Roman Storm, co-founder of the cryptocurrency mixing protocol Tornado Cash, posted a direct challenge to the U.S. Department of Justice on Aug. 14, 2026, arguing that the same legal theory used to convict him should, by its own logic, result in charges against Google and OpenAI.
Storm was convicted in August 2025 in the Southern District of New York on one count of conspiracy to operate an unlicensed money-transmitting business. Prosecutors alleged that Tornado Cash, a non-custodial protocol that pools and anonymizes cryptocurrency transactions, facilitated the movement of more than $1 billion in criminal proceeds, including funds tied to North Korean cyber operations.
The trigger for Storm's Aug. 14 post was a separate investigation into North Korean IT workers that found those operatives actively using ChatGPT for writing and coding, and Google Gemini for image forgeries and document alteration. Storm drew a direct line from those findings to his own case. If a developer is liable because bad actors use the tool, he argued, then OpenAI and Google face the same exposure.
"That's exactly the theory behind USA v. Roman Storm: build a neutral tool, bad actors abuse it, and the developer gets prosecuted instead of the criminals," Storm said. "If that logic is absurd for Google and OpenAI — it's absurd for Roman Storm. You prosecute the criminal, not the toolmaker. Writing code is not a crime."
Storm pushed the comparison to its procedural end, calling for investigators to apply the DOJ's own methods to both companies. "So let's be consistent: subpoena every Google and OpenAI employee. Dig through their text messages for any hint they knew their tools were used by DPRK. Indict them for 20 years in prison on IEEPA charges," he said, referencing the International Emergency Economic Powers Act — the same statute used to sanction Tornado Cash's smart contracts.
The IEEPA charges Storm referenced carry up to 20 years in prison. The DOJ's case rested in part on the argument that Storm knew his protocol was being used for illicit transfers and continued to develop and profit from it anyway, a theory that Storm's defense contested throughout the SDNY trial on the grounds that Tornado Cash is non-custodial — meaning Storm and his co-founders never held or controlled user funds.
The Tornado Cash case has sat at the center of a broader debate about developer liability in the United States since the U.S. Treasury's Office of Foreign Assets Control first sanctioned the protocol's smart contract addresses in August 2022. The Treasury Department subsequently removed those sanctions following a legal review, but the criminal conviction against Storm stands separately from the sanctions question and remains the live issue for the developer community.
Storm's argument connects directly to pending legislation. The Digital Asset Market Clarity Act — the CLARITY Act — includes provisions that would separate software developers from liability for illicit third-party use of their protocols. Those protections would address precisely the legal theory Storm was convicted under. The CLARITY Act is a market-structure bill that defines which digital assets fall under SEC jurisdiction as securities and which fall under CFTC jurisdiction as commodities; the developer-liability carve-out is embedded within that framework.
A vote on the motion to proceed to the CLARITY Act's final consideration is scheduled, but the odds of passage remain low. The proximity of the midterm elections and unresolved disagreements within Congress have stalled the bill's path forward.
For Storm personally, the CLARITY Act arriving too late changes nothing about his conviction. His case already set the legal precedent he warns against: a developer whose neutral tool is misused by third parties can be held criminally liable in U.S. federal court. That outcome has no legislative fix retroactively.
The North Korean IT worker investigation Storm cited adds a factual layer the DOJ cannot easily dismiss. Both ChatGPT and Google Gemini are subscription products — meaning OpenAI and Google collect revenue from paying users, a portion of whom, by the terms of Storm's argument, are sanctioned foreign nationals advancing a weapons program. Storm's framing is deliberate: the DOJ's theory, applied uniformly, reaches Silicon Valley's largest AI companies as easily as it reaches a crypto protocol developer in New York.
