The 50 ETH Deposit Six Hops From Tornado Cash
A VASP's blockchain analytics tool flags a customer's 50 ETH deposit as high risk because the funds are six hops from Tornado Cash. The customer says they sold an NFT and the buyer paid from a wallet that had used the mixer. The deposit arrived on Ethereum, was bridged to Polygon via a popular bridge, swapped to USDC, and withdrawn to a self-custody wallet. The analytics tool gives a 62% illicit exposure score but provides no direct transaction link to a sanctioned address. The customer has been with the VASP for two years, has completed enhanced due diligence, and has no prior alerts. The VASP is in a jurisdiction that implements OFAC-style sanctions but has no general prohibition on interacting with mixers. The compliance team must decide within 24 hours whether to freeze the withdrawal, file a suspicious transaction report, or close the alert.
1. How should the team interpret the 62% exposure score and the six-hop distance? What would make the alert a sanctions issue rather than a risk issue?
Read the worked answer
The 62% score is a risk signal, not a finding of sanctions exposure or illicit conduct. Six hops from Tornado Cash means the funds passed through a privacy-enhancing service at some point, but the tool has not identified a direct transaction with a sanctioned address or a sanctioned person. The first question is legal: does the VASP's jurisdiction prohibit dealing with the mixer itself, or only with sanctioned persons or property? If the jurisdiction implements OFAC-style sanctions, the VASP should determine whether any party to the transactions is sanctioned and whether the customer has a property interest in sanctioned funds. A six-hop connection is generally too remote to establish that on its own. The second question is risk: the mixer breaks the transaction trail, so the VASP cannot verify the source of the 50 ETH. That justifies enhanced due diligence and possibly a temporary hold, but not an automatic freeze or a conclusion that the customer is a launderer. The disposition should be documented as a risk decision, not a sanctions determination.
2. The customer provides an NFT sale contract and a buyer's wallet address. What verification steps would corroborate or undermine the explanation?
Read the worked answer
Verify the NFT sale independently. Check the marketplace or on-chain transfer of the NFT, the sale price, the buyer's address, and the timestamp. Confirm that the 50 ETH deposit amount and timing are consistent with the sale proceeds, allowing for fees and price movement. Then examine the buyer's wallet: did it receive funds from the mixer before paying the customer, and is there any link to the customer beyond this sale? Check whether the customer or the buyer used the same wallet, whether the sale was wash trading, and whether the NFT had a real market history. Ask for the customer's sale records, communications with the buyer, and any platform statements. A credible explanation would show an arm's-length sale with a buyer whose mixer use predates the purchase and whose wallet is not otherwise linked to the customer. A weak explanation would show a buyer wallet funded by the customer, a circular flow, or an NFT with no independent market.
3. Recommend a disposition and document the rationale. Address freezing, STR filing, and customer communication.
Read the worked answer
A defensible disposition is a temporary hold while the enhanced review is completed, not an indefinite freeze based on the score alone. The VASP should document the six-hop distance, the absence of a direct sanctioned address, the customer's two-year history, the completed EDD, and the verification of the NFT sale. If the sale is corroborated and no direct sanctions nexus exists, release the withdrawal and place the customer on enhanced monitoring for a defined period. If the buyer's wallet is directly linked to a sanctioned address or the customer cannot explain the flow, escalate to a freeze and file a suspicious transaction report. In either case, file an STR if the jurisdiction requires reporting of suspected illicit funds, and avoid tipping off the customer. The file should include the analytics screenshot or export, the transaction path, the customer's explanation, the corroborating documents, and the reasoning for the final decision.