Question:

Tornado Cash is in the news due to the sanctions imposed by the US government and the freezing of $75K of USDC from Circle. The addresses tied to the service have been publicly posted online. (Hint: we also have them in our crosschain address labels table as well).

Overview of essay:

According to the news, the US governance announced the sanctions related to the Virtual Currency Mixer Tornado Cash.

In this essay, the detailed analysis of addresses that participated on Tornado Cash before and even After sanctions have been studied.

The addresses that interacted most with the Tornado Cash have been identified. Also, the behavior of these addresses by their actions before and after sanctions have been determined.

Additionally, the currencies that used in the Tornado Cash have been investigated and the impacts of sanctions on their usage have been estimated.

Finally, the participants have been grouped by their frequency and volume of usage into various buckets to underestimate their most highlighted features.

What is Tornado Cash?

Tornado Cash was created with the aim of solving the privacy problem of blockchains through the use of private transactions. It's not a platform like Samourai and Wasabi because it combines coins in a slightly different way, but ultimately, TornadoCash has the same goal of keeping financial transactions private.

Tornado Cash (TORN) is a decentralized privacy solution built on Ethereum. While Tornado Cash was developed based on open source research by the Zcash team (one of the privacy coins), the protocol allows users to send ETH and ERC-20 deposits through its smart contract service.

After sending an ETH or ERC-20 deposit to TornadoCash, you can withdraw your cryptocurrency via a new address. When the asset is withdrawn by the new address, there is no way to link the withdrawal to the deposit, which in turn ensures the privacy of the asset.

The TORN protocol is community-owned, in May 2020 the TornadoCash team relinquished control of the protocol's multisig wallet through a contract update known as the Trusted Setup Ceremony. Since then, the founders have no control over TornadoCash and it is considered a fully decentralized protocol.

To achieve privacy, TornadoCash uses smart contracts that accept crypto deposits from one address and allow withdrawals from another address. These smart contracts act as pools that combine all deposited assets.

What is Tornado Cash sanctions?

Tornado Cash is a mixer, a protocol designed to pool funds in an effort to obfuscate the origin of any given transaction on Ethereum blockchain.

> “Today, Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. > > Tornado Cash was subsequently used to launder more than $96 million of malicious cyber actors’ funds derived from the June 24, 2022 Harmony Bridge Heist, and at least $7.8 million from the August 2, 2022 Nomad Heist.

This part exactly quoted from the official website of U.S. DEPARTMENT OF THE TREASURY.

As can be seen, the main reason of these sanctions is money laundry application of this mixer.

This sanction has been taken place on site August 8, 2022 and the sanction date considered as it.

Approach:

To handle this investigation, the Data provided by Flipside community has been adopted, accordingly.

The data related to address of Tornado cash have been shown by crosschain.address_labels with project name 'tornado cash' on Flipside. The rest of the analysis have been done by application of these addresses on ethereum.core.fact_event_logs and ethereum.core.fact_transactions:

• Most of the parts executed on fact_event_logs.

• Currencies identified by joining ez_token_transfers table.

• Group related to frequency:

  when total_trnasactions<2 then '1 transaction' when total_trnasactions between 2 and 5 then '2-5 transactions' when total_trnasactions between 5 and 10 then '5-10 transactions' when total_trnasactions between 10 and 20 then '10-20 transactions' when total_trnasactions>=20 then 'Above 20 transactions'

• Group related to volume:

  when currency_usage<10 then '1. Below 10 USD' when currency_usage between 10 and 100 then '2. 10-100 USD' when currency_usage between 100 and 1000 then '3. 100-1000 USD' when currency_usage between 1000 and 10000 then '4. 1000-10000 USD' when currency_usage>=10000 then '5. Above 10000 USD'

Part 1 : Before and after Sanctions

Notable findings:

The notable findings related to the participants before and after sanctions are:

• The number of participants and transactions count have been enhanced after Sanction as shown.
• The ETH value of transactions related to Tornado Cash has been reduced dramatically.
• After Sanctions, the most interacted participant has near 300 interactions with Tornado crash and stands in the first place.
• On the one year analysis before sanctions, the most applicated participant got over 6000 transactions.
• The most popular action on Tornado cash before sanctions are Transfer, approval and deposit. But after sanctions claiming rewards takes the third place as can be seen.

Notable findings:

The most used currencies on Tornado cash based on number of transactions, participants and volume of interaction in USD reveals the following consequences:

• The volume of application WETH has been increased dramatically after sanctions.

• From other aspects we did not see any notable change on application of currencies on Tornado cash.

• According to the List of US government, the cureency of banned addresses are mostly ETH and USDC. For this purpose analyze the daily application of these currencies.

• From the daily graphs, the usage of WETH after sanctions has been enhanced but on August 10 the volume of USDC application increased considerably as can be seen.

• From other aspects, the usage of WETH enhanced.

  
  \

In this part use the grouping of addressed participated on Tornado cash based on the frequency and volume of participation. The findings have been obtained as:

• Most of the participants has 1 transaction on Tornado cash about 54.4% of participants.
• The interesting part belong to the volume of application. As can be seen, most of the applicants have over 10000 USD interaction with Tornado Cash and it can be concluded that the users has put lots of money on this mixer.

References and useful links:

• Related news 1: U.S. DEPARTMENT OF THE TREASURY
• Related news 1: Routers
• Tornado Cash

Author:

Credited by MZG

Discord handle: m.zamani#0361

Twitter handle: @GargariZamani