ARTICLE
30 October 2024

Restaking And The Evolution Of Blockchain Security

CG
Cahill Gordon & Reindel LLP

Contributor

With a history of legal innovation dating back to the firm’s founding in 1919, Cahill Gordon & Reindel LLP is trusted by market-leading financial institutions, companies and their boards to manage significant litigation, regulatory matters and transactions. The firm is based in New York with offices in London and Washington, D.C.
Blockchains" are networks of computers running the client software of the blockchain (known as "nodes") operated by persons unknown to each other that are able to maintain...
United States Technology

"Blockchains" are networks of computers running the client software of the blockchain (known as "nodes") operated by persons unknown to each other that are able to maintain identical copies of a common ledger, the "state" of which is constantly updated through the acceptance and processing of a set of valid user instructions (known as a "block"). Transactions in decentralized blockchain networks are validated by nodes, and the process by which those validator nodes reach agreement on the transactions that will be added to the next block is determined by the consensus mechanism of the network.

What allows users and the general public to rely on the accuracy of the ledger maintained by a given blockchain network is the economic security associated with that network. This economic security is designed so that "attacking" or attempting to corrupt the ledger with "double-spend" or other invalid instructions (or "transactions") is substantially more difficult and expensive than any economic gain that may come from that attack. Commonly referred to as "Sybil resistance," it requires validator nodes to put value at risk in connection with transaction validation to incentivize honest validation.

The very first blockchain network, Bitcoin, used a system that required the costly expenditure of real-world assets (known as "mining") to ensure that all participating nodes respond to user instructions in a manner consistent with the network's rules (or "protocol"). This system of creating economic security came to be known as "proof-of-work" ("PoW"). While subsequent blockchain networks used some variation of PoW, other networks began to experiment with other systems for ensuring network security.

The Ethereum blockchain network launched in 2015 using a variation of PoW to provide network security. However, in September 2022, the Ethereum network officially transitioned to a different system of network security, known as "proof-of-stake" ("PoS"). A PoS consensus mechanism requires network nodes acting as "validators" of proposed user transactions to put economic value at risk (known as "staking") to ensure that the validator is available when needed and acts in accordance with protocol rules. This is generally achieved by requiring the validator to commit crypto assets they control that may be confiscated or "slashed" in the event that the validator goes offline or attempts to add transactions to a block that do not comply with the rules of the network.

Ethereum PoS requires node operators to stake a minimum of 32 ether, the native crypto asset of the Ethereum network (known as "ETH"), in order to validate transactions. To incentivize node operators to participate in this process, those acting as validators receive economic "rewards" when they are selected to update the network ledger by adding a block of validated transactions. These rewards are in the form of newly created ether tokens, which effectively reallocates the ownership of the Ethereum network away from owners of ether tokens who do not participate in staking (and who are accordingly diluted by the newly created tokens allocated to others) and toward those who do participate in validation. The more nodes that participate in transaction validation, the more economic value is committed to the Ethereum network, resulting in the network being more secure and less susceptible to a range of vulnerabilities and "attack vectors."

In addition to Ethereum, there are a number of blockchain networks with PoS consensus mechanisms, including Solana, Cardano, Avalanche and many others. This chapter discusses staking based on the Ethereum network for illustrative purposes, but similar issues are applicable to other PoS blockchain networks.

Because staking inherently involves an allocation of capital to the validation process, since the migration to PoS, we have seen the Ethereum community continually striving to optimize this allocation of capital. This process has resulted in the development of a number of different mechanisms, including staking pools, liquid staking protocols (which emit "liquid staking tokens" or "LSTs") and, most recently, "restaking," which is a mechanism that allows those users who have already committed capital to the Ethereum network in one way or another to use that staked capital to secure other networks or services provided by others. This allows those participating in restaking to earn greater rewards from this capital (thus reducing their capital cost) while taking on additional slashing risk (i.e., the risk of loss of their capital).

