Risk exposure
Tornado Cash association lists
CompliAPI crawls the Tornado Cash pools' Ethereum event logs daily and records the addresses that deposited into or relayed for the mixer. Matches are risk exposure — flagged, with the evidencing transaction attached — never sanctions hits.
- Publisher
- CompliAPI on-chain crawl
- List type
- Risk exposure
- Refresh
- Daily on-chain crawl
- API list slugs
tornado_cashtornado_cash_recipients- Official source
- Ethereum mainnet pool event logs
About this list
Tornado Cash is an Ethereum mixing protocol. It was sanctioned by OFAC in 2022 and removed from the SDN list in March 2025 — so today, having interacted with it is a risk signal many compliance policies care about, not a sanctions violation by designation. CompliAPI treats it accordingly: these lists carry list_type "risk", and a match sets only flagged, never sanctioned.
The data comes straight from the chain. A daily crawl reads the Tornado Cash pools' event logs from Ethereum mainnet — back to the first pool's deployment in December 2019 — and extracts two populations by signal strength: depositors (the sending address of each deposit transaction) and withdrawal relayers, both parties that actively used the mixer. Every record carries the evidencing transaction, linked on each match.
A third population, withdrawal recipients, is kept as a separate list that ships disabled: since 2022, dusting attacks have sprayed small Tornado Cash withdrawals at prominent addresses that never opted in, so merely receiving a withdrawal is not evidence of intent. Deposits and withdrawals are cryptographically unlinkable on-chain — these are separate populations, never a sender-to-recipient mapping.
What CompliAPI extracts
- Depositor addresses (tx.from of pool deposits)
- Withdrawal relayer addresses
- Withdrawal recipient addresses (separate list, disabled by default)
How CompliAPI handles it
Daily crawl of pool events
The crawl reads Deposit and Withdrawal events from the pools' logs via JSON-RPC, staying a safety margin behind the chain head so reorged logs never land, and resuming from a stored block cursor.
Append-only with evidence
On-chain history does not un-happen, so records are appended rather than reconciled, and every address carries the transaction that put it on the list — reviewers can verify each hit on-chain.
Signal strength made explicit
Depositors and relayers (active use) live on tornado_cash; withdrawal recipients (weak, dusting-prone signal) live on tornado_cash_recipients, which is disabled by default and clearly labeled if enabled.
Screen against this list
Every /screen endpoint checks all enabled lists by default and names the list behind each match. Add the ?lists= filter to restrict a request to this source.
GET /api/v1/screen/crypto/{address}?lists=tornado_cash
curl "https://api.compliapi.com/api/v1/screen/crypto/0x1a2b3c4d5e6f708192a3b4c5d6e7f80912a3b4c5?lists=tornado_cash" \
-H "Authorization: Bearer $COMPLIAPI_TOKEN"Response
{
"value": "0x1a2b3c4d5e6f708192a3b4c5d6e7f80912a3b4c5",
"flagged": false,
"sanctioned": false,
"lists_checked": ["tornado_cash"],
"matches": []
}Frequently asked questions
Does a Tornado Cash match mean the address is sanctioned?
No. Tornado Cash was removed from the OFAC SDN list in March 2025, so association with it is risk exposure, not a designation. Matches carry list_type "risk" and set only flagged — sanctioned stays false.
What puts an address on the tornado_cash list?
Active use of the mixer, read directly from Ethereum mainnet: the address either sent a deposit transaction into a Tornado Cash pool or acted as a withdrawal relayer. Every record links the evidencing transaction.
Why are withdrawal recipients a separate, disabled list?
Because receiving a withdrawal is a weak signal: post-2022 dusting attacks sprayed small Tornado Cash withdrawals at prominent addresses that never opted in. The recipients population lives on tornado_cash_recipients, which ships disabled so the weak signal is never silently mixed with the strong one.
Is this the same as blockchain analytics?
No. There is no clustering, multi-hop tracing or exposure scoring — just direct extraction of who interacted with the pools, with the transaction as evidence. Deposits and withdrawals are cryptographically unlinkable, and CompliAPI never presents them as a sender-to-recipient mapping.
Can a depositor hit identify the wrong party?
The recorded depositor is the transaction's sending address. When that sender is a smart-contract wallet or bundler, the hit identifies the contract rather than the person behind it — the linked transaction gives reviewers what they need to judge.
How far back does the Tornado Cash data go?
To the first pool's deployment on Ethereum mainnet in December 2019. The daily crawl advances a stored block cursor from there, staying a safety margin behind the chain head.
Related
Crime intelligence
Ransomwhere ransomware payment addresses
How CompliAPI screens the Ransomwhere dataset: crowdsourced ransomware payment addresses by Jack Cable, tagged with the ransomware family, ingested weekly and flagged as crime intelligence — never as sanctions hits.
Sanctions list
FBI-published Lazarus Group crypto addresses
How CompliAPI screens the crypto addresses the FBI attributed to North Korea's Lazarus Group after the $41M Stake.com theft: transcribed verbatim from the official press release and checked on every crypto screen.
Sanctions screening
Wallet screening API for crypto compliance
Screen crypto wallets against OFAC and global sanctions lists in one GET request.
Sanctions screening
OFAC API — screen against the official SDN list
Screen crypto wallets, emails, IDs and countries against the official US Treasury OFAC SDN list, refreshed every 15 minutes.
Screen against Tornado Cash data
Get a free API key and make your first request in minutes — every screen checks all enabled lists in one call.
14-day free trial. No credit card required.
CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.