Tornado Cash Sanctions Lifted Amid Russian Cloudflare and Microsoft Turmoil

Tornado Cash Sanctions Lifted Amid Russian Cloudflare and Microsoft Turmoil

At a glance

• The U.S. Treasury lifted sanctions on Tornado Cash, a cryptocurrency mixing service, on March 21, 2025.
• Russia saw widespread outages of websites and services, reportedly tied to blocking of Cloudflare.
• Attackers abused Microsoft’s Trusted Signing service to sign malware with short-lived certificates.

Three stories from one week

Three stories stood out in late March 2025. The U.S. lifted sanctions on Tornado Cash, Russia had a broad web outage linked to Cloudflare, and criminals found a way to abuse a Microsoft code-signing service. Each one raised questions. Privacy, security and trust online were all in play that week, for users and regulators alike.

Tornado Cash sanctions lifted

Tornado Cash is a decentralized service that hides the trail of cryptocurrency transactions. On March 21, 2025, the U.S. Treasury removed it from its sanctions list.

The Treasury had sanctioned the service in 2022 over concerns that it was used to launder money, including funds stolen by North Korean hackers. A federal appeals court later ruled that the Treasury had exceeded its authority by sanctioning Tornado Cash’s code. The Treasury said it remains concerned about North Korean hacking and money laundering.

Russia’s Cloudflare outage

Russia saw a broad outage that hit consumer sites, banking, government and messaging services. Reports tied it to blocking of Cloudflare, which many websites use for content delivery and protection against attacks.

Cloudflare sits in front of a large share of websites. Block it, and much of the internet goes dark at once. Technical details were limited, but the outage showed how much depends on a handful of infrastructure providers that most users have never heard of.

Microsoft Trusted Signing abused

Attackers abused Microsoft’s Trusted Signing service, which issues code-signing certificates. They got short-lived, three-day certificates and used them to sign malware, making it look legitimate.

Signed files can slip past security controls that block unsigned programs. The abuse shows how attackers turn trusted services against users, and why defenders shouldn’t treat a valid signature as proof that a file is safe.

One week, three warnings

The three stories have little in common on the surface. Each still shows the tension between open technology and protecting users, and each will keep regulators and security teams busy.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.