1 Liquid staking tokens

As PoS consensus mechanisms gain adoption as a means to efficiently and effectively provide security for blockchain networks, liquid staking protocols (such as Lido and Rocket Pool) have become popular. These protocols allow users to contribute fewer than 32 ETH to a staking pool and participate in validation and earn rewards. Users that contribute ETH to a liquid staking protocol receive LSTs in return in an amount that corresponds to the amount of ETH they contribute. The liquid staking protocol then allocates ETH contributed by users to Ethereum validators.1 As of August 24, 2024, the total value of assets committed (or "locked") in liquid staking protocols exceeds $45 billion.2

Through these protocols, users are able to contribute fewer than 32 ETH and still participate in securing the underlying blockchain network. As a result, these users are also able to receive their ratable share of validation rewards (subject to fees allocated to the "treasury" of the liquid staking protocol). Participating users receive a new crypto asset known as a "liquid staking token" (for example, "stETH" in the case of the Lido protocol). Ownership of an LST allows the user to claim back an equal number of ETH from the liquid staking protocol. The owner can also use these LSTs to participate in other on-chain activities. Ultimately, users may choose to "unstake" by sending the LSTs back to the liquid staking protocol to withdraw ETH from the protocol.

There are two different types of LST – rebasing tokens (such as stETH) and non-rebasing tokens (such as rETH). The total number of rebasing tokens in circulation increases based on the amount of staking rewards earned by the liquid staking protocol, and additional LSTs are allocated to users that have staked ETH to the protocol when staking rewards are earned. This design is intended to allow rebasing tokens to have a relatively stable price per token even as the total supply increases due to rewards. In contrast, non-rebasing tokens accrue additional value from staking rewards directly such that the value of the LST itself automatically increases as staking rewards accumulate without affecting the quantity of their LSTs. In this case, the total number of LSTs in circulation remains constant while the price of the token will move (reflecting the accrued staking rewards).

Participation in liquid staking protocols is not risk-free. Like any other smart contract protocol, liquid staking protocols may have vulnerabilities and may be exploited by hackers. Separately, network validators stake the ETH committed by liquid staking participants in connection with performing validation tasks, and those staked amounts are subject to slashing penalties if the validator goes offline or otherwise attempts to validate transactions that do not comply with the rules of the network.

2 Restaking

In 2023, an Ethereum-based protocol called EigenLayer introduced the concept of "restaking." Restaking allows assets staked by Ethereum validators to also be used to secure other applications or networks (known as Actively Validated Services or "AVSs") built on Ethereum. AVSs that leverage restaking benefit from the thousands of validator nodes participating in transaction validation and contributing to the security of the Ethereum network.3 This innovation helps new blockchain-based projects bootstrap security by reutilizing capital already committed to the Ethereum network.

More specifically, EigenLayer provides two options for restaking: native restaking (i.e., using ETH that has been staked with a validator that the user controls); and liquid restaking (i.e., using LSTs, as discussed above).4 After being registered within EigenLayer, any Ethereum address can serve as an EigenLayer operator. An EigenLayer operator facilitates the delegation of staked ETH or LSTs to AVSs through the EigenLayer application to secure selected AVSs. EigenLayer operators can either stake their own staked ETH or LSTs or allow users to delegate their staked ETH or LSTs to them to validate transactions on AVSs, thereby contributing to the security and integrity of the AVSs. Users that hold either staked ETH or LSTs first place their assets with EigenLayer, then delegate select amounts of assets to one or more EigenLayer operators to secure specific AVSs. While contributing to the security of various AVSs, users can earn rewards from those AVSs (subject to fees charged by the operator), in addition to rewards for securing the Ethereum network.

Restaking has expanded beyond Ethereum to other PoS networks. It achieves greater capital efficiency of the staked assets and extends the security model of the underlying layer-1 PoS network, such as Ethereum, across a suite of AVSs. However, restaking also introduces risks – similar to Ethereum validators, EigenLayer (or other restaking protocol) operators risk losing their stakes if they go offline, act maliciously, or otherwise fail the validation tasks, and thus users' staked assets are subject to loss. In addition, from a technological perspective, the various layers of smart contract protocols involved give rise to additional vulnerabilities.

