What Happened
Keonne Rodriguez and William Lonergan Hill built Samourai Wallet. Rodriguez went to prison for five years on November 6, 2025. Hill for four years on November 19. The charge: conspiring to operate an unlicensed money-transmitting business. They had pleaded guilty in late July after a two-count indictment alleged that Samourai processed more than $237 million in criminal proceeds across darknet markets, cyber intrusions, fraud schemes, sanctioned jurisdictions, and other illegal activity. The platform earned roughly $6.36 million in fees from that traffic, which was forfeited. The total forfeiture judgment stands at $237 million.
What emerged from the proceedings was a detail that reframes the entire case for anyone using Bitcoin privacy tools: during the prosecution, the DOJ asked FinCEN directly whether CoinJoin or non-custodial wallets qualified as money transmission. FinCEN answered no. This answer was consistent with FinCEN's 2019 guidance, which stated that entities providing only software without taking custody of assets are not subject to Bank Secrecy Act registration requirements applicable to money services businesses. The DOJ prosecuted regardless, relying on statutes outside the BSA framework — and won.
Why the Samourai Case Does Not Mean What You Think It Means
The temptation is to read Samourai's outcome as a ruling that Bitcoin privacy software is illegal. It is not. The convictions rested on specific, documented evidence of criminal facilitation that goes well beyond writing or publishing code. Rodriguez responded publicly on Twitter in July 2020 to a post encouraging hackers to use Whirlpool to launder stolen funds — personally urging them to 'feed' and 'send' proceeds into the service. Private WhatsApp messages obtained by prosecutors showed Rodriguez describing Samourai as 'money laundering for Bitcoin.' Hill's own communications were similarly explicit. The platform had a running coordinator server that operators controlled and maintained. It was continuously updated. It was actively marketed on darknet forums.
FinCEN's 2019 guidance distinguishes custodial from non-custodial wallets precisely because custody is the fulcrum of money transmission law. Samourai maintained a coordinator service that was not immutable — operators could and did update it, and that active involvement gave prosecutors a foothold the Tornado Cash defense was able to contest more credibly. The DOJ's theory in Samourai was not 'you wrote privacy software.' It was 'you knowingly operated an active service for criminal proceeds and left a documented record proving you knew it.' The evidentiary trail is what made this prosecution viable.
The Tornado Cash Comparison and Why April 9 Matters
Roman Storm's situation is structurally different and legally more consequential for the Bitcoin privacy community. Tornado Cash's smart contract pools were immutable — once deployed, the admin keys were burned, and no developer could modify, block, or reverse transactions. The Fifth Circuit ruled in November 2024 that OFAC exceeded its authority in sanctioning the immutable contracts. Treasury subsequently lifted the sanctions. The DOJ's criminal prosecution of Storm does not rest on sanctions law — it rests on the theory that Storm knowingly operated a money transmitting business by running the protocol's front-end website, holding governance tokens, and maintaining infrastructure adjacent to the immutable contracts.
Storm's Rule 29 motion for acquittal, with oral arguments on April 9, challenges whether the government presented legally sufficient evidence for the conviction on the money transmitter count. The defense argument: Tornado Cash never took custody of funds, Storm never controlled which transactions occurred, and the government's theory requires stretching the definition of 'operating a money transmitting business' beyond any reading consistent with FinCEN's own guidance. Judge Failla discouraged a First Amendment defense at trial, finding that the functional capability of code is not speech — a ruling the advocacy group Coin Center has argued relies on outdated case law. If Failla denies the acquittal motion, Storm faces an October retrial on the money laundering and sanctions counts, each carrying up to 20 years.
What This Means for You
The practical map of Bitcoin privacy tools under US law as of March 2026: Samourai Wallet is gone, its founders imprisoned, its domain now serving malware. Tornado Cash's Ethereum mixing pools are technically still operational — the immutable contracts cannot be taken down — but its front-end is gone, its developer is facing retrial, and using it carries regulatory risk. Whirlpool, Samourai's CoinJoin implementation, is offline with no active development.
What remains and why the legal risk profile differs: Sparrow Wallet's STONEWALL builds a single-person transaction that looks like a two-person CoinJoin, without any external coordinator. PayJoin requires both parties to the transaction but no third-party service. Wasabi Wallet's WabiSabi CoinJoin uses a coordinator, which is the structural element that most closely resembles Samourai — but Wasabi's coordinator does not take custody of funds, Wasabi's developers have not publicly marketed the tool to criminal users, and there is no documented evidentiary record of criminal facilitation comparable to what prosecutors presented in Samourai. That distinction matters legally. It does not make the risk zero. It makes the risk dependent on facts that do not currently exist.
The actionable posture: use tools with no central coordinator when possible. Sparrow's privacy features are the strongest option for self-custody Bitcoin privacy in the US environment right now. If you use Wasabi, understand that a coordinator exists and that future enforcement attention to that architecture is not hypothetical. Watch the April 9 Storm hearing — the judge's ruling on legal sufficiency will be the clearest signal yet of how far the current legal theory extends.
What to Watch
April 9 oral arguments on Storm's Rule 29 acquittal motion. A grant of acquittal ends the case and removes the most active DOJ prosecution of privacy software from the board. A denial means October retrial and continued legal uncertainty through at least late 2026. Watch also for the CLARITY Act's progress through the Senate Banking Committee — its developer protection provisions are the legislative path to resolving what FinCEN guidance and DOJ prosecution theory currently contradict each other on.