TraderTraitor.com · Field notes · Mixers explained

How Tornado Cash works, in seven steps

Tornado Cash is a program on Ethereum that breaks the link between the wallet that puts money in and the wallet that takes it out. Here is the whole trick, with no maths.

Animation: six people put 10 ETH each into a shared pool and leave sealed tickets on a public board. Later one of them proves she owns a ticket, without saying which, and a fresh wallet is paid 10 ETH.
1

The same thing, in the real words

PoolA smart contract that only takes one fixed size: 0.1, 1, 10 or 100 ETH. Same size means every coin looks the same.
Secret noteA random code your browser makes when you deposit. Whoever holds it can withdraw. Lose it and the money is gone for good.
CommitmentThe sealed ticket. A scrambled fingerprint of your secret, added to a public list (a Merkle tree) that anyone can read.
Zero-knowledge proofMaths that proves "my secret matches one ticket on the list" without revealing which ticket.
NullifierA used-ticket stamp. It is published at withdrawal so the same note can never be cashed twice, and it can't be traced back to the deposit.
RelayerA helper who pays the gas fee for your withdrawal and takes a small cut, so your brand-new wallet doesn't need any ETH to start with.

Does it actually do what it says?

Yes, the maths holdsNobody has broken the proof system. No operator can take the coins or stop a valid withdrawal.
Privacy is only as big as the crowdSmall pools, quick in-and-out, odd amounts and reused wallets let analysts match deposits to withdrawals.
Cashing out is the weak spotCoins that touched Tornado Cash get flagged. Exchanges freeze them and ask questions.

Timeline

Launches on Ethereum.
Developers give up control. The core contracts can no longer be changed or shut down by anyone.
US Treasury sanctions it, saying more than $7 billion was laundered through it, including about $455 million stolen by North Korea's Lazarus Group.
A Dutch court convicts developer Alexey Pertsev of money laundering and sentences him to 64 months.
A US appeals court rules that code nobody controls isn't "property" that can be sanctioned.
Treasury lifts the sanctions.
Co-founder Roman Storm is convicted in New York of conspiring to run an unlicensed money transmitter. The jury can't agree on laundering and sanctions charges, and prosecutors seek a retrial.
Deposits hit a record of about $1.2 billion after large whales pour ETH in.
The Binance attacker pays for its rehearsal with three small Tornado Cash withdrawals. See the money trail.

The only real address is tornado.cash's contracts on Ethereum. Sites like tradertraitor.org that ask you to send coins to their wallet are not Tornado Cash. Sources: Tornado Cash docs, Tokamak Network explainer, TRM Labs on the 2022 sanctions, Merkle Science on the reversal, The Block on the Storm retrial, ForkLog on the record deposits, TRM Labs on the Binance rehearsal.