3 Liquid restaking

Similar to the concept of liquid staking, with the increasing popularity of restaking, another type of protocol known as "liquid restaking," built on top of restaking protocols, has evolved. As of August 24, 2024, the total volume of assets committed (or "locked") in liquid restaking protocols has reached over $11 billion.5

Prior to the introduction of liquid restaking protocols, if an ETH holder did not hold 32 ETH but wished to participate in validating both the Ethereum network and AVSs, it had to first transfer its ETH to a liquid staking protocol (such as Lido) in exchange for LSTs (such as stETH, in the case of Lido) and then restake those LSTs with a restaking protocol (such as EigenLayer) and, via EigenLayer, delegate its LSTs to select EigenLayer operators to validate AVSs. Without liquid restaking, the user's staked position is committed to EigenLayer and can only be withdrawn by the user.

With liquid restaking protocols (for example, Ether.Fi, Renzo, and Puffer), an ETH holder can skip the steps above and instead transfer its ETH to a liquid restaking smart contract in exchange for liquid restaking tokens ("LRTs") (in the case of Ether.Fi, "eETH"), which accrues staking rewards from securing both the Ethereum network and AVSs, as the restaking protocol automatically restakes the staked assets with EigenLayer.6 Specifically, eETH is a rebasing token (as discussed above), so for any eETH holder, its balance of eETH holding changes as staking and restaking rewards are earned via the Ether.Fi protocol. In addition, restaking protocols may separately provide loyalty points to users to incentivize them to use one restaking protocol over another.

Similar to LSTs, LRTs can be used by their holders in decentralized finance ("DeFi") applications while still allowing users to benefit by receiving rewards from participation in securing multiple networks. Despite the capital efficiency enabled by liquid restaking, additional risks ensue – for example, it is possible that the use of LRTs as collateral in decentralized lending markets leads to a cascade of liquidations across protocols (as discussed below).

4 Depegging risks

LSTs and LRTs are widely used in DeFi applications. As an example, an ETH holder may first stake its ETH by sending it to the Lido staking pool in exchange for stETH, then use stETH as collateral in a DeFi lending protocol (such as Aave) and borrow ETH from a lending pool on Aave, before using the borrowed ETH to acquire more stETH, and so on. Although, by doing so, the user can earn multiples of the ETH staking rewards, the leveraged positions are inherently risky.

During the crypto market collapse in 2022, the price of stETH deviated significantly (or "depegged") from the price of ETH as selling pressure on stETH intensified. As the price of stETH dropped, since many DeFi protocols allow users to use stETH as collateral for borrowing ETH, ETH borrowers on DeFi platforms were liquidated and their stETH was automatically sold on the open market. This further increased the selling pressure on stETH and led to more liquidations of stETH and a further decline in the price of stETH.7

Similar events happened to LRTs recently. "ezETH," which is the LRT created by Renzo, one of the largest liquid restaking protocols, suffered from depegging earlier this year. In April 2024, following the end of Renzo's then-current airdrop season, ezETH holders rushed to sell ezETH in exchange for ETH or other tokens on decentralized exchanges in order to participate in other restaking opportunities. Following that, the price ezETH fell, causing liquidations of user positions on DeFi applications that used ezETH as collateral, setting off further selling. At one point, the price of ezETH fell to approximately 20% of the price of ETH.8

In both of these instances, the price of the tokens eventually recovered. However, because LSTs and LRTs allow staking and restaking participants to financialize their positions, depegging events can have cascading effects.

5 Legal and regulatory frameworks

With the growing adoption of and user participation in staking, liquid staking and restaking, these activities have increasingly attracted the attention of regulators. Engagement with liquid staking and restaking protocols is generally permissionless (meaning that users do not need to go through any identity verification or know-your-customer process in order to participate).

