Washington sent two messages about crypto privacy in the same week.
Treasury told Congress that lawful users of digital assets may leverage mixers to protect personal wealth, business payments, charitable donations, and consumer spending habits from public view on transparent blockchains.
Days later, SDNY prosecutors filed a letter proposing to retry Tornado Cash co-founder Roman Storm in October 2026 on the two counts where jurors deadlocked last August: conspiracy to commit money laundering and conspiracy to violate sanctions. Each count carries a maximum of 20 years.
The policy thaw is real. It may just stop where privacy tools begin.
For retail investors, what matters is if markets have priced the shift in Washington’s crypto posture correctly. The evidence suggests they may not have.
| Government action / statement | What softened | What stayed hardline | Investor takeaway |
|---|---|---|---|
| Treasury delists Tornado Cash (Mar. 21, 2025) | Sanctions posture eased; Washington acknowledged the legal and policy complexity around applying sanctions in an evolving technology environment | Treasury still said it remained deeply concerned about DPRK-linked hacking and laundering | Delisting did not mean privacy infrastructure was broadly de-risked |
| DOJ memo ending “regulation by prosecution” (Apr. 2025) | DOJ said it would stop targeting exchanges, mixers, and wallets for the acts of end users or unwitting regulatory violations | DOJ preserved priority treatment for cases involving sanctions, hacking, terrorism, organized crime, and sanctioned states | The policy thaw looks real for some crypto sectors, but not for the national-security bucket |
| Treasury report to Congress (Mar. 2026) | Treasury explicitly acknowledged that lawful users may use mixers for financial privacy | The same report highlighted mixer-linked illicit flows and recommended stronger tools, including a possible “hold law” to freeze suspicious assets temporarily | Privacy use is being acknowledged, but privacy infrastructure is still being framed as a live enforcement risk |
| SDNY retrial push on Roman Storm (Mar. 2026) | No visible softening in this step | Prosecutors want another shot on the money-laundering and sanctions counts, the two counts most aligned with the government’s preserved hardline priorities | Privacy-adjacent projects still appear to sit in a different legal-risk bucket from the rest of crypto |
| Overall Washington message | Friendlier posture toward mainstream crypto market structure, payments, and infrastructure | Continued aggressiveness where privacy tools can be linked to sanctions evasion, laundering, or North Korea | Investors should stop treating “pro-crypto policy” as a single uniform discount across the whole sector |
What the jury left unresolved
Last August’s verdict was a split decision that clarified almost nothing.
The jury convicted Storm on the unlicensed money-transmitting count, which carries a maximum of 5 years, but deadlocked on the money-laundering and sanctions counts.
Prosecutors now want those two counts retried, with a proposed start date around Oct. 5 or Oct. 12 and an expected three-week run. Storm’s Rule 29 motion for acquittal also argues that the evidence was insufficient on the convicted count, and that argument will be presented to a judge on Apr. 9.
The distinction between the counts matters for anyone trying to read this case as a policy signal.
DOJ’s April 2025 memo, the one that declared an end to “regulation by prosecution,” said the department would stop targeting exchanges, mixers, and wallets for the acts of end users or unwitting regulatory violations.
That language fits awkwardly around the unlicensed-transmission count, where the theory of liability is closest to holding a developer responsible for running infrastructure.
It fits less awkwardly around money laundering and sanctions, where prosecutors can argue Storm knew specific illicit activity was flowing through the protocol and continued anyway.
The government is retrying the counts it chose to keep, rather than the one that most directly conflicts with its own stated policy evolution.
The real limits of the thaw
Treasury delisted Tornado Cash on Mar. 21, 2025, citing “novel legal and policy issues” raised by the sanctions regime in an “evolving technology and legal environment.”
DOJ disbanded its crypto enforcement unit and narrowed its prosecution priorities, resulting in a major reduction in the department’s crypto posture. None of that is theater.
The administration deliberately chose to pull back from the broadest definition of crypto legal risk.
However, Treasury’s delisting statement did not arrive alone.
The same document said Treasury remained “deeply concerned” about DPRK-linked hacking and money laundering. It warned US persons to exercise caution when dealing with transactions that may benefit North Korean cyber actors.
DOJ’s memo preserved priority treatment for cases involving terrorism, organized crime, hacking, and sanctioned states. The administration narrowed the target, it did not eliminate it.
Storm’s remaining exposure sits precisely in the preserved bucket: laundering and sanctions, with prosecutors arguing the protocol was used as infrastructure for North Korea-linked theft proceeds. Treasury’s March 2026 report to Congress adds the sharpest numbers to that story.
Since May 2020, bridges on public blockchains received roughly $1.6 billion in deposits originating from mixing services. More than $900 million of those mixer-originated deposits flowed into a single bridge that faced scrutiny for failing to intervene in DPRK-linked laundering activity.
Treasury acknowledged lawful privacy uses in the same document while also recommending that Congress consider a new “hold law” that would give institutions a safe harbor to freeze suspicious digital assets during short-term investigations.
The report that validated mixer privacy is also the one asking for stronger tools to freeze suspected mixer flows.
What investors are likely mispricing
The market narrative around US crypto policy has largely been a single theme: the administration has become friendlier, the legal overhang has receded, and the sector deserves a lower-risk discount.
That framing holds reasonably well for the parts of crypto Washington is actively trying to normalize, such as exchange regulation, ETF infrastructure, stablecoin payment rails, and mainstream market structure.
It holds less well for anything that can be narrated through privacy, obfuscation, and sanctions evasion.
The developer-liability question cuts directly to the point. Post-verdict legal analysis argued that the mixed outcome leaves substantial uncertainty for builders of decentralized privacy-preserving platforms, noting that the jury was not persuaded by arguments that Storm lacked sufficient control over who used the protocol.
The case suggests that “decentralized” and “non-custodial” provide less legal insulation than the market often assumes, particularly when there is evidence of continuing business activity, fee collection, governance involvement, or promotion.
Prosecutors can use any of these factors to argue that the developer maintained meaningful operational contact with the protocol.
For a retail investor holding tokens tied to privacy protocols, mixer-adjacent infrastructure, or any project whose team could face the argument that they knew illicit activity was flowing through their software, the Storm case suggests those assets carry a legal risk premium that a broadly “pro-crypto” administration does not automatically eliminate.
The contradiction that clarifies
The most useful thing about the Treasury’s lawful-privacy acknowledgment, next to SDNY’s retrial push, is that it reveals where the line is.
Washington appears willing to say that privacy tools can be legitimate, that mixers serve lawful purposes, and that developers should not be prosecuted for what users do with neutral infrastructure.
It is less willing to drop cases where prosecutors believe the developer knew about specific illicit flows, continued operating, and where those flows connect to North Korea.
It frames privacy as potentially lawful unless the government can also tell a national-security story.
For markets, that distinction matters more than the headline policy shift. The bull case for Storm is that his Rule 29 motion succeeds, DOJ backs away from the retrial, and Treasury’s lawful-privacy language matures into a clearer developer safe harbor.
The bear case is that the retrial proceeds, prosecutors win on one or both deadlocked counts, and the market relearns that the privacy-adjacent sector carries durable legal exposure that “friendlier” rhetoric did not actually resolve.
Neither outcome changes the core lesson: legal clarity in crypto is becoming sector-specific. Investors who treat the policy shift as a uniform discount across the market may be applying it to assets where the government’s own posture, in its own documents, says the fight is not over.
