In the wake of the legal battles surrounding Tornado Cash developer Roman Storm, a critical question hangs over the decentralized finance (DeFi) space: Can developers be sure they won't face charges for building non-custodial protocols?. Storm himself has voiced this concern, directly asking DeFi developers, "How can you be so sure you won't be charged by the DOJ as a money service business for building a non-custodial protocol?".
Storm's question arises from his own experience. He was convicted in August 2025 on one count of conspiracy to operate an unlicensed money transmitting business. The jury deadlocked on charges of conspiracy to commit money laundering and conspiracy to violate U.S. sanctions. Prosecutors alleged that Tornado Cash facilitated over $1 billion in money laundering transactions, including millions for the Lazarus Group, a sanctioned North Korean hacker group. Storm's defense argued that Tornado Cash was immutable software beyond his control once deployed. He maintains that he created the protocol to provide privacy on Ethereum and other blockchains.
The conviction of Storm sent shockwaves through the crypto community, with many legal observers expressing concern that it could set a "dangerous" precedent for developers and digital privacy. Critics argue that holding developers liable for the misuse of their code by others misapplies money transmitter laws. The DeFi Education Fund, a crypto advocacy firm, stated that developers of non-custodial, peer-to-peer protocols do not exercise control over user assets and should not be considered money transmitting businesses.
In an effort to address these concerns, the Department of Justice (DOJ) has clarified its policy on prosecuting DeFi developers. Acting Assistant Attorney General Matthew Galeotti stated that the DOJ will not pursue criminal charges against developers building decentralized platforms in good faith, without intent to enable criminal activity. He emphasized that "merely writing code without ill intent is not a crime" and that the focus remains on intent, not merely the outcome of code deployment. Galeotti added that new money transmission charges against a third party will not be approved where the evidence shows that software is truly decentralized and solely automates peer-to-peer transactions, and where a third-party does not have custody and control over user assets.
This clarification has been welcomed by some in the crypto community. Amanda Tuminelli, executive director of the DeFi Education Fund, said that the DOJ acknowledged that software developers should not be held responsible for third parties' misuse of their code. Katie Biber, chief legal officer at crypto venture firm Paradigm, stated that the uncertainty has ended, with an emphatic statement from the DOJ that shipping code is not a crime.
However, some remain cautious. Peter Van Valkenburgh, head of Coin Center, called the DOJ's statement "a little late" for Storm's case and questioned how the Justice Department would act during the developer's appeal. He also expressed concern about the "criminal intent" caveat and noted that the official's words do not carry binding legal force. A DOJ representative emphasized that the new policy is not retroactive, meaning it will not affect Storm's sentence.
Despite the DOJ's clarification, Storm's question continues to resonate within the DeFi community. Developers must assess illicit finance risks, take proactive measures where control exists, and have clear plans to respond to criminal activity. The DOJ's stance makes it clear that developers who knowingly create tools to support fraud, money laundering, or sanctions violations remain at risk of prosecution. The focus remains on intent, not merely the outcome of code deployment. It remains to be seen how these principles will be applied in practice and whether they will provide sufficient clarity and protection for DeFi developers.
Storm's case highlights the ongoing tension between fostering innovation in the crypto space and preventing the misuse of decentralized technologies for illicit purposes. As the legal landscape continues to evolve, DeFi developers must carefully consider the potential risks and take steps to ensure they are building and deploying their code responsibly.