As such, the permissionless structure does not align with existing regulatory frameworks that have been designed to monitor and regulate traditional finance participants such as issuers and intermediaries. The U.S. securities laws regulate issuers of securities and securities intermediaries that facilitate securities transactions. The U.S. commodities laws regulate those offering commodity derivatives contracts and intermediaries that facilitate these transactions. The U.S. financial regulatory laws, such as the Bank Secrecy Act of 1970, as amended (together with its implementing regulations, the "BSA"), apply to financial institutions broadly and require transaction monitoring, reporting, and recordkeeping in a variety of contexts.

However, in the absence of regulatory frameworks designed to address the unique challenges posed by permissionless blockchain-based activities, regulators have shown an inclination to treat those who develop, provide access to, or financially benefit from the smart contracts powering these protocols as intermediaries. More specifically, regulators may evaluate elements of control over blockchain-based systems when seeking to identify parties that should be responsible for complying with applicable laws. This evaluation is typically facts and circumstances-specific, and the higher the degree of control exercised by a particular party or group, the more likely that the party or group will be viewed as a responsible party by the relevant regulator. Each of the Office of Foreign Assets Control ("OFAC") of the Treasury Department, the Securities and Exchange Commission ("SEC") and the Commodity Futures Trading Commission has brought enforcement actions involving protocols that comprise smart contract code deployed to a blockchain network and identified parties that it asserts were in "control" of such systems.

We discuss below select enforcement actions that may be relevant to participants in the liquid staking and restaking sectors.

Securities laws

In the United States, as noted, securities laws regulate issuers of securities and intermediaries involved in securities transactions. Generally, each entity that is properly considered either an issuer or one or more of a broker, dealer, clearing agency, securities exchange or other intermediary must register with the SEC and comply with the laws and regulations applicable to their activities. A prerequisite to SEC jurisdiction is interstate activity involving "securities." The SEC has frequently referred to crypto assets as "securities" or "crypto asset securities" in speeches,9 settlements10 and many complaints and motions.11 For example, in 2023, the SEC brought enforcement actions against centralized crypto asset marketplaces Coinbase, Binance, and Kraken and alleged that a number of crypto assets available on those marketplaces were "crypto asset securities."

In early 2024, multiple media outlets reported that the Ethereum Foundation was the subject of an SEC investigation and that various companies had received subpoenas about their dealings with the Ethereum Foundation.12 In June 2024, Consensys, the software development company that builds the MetaMask cryptocurrency wallet as well as various other products for the Ethereum network, publicly disclosed that, following a 13-month investigation by the SEC in the matter of "Ethereum 2.0, C-08950," the SEC has concluded its investigation in this matter.13 Nevertheless, the SEC did not expressly acknowledge that ETH transactions are not "securities" transactions despite the Ethereum blockchain network's upgrade to a PoS validation mechanism.

However, Consensys's battle with the SEC is still ongoing in courts. In April 2024, Consensys brought a lawsuit against the SEC in the U.S. District Court for the Northern District of Texas seeking a declaratory judgment that (i) ETH is not a security, (ii) Consensys's sales of ETH are not securities transactions, and (iii) Consensys is not acting as a broker-dealer or selling securities through the MetaMask software.14 In June 2024, the SEC separately brought suit against Consensys in the U.S. District Court for the Eastern District of New York, charging it with (i) engaging in the unregistered offer and sale of securities through MetaMask Staking, and (ii) operating as an unregistered broker through MetaMask Staking and MetaMask Swaps.15 More specifically, the SEC alleged that Consensys acted as an underwriter of an unregistered security because MetaMask allowed users to participate in liquid staking protocols known as "Lido" and "Rocket Pool" and offered and sold securities for the alleged "issuers" (Lido and Rocket Pool) by allowing users to receive LSTs associated with the Lido and Rocket Pool protocols.

Although the SEC has not brought an action against members of the Lido or Rocket Pool communities directly for offering and selling unregistered securities, the court papers make clear that the SEC is focused on the treatment of LSTs and arrangements involving LSTs as "investment contracts" and thus as purported securities offerings. According to the SEC, the four prongs of the Howey test16 are met when users engage in liquid staking through Lido and Rocket Pool because users make an investment of ETH in a common enterprise with other users, with a reasonable expectation of profits (comprising staking rewards), from the managerial efforts of other persons engaging with the Lido or Rocket Pool protocols.

