Soleimani explained that the “critical flaw” with Tornado Cash is that users cannot prove that they’re not associated with a criminal enterprise stealing or laundering crypto funds.A former Tornado Cash developer claims to be building a new crypto mixing service that aims to solve a “critical flaw” of the sanctioned crypto mixer — which he hopes will convince United States regulators to reconsider its position on privacy mixers.
The code of a new Ethereum-based mixer, “Privacy Pools,” was launched on GitHub on March 5 by its creator, Ameen Soleimani.
In a 22-part Twitter thread, Soleimani explained that the “critical flaw” with Tornado Cash is that users cannot prove that they’re not associated with North Korea’s Lazarus Group or any criminal enterprise for that matter.
Twitter content:
https://twitter.com/ameensol/status/1632083054272430080With Privacy Pools, however, Soleimani says that depositors and withdrawers can opt out of an anonymity set that contains an address associated with stolen or laundered funds.
This feature of Privacy Pools is executed with zero-knowledge (ZK) proofs, meaning that the privacy of the user is preserved:
“Now, users have the option to help regulators isolate illicit funds, without revealing their entire transaction history [...] With privacy pools, just because someone deposits into the same smart contract as you, it doesn't mean they can also force you into sharing an anonymity set with them. It's your choice.”
Soleimani provided a demonstration of how Privacy Pools is used on twitter:
Twitter content:
https://twitter.com/ameensol/status/1632089283354845184The developer hopes the solution will empower “the community to defend against hackers abusing the anonymity sets of honest users without requiring blanket regulation or sacrificing on crypto ideals.”
While Privacy Pools is already live on Optimism, Soleimani noted that the first version of the privacy protocol is still in its “experimental” stage because the code isn’t complete and has not been audited, but he is “pretty close to having this ready.”
To see the protocol progress further, Soleimani wants on-chain forensics platforms like Chainlaysis and TRM Labs to conduct tracebacks on deposits so that users of the privacy tool don’t have to manually create their own subset exclusion lists.
In making the case for on-chain privacy protocols, Soleimani cited what he described as an “excellent” report by the Federal Reserve Bank of St. Louis in Missouri that examined the trade-offs between on-chain privacy and regulation:
“Their report proposes to achieve effective regulation by having Tornado Cash users provide receipts to an intermediary, thus revealing their entire transaction history to the intermediary, but still being able to have privacy with respect to other public blockchain users.”
The developer hopes this can help “start a conversation” with U.S. regulators on how on-chain privacy can be preserved whilst restricting criminal activity through the use of ZK proofs.
Soleimani’s attempt to create a crypto-friendly on-chain privacy solution comes after the U.S. Office of Foreign Asset Control (OFAC) sanctioned ETH and USDC addresses linked to Tornado Cash on Aug. 8 in response to several alleged thefts by North Korea’s Lazarus Group, who were claimed to have routinely used the privacy mixer to preserve its anonymity.
Shortly after the sanction on Aug. 10, Alexey Pertsev, the creator of Tornado Cash, was arrested by authorities in the Netherlands and is currently facing a series of money laundering charges. He remains behind bars and his next hearing will take place in late April.
https://cointelegraph.com/news/tornado-cash-dev-says-sequel-to-crypto-mixer-aims-to-be-regulator-friendly ....
A redesign and update to tornado cash intended to comply with feedback and criticism from regulators.
It seems to include greater transparency. Along with improved implementation and coordination of whitelist versus blacklist networking to better isolate legitimate transactions from illegitimate ones.
Given the nature of the internet to offer anonymizing services through proxies, VPNs and TOR. Could an anonymizing service offer better proof of authentication through not allowing end users to conduct tornado cash transactions through anonymizing services like proxy/VPN/TOR? Rather than allow anonymizing services, the end user IP address and region could be confirmed as not being anonymized before being one way hashed or obfuscated in some way. In this way, it could be easier to separate legitimate funds from illegitimate ones.
Although given the rise of botnets, there certainly might be no shortage of supply of IP addresses for criminals to utilize towards executing their nefarious plans. Even without resorting to network anonymization.
Perhaps captchas could be used to cut down on potential botnet traffic? Or perhaps my ideas are not the best.
Still, doesn't it seem as if there could be a better way to do this.