The U.S. Treasury Department has submitted a comprehensive report to Congress acknowledging the legitimate privacy uses of cryptocurrency mixers, marking a notable departure from its previous enforcement-heavy approach. The 32-page assessment, filed under the GENIUS Act mandate, recognizes that blockchain professionals and businesses have valid reasons to use privacy tools while proposing new legislative mechanisms to combat illicit finance.
Regulatory Recalibration After Years of Enforcement
The Treasury's acknowledgment that lawful users may employ mixers to protect sensitive financial information represents a significant policy evolution. The department previously sanctioned Tornado Cash in 2022 and designated several international mixers as money-laundering operations in 2023. This shift follows the March 2025 lifting of Tornado Cash sanctions after a federal appeals court ruled that OFAC exceeded its statutory authority.
The report distinguishes between custodial and non-custodial mixing services, noting that custodial operators must register with FinCEN as money services businesses. Treasury explicitly stated it will not recommend new restrictions on non-custodial mixers, diverging from FinCEN's proposed 2023 recordkeeping rule.
Despite acknowledging legitimate use cases, the department highlighted ongoing criminal exploitation. North Korean-affiliated actors stole at least $2.8 billion in digital assets between January 2024 and September 2025, including $1.5 billion from the Bybit exchange, frequently using mixers to obscure transaction trails.
Implications for Compliance Professionals and Developers
Treasury has proposed Congress enact a digital asset-specific "hold law" that would grant financial institutions temporary safe harbor to freeze suspicious assets during investigations. The department also recommends Congress clarify which DeFi actors should face AML and CFT obligations based on their specific roles and risk profiles, addressing long-standing regulatory uncertainty in decentralized finance.
For blockchain developers, the Justice Department's indicated shift toward prosecuting criminal intent rather than tool creation may provide greater clarity. The Roman Storm case—resulting in conviction for operating an unlicensed money transmitter—suggests prosecutors will focus on business operations rather than code development alone.
The report, informed by over 220 public comments and consultations with financial institutions, blockchain analytics firms, and law enforcement, reflects an effort to balance privacy considerations with compliance requirements. Web3 professionals in compliance, legal, and development roles should monitor how these recommendations translate into specific regulatory guidance and legislative action, as they will likely shape hiring priorities and required skill sets across the industry.