The New York District Court has yet to decide whether it agrees with the SEC's position that the Lido and Rocket Pool staking programs constitute investment contracts. If so, questions remain whether other staking and restaking protocols share features similar to Lido and Rocket Pool such that the associated staking and restaking programs also constitute securities. In addition, other participants in the liquid staking and restaking spaces (whether operators, restaking protocols, or DeFi applications) could be seen as being engaged in securities transactions, and activities around such programs may trigger obligations under the federal securities laws when performed or facilitated by identifiable parties. In particular, parties that are able to exercise control over a given protocol (or over assets held within a smart contract that is part of the protocol) are at a higher risk of being regulated, as opposed to persons engaging with protocols that, once deployed, operate wholly or substantially programmatically, since identifying a responsible party in that case is likely to be substantially more difficult.

OFAC

OFAC administers and enforces trade sanctions against various targeted foreign countries, groups, and individuals. Transactions with sanctioned countries or persons by U.S. persons or within the United States are prohibited by federal law. Most liquid staking and restaking protocols are permissionless, meaning that sanctioned parties may transact digital assets using these protocols. OFAC may examine smart contract-based systems and potentially bring enforcement actions against persons or entities it believes are ultimately responsible for network activities that are illegal.

For example, in August 2022, OFAC sanctioned Tornado Cash, a smart contract-based protocol known as a "mixer" used to effect private transactions in digital assets on public blockchain networks, alleging that the system facilitated the laundering of digital assets that were the proceeds of criminal activity by the Lazarus Group and others.17 OFAC designated Tornado Cash pursuant to Executive Order 13694, as amended. In connection with this, the public blockchain addresses associated with the Tornado Cash smart contracts were added to OFAC's specially designated nationals ("SDN") list, as were a number of other associated public blockchain addresses.

This action by OFAC was atypical in that the Tornado Cash system, comprising computer code, appears to be the entity sanctioned and designated.18 At its core, Tornado Cash comprises software code deployed to a blockchain-based network. As of May 2020, that code was immutable and will be accessible for so long as the blockchain network to which it was deployed remains operational. This means that no one controls the Tornado Cash smart contracts and they are accessible to anyone that has the technical capability of interacting with them. This is true whether individuals most closely associated with Tornado Cash (in particular, Messrs. Storm and Semenov) continue to be involved with the development of Tornado Cash or not. Nevertheless, it is notable that Messrs. Storm and Semenov are currently subject to criminal prosecution in the United States.

The criminal case against Messrs. Storm and Semenov is an extreme example involving issues of national security that are of the highest priority and focus for U.S. law enforcement and regulators. It is with respect to these types of high-priority matters that the government is most likely to attempt to link the programmatic operation of a smart contract system with elements of control over technology complementary to that system and other promotion of the smart contract system.

FinCEN

The BSA serves as the United States' principal anti-money laundering and anti-terrorist finance (collectively, "AML") regulatory regime. The U.S. Treasury Department's Financial Crimes Enforcement Network ("FinCEN") is the federal agency responsible for administering the BSA, frequently working in conjunction with other federal agencies and bureaus, including the Federal Bureau of Investigation and the National Security Agency.

The application of the BSA to digital assets has been based on guidance issued on May 9, 2019 from FinCEN, entitled "Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies" ("Guidance").19 The Guidance clarifies that whether an "Exchanger" or "Administrator" is a money transmitter or exempt from status as a "Money Services Business" ("MSB") under the BSA depends on the application of applicable regulations to the person's specific facts and circumstances.20 It further confirms that a person is considered a money transmitter (and thus an MSB) not only if it accepts and transmits a convertible virtual currency ("CVC") but also, more broadly, if the person by any means receives any form of value (such as currency, funds, prepaid value, or a CVC or other substitute for currency) from one person and transmits either that or a different form of value to another person or location, regardless of the order of actions.

