{"id":14507,"date":"2025-07-29T14:18:01","date_gmt":"2025-07-29T12:18:01","guid":{"rendered":"https:\/\/wsj-crypto.com\/?p=14507"},"modified":"2025-07-29T14:18:01","modified_gmt":"2025-07-29T12:18:01","slug":"tornado-cash-trial-reaches-third-week-defense-calls-expert-digital-forensics-witness-to-the-stand","status":"publish","type":"post","link":"https:\/\/wsj-crypto.com\/index.php\/2025\/07\/29\/tornado-cash-trial-reaches-third-week-defense-calls-expert-digital-forensics-witness-to-the-stand\/","title":{"rendered":"Tornado Cash Trial Reaches Third Week: Defense Calls Expert Digital Forensics Witness to the Stand"},"content":{"rendered":"

<\/p>\n

\n

Today, on the 11th day of the Tornado Cash trial<\/a>, Dr. Edman<\/a>, a co-founder and partner at Naxo, a firm specializing in digital forensics and investigations, testified for the bulk of the day.<\/p>\n

In his direct examination, he elucidated essential crypto terminology for the court, illustrated the degree to which Tornado Cash was decentralized, underscored the measures Roman Storm and the other Tornado Cash co-founders took to deter malicious entities from utilizing the service, and questioned the credibility of the analysis given by two preceding witnesses.<\/p>\n

During cross-examination, the prosecution pressed Dr. Edman to elaborate on and clarify various assertions he made and the evidence he presented in his testimony.<\/p>\n

Explaining How Tornado Cash Operates<\/h2>\n

In his presentation, Dr. Edman depicted Tornado Cash as a noncustodial platform that employed immutable smart contracts to conceal transactions<\/a>.<\/p>\n

As he introduced crypto-specific terminology that may have been unfamiliar to the jury, such as \u201ccryptographic signatures,\u201d \u201csmart contracts,\u201d and the previously mentioned \u201cimmutable,\u201d he provided definitions in simple terms.<\/p>\n

He was so meticulous in his explanations that it inadvertently caused him to lose some attention from the jury members along the way.<\/p>\n

\n
\n
\n

Yep, jury has a serious case of the Mondays today. Many slouched in their seats, one with her head in her hands rubbing her temples, another mindlessly picking her split ends, a few others frequently staring up at the clock on the back wall. <\/p>\n

To be fair, it\u2019s 12 non\u2013tech-savvy\u2026 https:\/\/t.co\/Qrmmuh9dXD<\/a><\/p>\n

\u2014 Eleanor Terrett (@EleanorTerrett) July 28, 2025<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n

Nevertheless, he made several significant points in his testimony, notably that the Tornado Cash pool contracts had been immutable since May 18, 2020, that the Tornado Cash DAO was involved in overseeing Tornado Cash (rather than just Storm and his co-founders), and that a \u201cminified\u201d (compressed) version of the source Tornado Cash user interface (UI) source code had been available on GitHub since nearly the beginning of the project for those with technical know-how to copy and utilize as desired.<\/p>\n

Dr. Edman also pointed out that even the UI for Tornado Cash was decentralized in a manner, as it resided on IPFS (InterPlanetary File System)<\/a>, a peer-to-peer storage mechanism for sharing data across distributed networks.<\/p>\n

The Safeguards Employed by the Tornado Cash Developers<\/h2>\n

Dr. Edman emphasized that Storm and his co-founders implemented a geoblocking strategy for the UI, making it increasingly challenging for individuals or entities from certain parts of the world, like North Korea or Cuba, to access the UI.<\/p>\n

He also remarked that the Tornado Cash developers incorporated the Chainalysis Sanctions Oracle<\/a> \u2014 a smart contract that contains a list of sanctioned addresses \u2014 within a month following Chainalysis\u2019 development of that tool.<\/p>\n

Questioning the Testimony of Two Other Witnesses<\/h2>\n

Dr. Edman indicated that he had analyzed the data presented last week by FBI Special Agent DeCapua in court<\/a>, pointing out that the wallets linked to the Ronin hack did not funnel funds through Tornado Cash. He mentioned that there were several hops from the Ronin hack wallet to Tornado Cash, complicating the validation of the analysis.<\/p>\n

He added that from September 1, 2020, to August 8, 2022, 85% of the funds that transited through Tornado Cash were \u201cunidentified,\u201d while merely 13% were attributed to hacks referenced in DeCapua\u2019s demonstrations, emphasizing that the majority of Tornado Cash users were not necessarily criminals<\/a>.<\/p>\n

Dr. Edman further critiqued the testimony of Philip Werlau, a blockchain auditor from AnChain.AI<\/a> and a witness for the prosecution.<\/p>\n

Dr. Edman was especially critical of Mr. Werlau\u2019s distinctive \u201cgas ratio analysis,\u201d which tracked cryptocurrency deposits into Tornado Cash. He asserted that he was unaware of this methodology\u2019s known error rates and that Mr. Werlau was also in the same position (he stated this during his testimony).<\/p>\n

Cross-Examining Dr. Edman<\/h2>\n

At the beginning of Dr. Edman\u2019s cross-examination, the prosecution emphasized that, from December 2020 to August 8, 2022, nearly all the funds processed through Tornado Cash were routed via a system set up by Storm and his co-founders.<\/p>\n

The prosecution displayed a slide demonstrating 7,764 deposits and 7,322 withdrawals for the 100 ETH Tornado Cash pool<\/a> utilizing the router in February 2022, a month in which no funds were processed directly through that pool.<\/p>\n

While Dr. Edman largely concurred with this observation, he did not support the prosecution\u2019s assertion that criminals were transferring illicit funds through the router, asserting that doing so would help them enhance their anonymity (the prosecution contended that criminals mixing their funds through the same entry point as all other users made the transactions less conspicuous).<\/p>\n

During the cross-examination, the prosecution also claimed that the proprietors of the Tornado Cash organization\u2019s GitHub account (Storm and his two co-founders) made the final decisions on UI inclusions and remarked that the source code for the UI was not as open source as Dr. Edman had indicated during his testimony.<\/p>\n

On this latter point, the prosecution argued that providing only the minified source code was not equivalent to offering the complete source code.<\/p>\n

Dr. Edman hesitated to concur with this evaluation and ultimately stated that under the stringent definition of open source provided by the prosecution, the Tornado Cash UI was technically not entirely open source from the beginning.<\/p>\n

The prosecution also questioned Dr. Edman on whether Storm and the other Tornado Cash developers had indeed integrated the geoblocking code.<\/p>\n

They presented a commit for the code that Dr. Edman had incorporated in his slides and pressed him to clarify whether he was certain that the code had been merged. Dr. Edman responded that it was to the best of his knowledge.<\/p>\n

A Second Witness Takes The Stand<\/h2>\n

With roughly 10 minutes remaining in the trial day, the defense called their second witness, Tyler Alameida, to testify.<\/p>\n

Mr. Alameida, who works in cybersecurity at Coinbase, testified about using Tornado Cash to maintain his privacy when transferring funds from his wallet to the Ukrainian war fund<\/a>.<\/p>\n

Although Judge Failla had not allowed much latitude for witnesses to discuss the privacy use case for Tornado Cash, she permitted Mr. Alameida to share his story during the just over five minutes he was on the stand.<\/p>\n

What\u2019s Next?<\/h2>\n

The defense will call additional witnesses to testify tomorrow, including a custodian from Chainalysis.<\/p>\n

Following that, the defense has indicated plans to introduce approximately four more witnesses, potentially including Roman Storm himself.<\/p>\n<\/div>\n