Roman Storm Blames Google, OpenAI After DOJ Conviction

Roman Storm, the founder of the anonymizing crypto protocol Tornado Cash, accused Google and OpenAI of enabling North Korean hackers after his conviction in August 2025 on a charge of conspiracy to operate an unlicensed money transmitting business.

Storm posted on social media following an investigation that found North Korean IT workers continue to use large language models and other AI tools for tasks such as writing, producing code and altering images. He argued the Justice Department’s legal theory that developers can be criminally liable for crimes committed by users is inconsistent.

In his posts he wrote: “That’s exactly the theory behind USA v. Roman Storm: build a neutral tool, bad actors abuse it, and the developer gets prosecuted instead of the criminals.” He added that law enforcement should prosecute the people who commit crimes rather than the creators of neutral technology and wrote, “Writing code is not a crime.”

Storm called for similar investigative steps against large AI firms, urging authorities to subpoena employees and examine company messages. He wrote: “So let’s be consistent: subpoena every Google and OpenAI employee. Dig through their text messages for any hint they knew their tools were used by DPRK. Indict them for 20 years in prison on IEEPA charges.”

Legal experts and industry observers have highlighted the Storm verdict as a potential precedent that could expose software developers to criminal liability when others misuse their code. The case has prompted discussion in Washington about how to align law enforcement aims with legal protections for developers and open-source projects.

Legislative efforts include the Digital Asset Market Clarity Act, known as the CLARITY Act, which would create specific legal protections to separate developers from illicit activity carried out by users of their protocols. The bill faced a scheduled procedural vote to advance to final consideration, but supporters say its chances of passage are limited because of timing and political priorities ahead of the midterm elections.

Tornado Cash is an on-chain service built to mix cryptocurrency transactions to increase user privacy. U.S. authorities have alleged the service was used to launder funds, including proceeds tied to cybercrime. Storm’s conviction arrives as officials increase scrutiny of software and tools that can be repurposed for illicit finance, and as developers and privacy advocates express concern that broad criminal exposure could hamper legitimate research and development.

Prosecutors and lawmakers had not publicly responded to Storm’s social media posts. The question of whether legal responsibility should rest with toolmakers, users or platforms remains under debate as courts, Congress and industry groups consider possible reforms.