Why crypto's "code is speech" defense keeps losing, and how the Roman Storm retrial shows the industry is fighting the wrong battle on developer liability.
Crypto Developer Liability Won't Be Won With "Code Is Speech"
Roman Storm is walking back into a Manhattan federal courtroom, and his industry is about to bet its credibility on an argument a judge already threw out. Storm — the Tornado Cash co-founder convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business — now faces a retrial on the two charges a jury deadlocked over: money laundering and sanctions evasion. Convicted on both, he is looking at up to 40 years. The live question in crypto developer liability was never whether writing code is a crime. It is whether the industry will finally admit Storm was not just writing code — he was running a business.
Key Takeaways
- Roman Storm was convicted on one count (unlicensed money transmission, up to 5 years) while a jury deadlocked on money laundering and sanctions — prosecutors now want a retrial that pushes exposure to roughly 40 years.
- The "code is speech" defense was rejected before trial; the judge ruled "the functional capability of code does not qualify as free speech protected by the First Amendment."
- The CLARITY Act — which would have codified developer protections in Section 604 — died in the Senate on September 15, 2026, on a 49–50 cloture vote.
- Treasury's own March 2026 report to Congress admits crypto mixers serve legitimate purposes, and DOJ guidance says writing code "without ill intent" is not a crime.
- The real future is "compliant privacy" — association sets, zero-knowledge proofs, shielded DeFi — and the industry is ignoring it to defend a 2019 mixer.
The Bigger Picture: Why crypto keeps losing this war
The Tornado Cash case was never really about privacy. It was about the difference between publishing software and operating a financial service — and crypto has spent four years refusing to admit the difference exists.
Here is the uncomfortable fact the industry will not say out loud: Storm's conviction did not hinge on code. It hinged on conduct. The government's theory — which a jury accepted — was that Storm and his co-founders built a front-end, collected fees, knew North Korea's Lazarus Group was laundering stolen funds through the mixer, and kept running and promoting it anyway. That is not "publishing open-source software." That is operating a business.
The judge said it in plain English before trial even began: "the functional capability of code does not qualify as free speech protected by the First Amendment." The industry heard that and decided the correct response was to shout the slogan louder.
OFAC sanctioned Tornado Cash in August 2022, alleging more than $7 billion in laundered value, including roughly $600 million tied to Lazarus from the Axie Infinity hack. The Fifth Circuit later clipped OFAC's wings on the civil side in December 2024 — but that ruling explicitly did not touch Storm's criminal case. The industry celebrated it as a vindication anyway.
Ripple Effects: Who wins, who loses
If the retrial lands a conviction on laundering or sanctions, the losers are not who you expect. Storm loses, obviously. But the deeper loser is the open-source financial middle layer: every team that runs a front-end, takes a fee, or operates a transaction relayer for a protocol it cannot fully control. They just learned that "I only wrote the code" is not a shield when you also operated the rails.
The winners are the centralized incumbents. Coinbase, Circle, and the licensed exchanges do not publish permissionless code and hope for the best — they hire compliance officers, screen against OFAC lists, and freeze on request. Every headline about a convicted developer makes their "we are the responsible ones" pitch easier. The irony is that Coinbase signed the letter demanding Trump drop the charges against Storm. It is lobbying for a freedom its own business model depends on not needing.
The second-order damage is legislative. The CLARITY Act is dead — cloture failed 49–50 on September 15, 2026 — and the Storm case is a big reason why. The banking lobby used exactly the "no custody, no controls, no responsibility" framing to argue the bill was a money-laundering license. Every maximalist "code is speech" argument made that attack easier to win.
Historical Context: We have been here before
Crypto has run this exact play three times. The first was Ross Ulbricht and Silk Road: the industry argued "it's just a website" and lost, because Ulbricht was running a marketplace, not a protocol. The second was Samourai Wallet, whose founders were sentenced for building a privacy tool prosecutors tied to illicit use. Now it is Storm, running the same script a third time with the same result.
What is different now is that the industry's own government is contradicting itself. Todd Blanche's memo declared the DOJ "is not a digital assets regulator" and warned against criminalizing infrastructure. Treasury's March 2026 GENIUS Act report to Congress admitted mixers have legitimate uses — shielding personal wealth, business payments, charitable donations. FinCEN's 2019 guidance said non-custodial developers are not money transmitters. The industry has the receipts. It keeps choosing the wrong ones to wave.
