Blockchain Frontier

In the summer of 2022, crypto holders around the world opened their digital wallets and felt a collective gut punch.

A shadowy band of hackers known as the Lazarus Group—a group the FBI suspects is backed by North Korea and has stolen billions of crypto to date—had made off with hundreds of millions of dollars’ worth of Ether, a cryptocurrency similar to Bitcoin.

This time, Lazarus’ target was Horizon Bridge, a tool for transferring cryptocurrency across different platforms. By compromising the bridge, they were able to siphon off funds mid-transit.

But stealing the Ether was only the first step. The next challenge was figuring out what to do with it.

Cashing out was far too dangerous. Like Bitcoin, every Ether transaction is recorded on a decentralized public ledger called a blockchain—permanent, transparent, and secured
by cryptography. A giant notebook that nobody can erase or change, the blockchain provides the underlying infrastructure for cryptocurrencies, digital money that people can trust is real—and hasn’t been spent twice—because every transaction is recorded. In recent years, the FBI has gotten increasingly savvy at tracing, and even seizing, stolen crypto via the blockchain itself.

But that’s where Tornado Cash came in.

Launched in 2019 by a group of privacy-focused coders, Tornado Cash was built to scramble transaction histories. Its algorithm pools different users’ Ether, mixes up the funds and then redistributes them. The anonymizing tool can help protect crypto holders concerned about targeted threats from repressive regimes or kidnappers. But it also thwarts investigators in their attempts to follow the money trail.

The Lazarus Group turned to Tornado Cash to launder their crypto haul. But the U.S. government quickly moved to shut it down. In an unusual step, the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, accusing it of helping to launder the more than $455 million obtained by the state-sponsored hack. Americans were banned from using the tool—including those who might wish to use it for legitimate purposes, such as to safeguard their financial history, which is otherwise publicly visible on the blockchain.

But there was a snag: Tornado Cash wasn’t a company or a person. It was code—a fully decentralized application governed by a “Decentralized Autonomous Organization,” or DAO, and executed by self-operating smart contracts on the blockchain. It was self-controlling software. No one, it seemed, was in charge.

So who exactly was the U.S. government sanctioning?

The question of where the buck stops when it comes to decentralized technology is an increasingly urgent one—not least because the stakes now extend far beyond cybercrime. For many, blockchain still conjures images of scams, speculation and money laundering. But the internet is changing, and the blockchain is becoming mainstream. To its proponents, the technology even heralds the start of a third internet era—Web3—defined by decentralized control and user ownership beyond the control of tech companies.

“In the first era of the internet, you could only read content. Then came social media, where you could create it—but the platforms owned it,” says Jordan Hatcher ’05, an international technology lawyer and co-founder of The Grid, a Netherlands-based Web3 startup. “But with Web3, you can read and you can write—but you also own.”

From finance and logistics to potential applications in the legal field, blockchain’s legitimate uses are indeed multiplying. And the appeal is clear. At its core, blockchain offers immutable, verifiable records—a powerful asset in industries built on trust.

In 2020, JPMorgan, the world’s biggest bank, launched Onyx (now rebranded as Kinexys), a proprietary blockchain for settling complex payments. The following year, Europe’s largest seaport, the Port of Rotterdam in the Netherlands, adopted a blockchain technology for streamlining goods through customs. And Walmart has developed a blockchain for tracking food products in its supply chain from farm to shelf.

Governments on both sides of the aisle are getting involved, too. In 2022, President Biden issued an executive order opening the door to a possible U.S. central bank digital currency. Meanwhile, in May, Texas Governor Greg Abbott signed Senate Bill 21, making Texas the second U.S. state—after New Hampshire—to establish a Bitcoin reserve. Two months later, President Trump signed the GENIUS Act, which provides a regulatory framework for stablecoins, a kind of cryptocurrency pegged to stable assets like the U.S. dollar.

Beyond finance and logistics, the blockchain seems set to expand into other corners of everyday life. Instead of handing over sensitive personal information to prove who you are, people could instead carry a secure credential on their phone that could be instantly verified against the blockchain to prove its authenticity, without any personal data ever being shared. The technology could even make it impossible to duplicate or counterfeit tickets for events, such as concerts. “Just think of any use case where having a record that everybody can agree is factually correct is useful. That,” says Hatcher, “is a use case for blockchain.”

Infrastructure like Hatcher’s The Grid could help pave the way to this future. By making Web3 more navigable, it hopes to enable the shift from niche technology to norm. “The key moment in the adoption of this technology will be when people are using the blockchain a lot, whether to prove your identity online or to make online payments, but without ever realizing it,” says Hatcher, who believes that moment is fast approaching.

