Tornado Cash recorded 968 deposits on July 23, marking the protocol’s most active day so far in 2026, according to data from L2Beat. The surge signals that large-scale actors have resumed using the privacy mixer following the U.S. Treasury’s decision to lift sanctions in March 2025. Baseline activity on the protocol has been climbing steadily, even as legal proceedings against developer Roman Storm continue to cast a shadow over the project’s future. The numbers raise pointed questions about how regulators will respond to a tool that sits at the intersection of financial privacy and illicit fund flows.
What the Deposit Spike Tells Us About Post-Sanctions Demand
Before unpacking the strategic implications, it’s worth grounding the data. A single-day deposit count of 968 doesn’t just represent a statistical outlier — it reflects a behavioral shift among users who had largely avoided the protocol during the sanctions period. That the spike occurred months after the Treasury’s delisting, rather than immediately following it, suggests a delayed but durable return of confidence among heavy users.
- The 968-deposit day on July 23 is the highest single-day figure recorded for Tornado Cash in 2026, per L2Beat tracking data.
- Large-scale depositors — often associated with exploit proceeds and cross-chain obfuscation — appear to have re-entered the protocol’s ecosystem in force.
- Baseline usage has trended upward since Q1 2026, indicating that the post-sanctions recovery is structural, not episodic.
- The U.S. Treasury’s March 2025 delisting removed the most significant legal deterrent for U.S.-adjacent users, but international regulatory postures remain fragmented.
- Developer Roman Storm’s ongoing legal case has not, at least on paper, dampened protocol-level activity — a separation of legal risk from usage risk that few predicted.
A Protocol Caught Between Legitimacy and Liability
Tornado Cash occupies an uncomfortable position in decentralized finance. It is, simultaneously, a legitimate privacy tool and the preferred laundering mechanism for some of crypto’s most damaging exploits. The Treasury’s 2022 sanctions were unprecedented — the first time OFAC targeted a smart contract rather than a person or entity (a distinction regulators have been slow to enforce consistently). When those sanctions were lifted in March 2025, the move was widely interpreted as a concession to legal and constitutional challenges rather than an endorsement of the protocol’s use cases.
And yet usage climbed.
That trajectory complicates the narrative for both privacy advocates and law enforcement. For the former, rising deposits validate the argument that privacy is a feature, not a crime. For the latter, the return of high-volume deposit days suggests the protocol is once again facilitating exactly the kind of activity that triggered sanctions in the first place. What remains less clear is whether any regulatory body has the appetite — or the legal framework — to act again.
How Tornado Cash Usage Has Evolved Since Delisting
| Period | Approximate Daily Deposits (Avg) | Regulatory Status |
|---|---|---|
| Pre-Sanctions (before Aug 2022) | Varied widely; peaks above 1,000 | Unlicensed but unrestricted |
| Sanctions Period (Aug 2022 – Mar 2025) | Sharply reduced; often below 100 | OFAC-sanctioned |
| Post-Delisting (Mar 2025 – Present) | Steadily rising; 968 peak on July 23, 2026 | Sanctions lifted; developer prosecution ongoing |
The Roman Storm Factor
Developer Roman Storm remains under prosecution in the United States, charged with conspiracy to commit money laundering and sanctions violations. His case has become a bellwether for how far governments can go in holding open-source developers accountable for how their code is used. But the protocol itself, being a set of immutable smart contracts on Ethereum, continues to function regardless of its creator’s legal jeopardy. This decoupling of developer fate from protocol activity is arguably one of the most consequential dynamics in DeFi governance right now.
Storm’s defense has centered on the argument that writing code is protected speech and that developers cannot control downstream usage. Prosecutors counter that the protocol was designed with obfuscation as its primary purpose. The outcome will likely shape how future privacy tools are built — and whether developers choose to build them at all.
Regulatory Fragmentation and What Comes Next
The Treasury’s reversal didn’t resolve the underlying tension. It displaced it. European regulators under MiCA have taken a harder line on mixing services, while jurisdictions in Asia remain inconsistent. Tornado Cash’s smart contract architecture makes geographic enforcement nearly impossible — deposits originate from wallets, not IP addresses, and the protocol enforces no KYC gates.
Still, the 968-deposit spike will not go unnoticed. On-chain analytics firms like Chainalysis and Elliptic have continued to flag Tornado Cash interactions in their compliance dashboards, meaning that funds passing through the mixer carry a forensic trail even if the protocol itself doesn’t collect user data. Financial institutions downstream — exchanges, custodians, OTC desks — face the practical question of whether to accept deposits with Tornado Cash exposure.
That calculus is shifting. Some exchanges have quietly loosened their flagging thresholds since the delisting. Others have not.
Why Privacy Protocols Remain a Structural Feature of DeFi
Dismissing Tornado Cash as merely a tool for bad actors misses a broader architectural reality. Privacy is a design requirement in financial systems, not an optional add-on. Traditional banking achieves it through institutional gatekeeping; decentralized finance achieves it through cryptographic mixing. The demand for on-chain privacy hasn’t diminished — it has, if anything, intensified as blockchain surveillance capabilities have expanded. Every new analytics tool creates a corresponding demand for obfuscation. This is not a moral judgment. It is a market dynamic.
What makes the current moment distinct is scale. The protocol’s busiest day of 2026 didn’t arrive during a major exploit or a panic-driven capital flight event. It arrived on an otherwise unremarkable Wednesday. That normalcy is, in its own way, the most telling data point of all.
Frequently Asked Questions
Why did the U.S. Treasury lift sanctions on Tornado Cash?
The sanctions were removed in March 2025 following sustained legal challenges that questioned whether OFAC had the authority to sanction autonomous smart contracts. The delisting reflected legal and constitutional pressure rather than a policy shift on crypto privacy.
Is Tornado Cash legal to use now?
With U.S. sanctions lifted, interacting with the protocol is no longer a sanctions violation for U.S. persons. However, using it to launder proceeds from criminal activity remains unlawful under existing money laundering statutes. Regulatory treatment varies by jurisdiction.
What does the 968-deposit day mean for the broader crypto market?
It signals that demand for on-chain privacy tools is growing, and that the post-sanctions chill has fully thawed. For compliance teams at exchanges and financial institutions, it means renewed scrutiny of wallet histories involving mixer interactions.
How does Roman Storm’s case affect Tornado Cash?
The protocol operates independently of its developers — smart contracts on Ethereum are immutable once deployed. Storm’s prosecution may influence future developer behavior and regulatory frameworks, but it has had no measurable impact on the protocol’s transaction volume.
