The Bitcoin Fog Precedent: How the DOJ Is Trying to Make Decentralized Code Answer for Centralized Sins

In a lower Manhattan courtroom this month, a filing arrived that few in the industry will ever read — and that all of them should. The U.S. Department of Justice invoked the conviction of Roman Sterlingov, the operator of the Bitcoin Fog mixer, to argue that the Southern District of New York holds jurisdiction over Roman Storm, the co-developer of Tornado Cash. Two Romans. Two mixers. One argument: if it touched your city, you answer to its courts. The code whispers, but the soul listens. And what it hears here is not a technical dispute. It is the sound of a legal system deciding whether a protocol can be tried in the place where someone, somewhere, once used it. To understand why this filing matters, you have to hold two architectures in your mind at once, because the prosecution is deliberately blurring them. Bitcoin Fog, launched in 2011, was a centralized custodial tumbler. Users sent their coins to Sterlingov, and his operation returned different coins. When an undercover agent completed a transaction inside his Washington, D.C. office, the government's jurisdictional hook was physical, concrete, almost mundane — a room, a desk, a person. Tornado Cash is a different species entirely. It is a set of immutable smart contracts deployed on Ethereum, self-executing and ownerless. No office. No desk. No one to hand your coins to. In 2022, the Treasury's OFAC sanctioned it, and in 2025 a jury in New York deadlocked on the money-laundering and sanctions-evasion counts while convicting Storm on a single count of operating an unlicensed money-transmitting business. Now the DOJ wants the court to treat Sterlingov's appellate defeat as settled law for a protocol that never had an operator at all. Here is where my audit experience matters. I have spent years reading contracts and, before that, reading the documents developers leave behind. And the most dangerous thing in this filing is not the precedent itself — it is the architectural equivalence it quietly assumes. Bitcoin Fog required trust. Tornado Cash minimized it. That distinction is not a philosophical nicety; it is the entire legal hinge. Sterlingov was convicted because he was an operator: he controlled funds, he controlled records, he controlled the point of failure. A custodial mixer is a business. Businesses have addresses, bank accounts, employees, and — critically — a mind that can form intent. A non-custodial smart contract has none of these. It is, in the most literal sense, a set of instructions that runs whether or not anyone is watching. When the DOJ cites Bitcoin Fog as 'directly supporting' jurisdiction, it is attempting to transplant the minimum-contacts logic from a custodial service onto a permissionless protocol. But minimum contacts presumes a defendant who did something in the forum — who reached in. Storm did not reach into Manhattan. Someone else did, and the protocol did not know or care who. I have seen this pattern before. In 2017, I audited 23 token whitepapers and found that 18 of them had no philosophical foundation at all — they were shells dressed as protocols. The lesson I carried forward was that the difference between a real protocol and a shell is whether value flows through a human custodian or through code. Bitcoin Fog was a shell with a man inside. Tornado Cash was code with no one inside. The government is now arguing that the man and the code are the same thing. And here is the deeper technical point the filing glosses over: the two systems fail differently. When Bitcoin Fog was seized, it stopped. When Tornado Cash was sanctioned, the front end went dark, but the contracts kept running — because there was never anything to seize. That asymmetry is not a bug in the law's eyes; it is the law's blind spot. You cannot serve papers on a hash. You cannot arrest a function. So the DOJ is doing the only thing it can: it is going after the human who wrote it, and it is borrowing a precedent from a world where humans were still in charge. The jurisdictional claim rests on the idea that Tornado Cash had 'activity' in Manhattan — testimony that a convicted attacker called it from an apartment, that its code ran on-chain inside the district. But the code runs everywhere and nowhere. Every node that validates it is a location. Every user who calls it is an author. If activity equals jurisdiction, then every developer is subject to every court on Earth, because their code has, at some point, executed on a machine inside someone's borders. That is the trap. And it is a trap built on a category error: treating the diffusion of a protocol as the presence of a person. We built towers of glass on beds of sand. Bitcoin Fog was one of those towers — and it fell because a man lived inside it. Tornado Cash was something else: a foundation without an architect in the room. The DOJ is now insisting that the absence of an architect is itself a crime, which is a remarkable thing for a legal system to say. But let me offer the angle my own community resists, because truth is not mined; it is revealed in the dark. The defense's strongest card — 'code is speech, and the developer is not the user' — is also its most fragile, because it depends on what Storm actually said and did. If prosecutors can show that a developer knowingly built for illicit flow, or marketed to it, or took a cut of it, then the architecture argument collapses. The law does not care that your protocol is permissionless if your intent was not. Non-custodial design is a technical fact; intent is a human one. And juries judge humans. Here is the uncomfortable truth: decentralization is a property of the system, not an alibi for the builder. The privacy community wants the ruling to be about code. But the ruling will be about conduct. That is the blind spot on our side — we keep arguing engineering while the court is arguing mens rea. The hearing is set for April 2026. Between now and then, the question hanging over every permissionless protocol is simple, and it will not be answered by whitepapers: when the code is everywhere, who is the defendant? The chain will keep running regardless of the verdict. But the people who dare to write it — that is who this case is really about. Faith in code requires a heart for humanity. The court, this time, is asking us to prove we have one.