Tornado Cash and Transaction Mixing: How Privacy Works on Ethereum

When you send Bitcoin or Ethereum, everyone on the network can see exactly where it came from and where it went. That’s not a bug-it’s how blockchains are designed. But what if you don’t want people to know you sent money to a certain address? Maybe you’re paying a freelancer, moving funds between wallets, or just protecting your financial privacy. That’s where Tornado Cash comes in.

What Is Tornado Cash?

Tornado Cash is a decentralized tool built on Ethereum that lets users break the link between where they sent crypto from and where they withdrew it. It doesn’t change the blockchain. It doesn’t create a new coin. It just hides the connection between two transactions using math.

Think of it like dropping a letter into a public mailbox, then picking up a different letter from the same box later. No one knows which letter you sent or which one you took. Tornado Cash does this with ETH, USDC, DAI, and even wBTC. You deposit funds into a shared pool. Later, you withdraw the same amount-but from a completely different address. The protocol uses something called zero-knowledge proofs (specifically zk-SNARKs) to prove you’re allowed to withdraw without revealing which deposit you made.

Unlike banks or centralized services, Tornado Cash doesn’t hold your money. The funds sit in smart contracts on Ethereum. You keep control. You just need one thing: your deposit note. If you lose it, your money is gone forever. No support team can recover it. No one can help.

How Transaction Mixing Actually Works

The mixing process has three steps:

1. Deposit: You pick a pool size-0.1 ETH, 1 ETH, 10 ETH, or 100 ETH-and send that exact amount to Tornado Cash. The contract records a hash of your secret deposit note. No one else sees it.
2. Wait: You wait. Days, weeks, even months. The longer you wait, the more your transaction gets lost in the crowd. Tornado Cash had over 1.2 million ETH in its pools as of February 2025. That’s billions of dollars worth of mixed transactions. The bigger the pool, the harder it is to trace.
3. Withdraw: You use your secret deposit note to generate a cryptographic proof. This proves you’re entitled to withdraw without saying which deposit you made. You can do this yourself, or pay a relayer (0.05%-0.2% fee) to do it for you. The withdrawal goes to any address you choose.

That’s it. No registration. No KYC. No identity checks. Just math.

Why Tornado Cash Is Different

There are other ways to hide crypto transactions. Monero and Zcash are coins built for privacy from the ground up. They change the entire protocol. Tornado Cash works on top of Ethereum. It doesn’t require users to switch coins. You keep using ETH, USDC, DAI-and just add privacy on top.

Compare it to Wasabi Wallet, a Bitcoin mixer that relies on a central server to shuffle coins. That introduces trust. What if the server is hacked? What if it disappears? Tornado Cash has no central server. No company. No CEO. No employees. The code runs on Ethereum. It can’t be shut down by taking down a website.

But it’s not perfect. The fixed denominations (0.1, 1, 10, 100 ETH) are a weakness. If you deposit 1.7 ETH, you have to deposit 2 ETH and lose 0.3 ETH in fees. That leaves a pattern. Timing is another issue. If you deposit and withdraw within minutes, analysts can still link them with high accuracy. Studies show 68% of transactions can be traced if the waiting period is too short.

The Sanctions and Legal Battle

In August 2022, the U.S. Treasury’s OFAC sanctioned Tornado Cash. Not the people behind it. Not the company. The software itself. They claimed it was used to launder $455 million stolen from the Axie Infinity Ronin Bridge by North Korean hackers. After the sanction, GitHub removed the code. U.S. citizens were blocked from interacting with it. Wallets that had mixed funds were frozen.

But here’s the twist: the smart contracts kept running. People outside the U.S. kept using it. The code was still out there. Developers in Germany, Brazil, and Singapore kept building on it. In November 2024, a U.S. federal judge ruled that OFAC had no legal power to sanction open-source software. Code, the court said, is not a person. It’s not a bank. It’s just math. In March 2025, sanctions were lifted.

Within a month, ETH deposits into Tornado Cash rose 37%. By September 2025, over 1.44 million ETH was locked in its pools. Most of that came from wallets linked to non-U.S. exchanges. The protocol is now used almost entirely outside U.S. jurisdiction.

Real User Problems

People love Tornado Cash for what it does. But they hate what it demands.

One user on Reddit lost 2.5 ETH because they accidentally deleted their deposit note. Another waited 47 days to withdraw 10 ETH, scared every day that someone might trace it. A security researcher found a bug in early versions that could have exposed users’ identities. The protocol’s developers fixed it, but the lesson stuck: if you mess up, you lose everything.

Relayer fees also add up. For a 0.1 ETH withdrawal, a 0.2% fee is 0.0002 ETH. That’s fine. But if you’re sending $5 worth of DAI? That fee becomes 10% of your amount. That’s why Tornado Cash works best for medium-to-high value transfers. Not for small payments.

What’s Next for Tornado Cash?

The protocol isn’t standing still. In March 2025, Version 3.1.2 added support for Arbitrum and Optimism, cutting withdrawal fees by 22%. The Tornado Cash DAO, now fully decentralized, is working on integrating ERC-4337-Ethereum’s account abstraction standard. This could let users recover lost deposit notes using trusted friends or family members, like a social recovery wallet.

But the bigger question is regulation. The EU’s MiCA law, set to take effect in 2026, could ban mixing services outright by requiring every transaction to carry sender and receiver info. That’s a direct threat. If MiCA passes as written, Tornado Cash might become illegal for EU residents.

Meanwhile, enterprise adoption remains near zero. Banks, exchanges, and DeFi platforms won’t touch Tornado Cash. They can’t. Compliance teams can’t risk interacting with a sanctioned protocol-even if it’s now unsanctioned. The stigma lingers.

Is Tornado Cash Right for You?

Use Tornado Cash if:

• You’re moving ETH or stablecoins between wallets and want to hide the link
• You’re outside the U.S. and aren’t subject to its sanctions
• You’re comfortable with technical complexity and understand the risks
• You’re depositing 1 ETH or more (to make fees worthwhile)
• You’re willing to wait weeks between deposit and withdrawal

Avoid Tornado Cash if:

• You’re in the U.S. and still worried about compliance gray areas
• You’re sending small amounts (under $50)
• You’re not confident you can securely store your deposit note
• You expect instant, foolproof privacy

There’s no middle ground. Tornado Cash doesn’t offer partial privacy. It’s all or nothing. Either you use it correctly and gain strong anonymity-or you mess up and lose everything.

Alternatives to Consider

If Tornado Cash feels too risky, here are other paths:

• Monero (XMR): Built-in privacy. No mixing needed. But it’s not compatible with most DeFi apps.
• Wasabi Wallet (for Bitcoin): Centralized mixer, but simpler to use. Trust required.
• Privacyswap: A new DeFi protocol using zk-rollups to anonymize swaps on Ethereum. Still early, but promising.
• Using multiple wallets with time delays: Not perfect, but better than nothing. Send from Wallet A → wait 2 weeks → send to Wallet B.

None of these match Tornado Cash’s scale. As of September 2025, it still controls 89% of all crypto mixer value locked. That’s not because it’s the easiest. It’s because it’s the most effective.