Why Storm's Google/OpenAI argument doesn't actually save him
Storm's sharpest move this year was pointing at North Korean IT workers using ChatGPT and Gemini, and asking why Sam Altman and Sundar Pichai are not in handcuffs. It is a devastating rhetorical jab. But it is also the exact distinction the industry refuses to see.
Google and OpenAI sell general-purpose tools with compliance teams, law-enforcement cooperation, and OFAC screening. Tornado Cash was purpose-built to sever the chain of custody on funds, and its operators — by the government's telling — declined to build any off-ramp. The analogy does not exonerate Storm; it reveals that the "toolmaker" frame only works when the tool is actually general-purpose. A mixer is not a hammer. It is a vault with no cameras.
Storm is a real person facing real prison, and Vitalik Buterin's January 2026 public letter of support — plus a defense fund that has raised over $6 million — reflects genuine solidarity. Sympathy is appropriate. But sympathy is not strategy, and treating a business operator as a pure speech martyr is how you keep losing.
The Future Lens: Compliant privacy is the answer crypto ignores
Here is the part nobody wants to admit: the privacy problem is already being solved, just not by Tornado Cash. Buterin — the same person defending Storm — spent 2023 co-authoring "Privacy Pools," a design where users prove their funds came from an "association set" that excludes sanctioned addresses. Railgun does shielded DeFi on the same logic. These are privacy rails that give regulators an answer to "how do we catch the bad guys?" — a public exit, a provably clean set, no sanctioned parties.
The tragedy is that the industry's capital and attention are going to a rear-guard legal defense of a 2019 mixer instead of getting FinCEN, the SEC, and the CFTC to bless these compliant-privacy designs. The industry is litigating the past while the future sits unblessed.
Trader's Angle: This is a risk map, not a price call
Forget whether Storm walks. The signal is the regulatory overhang on privacy infrastructure. A broad conviction reprices the entire on-chain privacy sector as legal risk. A dropped case or an appellate reversal opens a bid for the compliant-privacy rails specifically. Watch what institutions do, not what they say: if a licensed custodian or an ETF issuer starts touching Privacy Pools-style rails in the next 12 months, that is the real verdict — and it will matter more than whatever the jury decides.
Closing
Roman Storm may spend the next decade in prison for a tool he built in 2019, or he may walk free and become the movement's greatest martyr. Neither outcome answers the question that actually matters: can crypto build financial privacy that survives contact with the law? The industry keeps betting the answer is "sue harder and scream code is speech." It is a bet it has lost three times in a row. The team that wins will be the one that finally builds a privacy rail a judge can read, understand, and let stand. That is not a courtroom problem. That is an engineering problem — and it has been solvable for years.
FAQ
Was Roman Storm convicted? Yes. In August 2025 a Manhattan jury convicted Storm of conspiracy to operate an unlicensed money-transmitting business, a count carrying up to five years. The jury deadlocked on money laundering and sanctions charges, and prosecutors are seeking a retrial that could push exposure to roughly 40 years.
Is Tornado Cash still sanctioned? Partially. The Fifth Circuit ruled in December 2024 that OFAC overstepped in sanctioning immutable smart contracts, but that was a civil ruling and did not stop the DOJ's criminal case against Storm. The protocol's legal status remains contested.
What does "code is speech" mean and why did it fail? It is the First Amendment argument that publishing open-source code is protected expression. A judge rejected it in Storm's case, ruling the "functional capability of code" is not speech, because the government's case targeted his conduct in operating and promoting the mixer, not the code itself.
What is compliant privacy? Designs like Vitalik Buterin's Privacy Pools and Railgun let users prove their funds come from an "association set" that excludes sanctioned addresses, giving regulators a compliance answer while preserving transaction privacy.
What happened to the CLARITY Act? The bill — which included Section 604 protections for non-custodial developers — died in the Senate on September 15, 2026, when a cloture vote failed 49–50.
For readers who want to dig in: the Free Roman Storm defense fund (freeromanstorm.com (http://freeromanstorm.com)), Vitalik Buterin's Privacy Pools research (vitalik.eth.limo), FinCEN's 2019 virtual currency guidance (fincen.gov (http://fincen.gov)), and the CLARITY Act text (congress.gov (http://congress.gov)).