. Comprehensive financial surveillance is not merely a restriction on criminal activity; it is a restriction on political activity, labour organising, journalism, medical privacy, sexual privacy, and the full range of human conduct that takes place through economic transactions and that has historically been protected by the practical impossibility of surveilling cash. The move from a cash economy to a fully surveilled digital payment system is not a neutral technical transition; it is a redistribution of power from individuals to the institutions — states, banks, payment processors — that administer the surveillance architecture.
The Tornado Cash prosecution, Monero's effective delistment from regulated markets, and the FATF's global ratchet mechanism are three components of a coordinated transition whose endpoint is a digital financial system in which financial privacy is a privilege contingent on regulatory approval rather than a default feature of transacting as a human being in an economy. Whether that transition is inevitable, and whether it is desirable, are political questions — not technical ones — that deserve more public deliberation than they have received.
The Monexus tech desk covers privacy coin regulation as a civil liberties story as much as a financial crime story — because the question of who sees your transactions is also the question of who has power over your conduct.