Web3 is still a digital frontier. A chaotic marketplace of disconnected services, some platforms let users monetize their personal health data, while others offer decentralized financial services in parts of the world with unreliable banking. But without a clear way to sort through all these offerings, navigating Web3 feels like using the internet before Google.

The mission of The Grid, which Hatcher co-founded in 2023, is to build the infrastructure for the decentralized online economy of the future, allowing it to go mainstream at last. “We’re kind of like the Yellow Pages for Web3,” says Hatcher. “If you’re trying to navigate the space and figure out who’s building what, where, and why, you need that kind of directory.”

Kevin Frazier, the first-ever AI Innovation and Law Fellow at Texas Law, agrees that Web3 still lacks the underlying framework that will allow it to go big.

“Imagine we’re at the beginning of the twentieth century and the car had just been invented. I’m on horseback, and I ask you: ‘Would you rather race me in a car or on a horse?’ Maybe you say: ‘I’ll hop in the car, no problem.’ But back then, we didn’t have the roads that could handle cars. We had no stop lights, no norms around how to drive. So the horse would still be a better bet,” says Frazier. “That’s where we are right now with Web3.”

But Web3 has too much potential to stay on the fringes for long. For those savvy enough to find their way through the maze at this early stage, it’s already changed the web for the better.

Take Audius, a blockchain-based alternative to Spotify and Apple Music which boasts more than 7 million users. Audius connects musicians directly to fans, cutting out corporate intermediaries. Songs aren’t hosted on central­ized servers but on a distributed, community-run network. Meanwhile, digital assets called non-fungible tokens (NFTs), which function as blockchain-backed certificates of authenticity, are offering artists new ways of monetizing their creations.

“By allowing people to digitally own and control their work,” says Hatcher, “the blockchain can empower creators.”

And yet the legal implications of Web3 go deeper than tools and workflows. There are signs that Web3 could also force courts and policymakers to adapt core legal concepts to a new world where traditional ways of assigning liability and imposing accountability are obstructed by autonomous software. And some commentators see the Tornado Cash case as a blueprint for what’s to come.

When the Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, it became illegal for U.S. persons to deal in the “property and interests in property” of Tornado Cash. To online-privacy advocates, though, this was nonsensical. Tornado Cash was comprised of self-executing code. The government’s move, they said, was akin to outlawing a math formula. And the U.S. Court of Appeals for the Fifth Circuit agreed.

Reversing the decision of the Texas district court, a three-judge panel in Van Loon v. U.S. Department of the Treasury (2024) found that Tornado Cash’s code wasn’t “property” under
the International Emergency Eco­nom­ic Powers Act. OFAC had overreached its statutory authority. Tornado Cash, a collection of self-executing smart contracts, was not a sanctionable entity. The Fifth Circuit remand­ed the case to the district court. Meanwhile, in response to the appeal court’s finding, OFAC removed its sanctions against Tornado Cash.

The decision bodes well for the growth of Web3. “I find it encouraging,” says Whyte, who expects a slew of similar cases over the coming years in which courts have to adapt to this new frontier.

“For lawyers, it’s going to get really interesting,” continues Whyte, who worked at a blockchain consulting company as a general counsel before joining his current firm. “If you’re trying to build a flat hierarchy—where no one person is in charge—how do you decide who’s ultimately responsible?”

That concern doesn’t appear to trouble prosecutors. Although the U.S. Treasury was unable to uphold its sanctions against the entity itself, in 2023 the Manhattan U.S. attorney charged Tornado Cash’s co-founder, Roman Storm, with laundering more than $1 billion in stolen proceeds. At his trial this summer, the jury found Storm guilty only of operating an unlicensed crypto business. They deadlocked on money laundering.

It is a stark reminder that even if blockchain can circumvent some rules of enforcement, governments have many tools at their disposal to hold novel technologies to account.

“I think a lot of these decentralized projects want to have their cake and eat it too,” says Whyte. “They want the cohesion and momentum of a corporate structure, with everyone pursuing a shared vision. But when something goes wrong, they claim to be fully decentralized. And governments aren’t going to let them get away with that little dance.”

Still, Whyte notes, the flight of the blockchain’s most committed cyberlibertarians to obscure, privacy-focus­ed platforms like Tornado Cash may be the clearest sign yet that Web3 is set to move from the fringes to the mainstream, fundamentally transforming how ordinary people manage their data, their contracts, their money, and their digital lives.

“The most bullish case,” says Whyte, “is that this technology will cause unprecedented, foundational change.”