While the Guidance touches on the application of relevant U.S. laws and regulations with respect to "decentralized" systems, it does not clearly establish whether certain DeFi applications qualify as financial institutions and would therefore be subject to the BSA. Despite this uncertainty, the Guidance is clear that developers of DeFi applications are not considered money transmitters simply by creating the application, even if its purpose is to issue a CVC or facilitate financial activities involving a CVC. However, they may be classified as money transmitters if they "use" or "deploy" the application to engage in money transmission activities.21

With respect to liquid staking and restaking protocols, as each protocol design varies, the protocol developer could be seen as a "money transmitter" and be engaged in an MSB. This determination would depend on the mechanism behind the protocols – how the smart contract is designed and functions, how the assets get routed, whether there is any identifiable party in the middle of the flow of CVCs, and whether any continued maintenance of the protocol is required, among other considerations.

6 Conclusion

The future of restaking holds significant potential for blockchain-based systems. Restaking offers the major benefit of capital efficiency. By allowing crypto assets that are staked to a more established system to be restaked to simultaneously secure a new system, the new system inherits the security of the more established system (e.g., layer-1 blockchain), where significant value is already staked in connection with validating transactions. The concept of restaking allows network participants to enhance security while optimizing the use of staked capital across multiple networks and provides opportunities for greater rewards from securing multiple platforms.

However, with the increased technical complexity, restaking also comes with risks. These risks include the potential for slashing across multiple networks, systemic vulnerabilities introduced by interconnected protocols, potential centralization of large validators, and potential governance conflicts that arise from being part of multiple network communities.

From a legal perspective, it is important to ensure that restaking protocols allowing users to secure multiple blockchain networks are designed with regulatory considerations in mind. Various government agencies have either brought enforcement actions or otherwise provided guidance applicable to activities using permissionless blockchain-based networks. As discussed above, identifiable points of control within these systems are of particular importance. These elements of control include, but are not limited to: obtaining a financial benefit from the operation of the system; control of the private keys required to upgrade smart contract parameters; and control over the manner in which transactions are executed. As each of the regulatory agencies discussed above focuses on decentralized blockchain-based activities, participants in the restaking space should be mindful of the various regulatory frameworks discussed when making design choices.

As the technology matures, it promises more resilient decentralization and enhanced security so long as technological risks are responsibly managed and regulatory obligations are carefully navigated. The complexities of the restaking technology underscore the importance of a nuanced understanding and approach to regulatory considerations. Thoughtfully addressing the challenges posed by regulatory compliance will be crucial for the future success and adoption of the technology.

Footnotes

1. See https://stake.lido.fi . This chapter discusses stETH as an example of liquid staking tokens for illustrative purposes only. Other types of liquid staking tokens include, but are not limited to, rETH, cbETH, wBETH, osETH, and swETH.

2. See DefiLlama for statistics regarding total value locked in liquid staking protocols. https://defillama.com/protocols/Liquid%20Staking . Total value locked quoted herein is as of August 24, 2024.

3. This chapter discusses EigenLayer as an example of restaking protocols for illustrative purposes only. Other restaking protocols include, but are not limited to, Symbiotic and Karak.

4. Native restaking refers to the method where Ethereum stakers restake their staked ETH natively by pointing their withdrawal credentials to the EigenLayer contracts. Liquid restaking refers to the method where liquid staking token holders restake their LSTs by transferring them into the EigenLayer smart contracts. See https://docs.eigenlayer.xyz/eigenlayer/overview/key-terms

5. See DefiLlama for statistics regarding total value locked in liquid restaking protocols. https://defillama.com/protocols/Liquid%20restaking . Total value locked quoted herein is as of August 24, 2024.

6. See https://etherfi.gitbook.io/etherfi/getting-started/faq . This chapter discusses eETH as an example of liquid restaking tokens for illustrative purposes only. Other types of liquid restaking tokens include, but are not limited to, weETH, ezETH, pufETH, rswETH, and rsETH. Each of the associated restaking protocols features various technical functionalities. Some feature native liquid restaking, as opposed to liquid restaking.

7. See "stETH Depegging: A Case Study of Cascading Events," Apr. 18, 2022, available at https://fintech.io/articles/steth-depegging-a-case-study-of-cascading-events

8. See "Observations from Renzo's $ezETH depeg," Apr. 25, 2024, available at https://medium.com/coinmonks/observations-from-renzos-ezeth-depeg-c545dc217147

9. See, e.g., "Kennedy and Crypto," Speech by SEC Chair Gary Gensler, Sept. 8, 2022 ("Of the nearly 10,000 tokens in the crypto market, I believe the vast majority are securities.").

10. See, e.g., In the Matter of Stoner Cats 2, LLC, File No. 3-21655 (claiming that the defendants conducted an unregistered offering of crypto asset securities in the form of non-fungible tokens called Stoner Cats).

11. See, e.g., SEC v. Payward Inc., et al., No. 23 Civ. 06003(WHO), ECF No. 1 (N.D. Cal. Nov. 20, 2023).

12. See "SEC Investigating Ethereum Foundation Regarding Proof-of-Stake Transition: Report," Mar. 20, 2024, available at https://unchainedcrypto.com/sec-investigating-ethereum-foundation-regarding-proof-of-stake-transition-report

13. See "SEC closes investigation into Ethereum 2.0, no securities charges against ETH: Consensys," Jun. 19, 2024, available at https://cryptobriefing.com/sec-ethereum-decision-cleared

14. See Consensys Software Inc., v. Gensler et al., No. 24-Civ-00369 (N.D. Tx. Apr. 25, 2024).

15. See SEC v. Consensys Software Inc., No. 24- Civ-04578, ECF No. 1 (E.D.N.Y. Jun. 28, 2024).

16. The federal securities laws define the term "security" to include "investment contracts." The test to determine whether a particular asset or scheme would be considered an "investment contract" was established in S.E.C. v. W.J. Howey Co., 328 U.S. 294 (1946). The "Howey test" looks to whether a "contract, transaction or scheme" involves (1) an investment of money (2) in a common enterprise (3) with profits to come (4) solely from the efforts of others. All four elements of the Howey test must be present for a scheme to be considered an "investment contract" under this test.

17. Press Release, U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash, U.S. Department of the Treasury (Aug. 8, 2022), available at https://home.treasury.gov/news/press-releases/jy0916 . According to OFAC, Tornado Cash played a role in laundering over $7 billion worth of virtual assets, including those allegedly stolen by the Lazarus Group, a North Korea-sponsored hacking group, which was also believed to be involved in a few bridge exploits (including the Axie Infinity and Nomad incidents). David Canellis, Tornado Cash Sanctions Expose Potential DeFi Achilles' Heel, Blockworks, https://blockworks.co/tornado-cash-sanctions-expose-potential-defi-achilles-heel (Aug. 9, 2022).

18. In August 2023, the Department of Justice brought criminal charges against Roman Storm and Roman Semenov, two of the lead developers associated with Tornado Cash, charging the pair with conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed money transmitting business. See U.S. v. Roman Storm and Roman Semenov, Indictment No. 23 Cr. 430, U.S. Dist. Ct. for the S.D.N.Y. (Aug. 23, 2023). The indictment alleged that the defendants created, operated, and promoted Tornado Cash, a cryptocurrency mixer that facilitated more than $1 billion in money laundering transactions, and laundered hundreds of millions of dollars for the Lazarus Group, the sanctioned North Korean cybercrime organization.

19. FinCEN, Guidance on the Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies, FIN-2019-G001 (May 9, 2019), available at https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf

20. An Exchanger is a person engaged in the business of exchanging virtual currency for "real currency, funds, or other virtual currency." An Administrator is a person engaged in the business of issuing virtual currency and has the authority to redeem it. FinCEN, Guidance on the Application of FinCEN's Regulations to Persons Administering, Exchanging or Using Virtual Currencies, FIN-2013-G001, at 1 (Mar. 18, 2013), available at https://www.fincen.gov/sites/default/files/shared/FIN-2013-G001.pdf

21. Guidance at pp 27.

Originally published by Global Legal Insights.

To subscribe to Cahill Publications Click Here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More