{"id":4410,"date":"2025-07-29T12:16:16","date_gmt":"2025-07-29T12:16:16","guid":{"rendered":"https:\/\/digkrypton.com\/index.php\/2025\/07\/29\/tornado-cash-trial-enters-week-three-defenses-expert-digital-forensics-witness-takes-the-stand\/"},"modified":"2025-07-29T12:16:16","modified_gmt":"2025-07-29T12:16:16","slug":"tornado-cash-trial-enters-week-three-defenses-expert-digital-forensics-witness-takes-the-stand","status":"publish","type":"post","link":"https:\/\/digkrypton.com\/index.php\/2025\/07\/29\/tornado-cash-trial-enters-week-three-defenses-expert-digital-forensics-witness-takes-the-stand\/","title":{"rendered":"Tornado Cash Trial Enters Week Three, Defense\u2019s Expert Digital Forensics Witness Takes the Stand"},"content":{"rendered":"

Bitcoin Magazine<\/a><\/p>\n

Tornado Cash Trial Enters Week Three, Defense\u2019s Expert Digital Forensics Witness Takes the Stand<\/a><\/p>\n

<\/div>\n

Today, on day 11 of the Tornado Cash trial<\/a>, Dr. Edman<\/a>, co-founder and partner at Naxo, a digital forensics and investigations firm, took the stand for the majority of the trial day.<\/p>\n

In his direct testimony, he defined key crypto terms for the court, explained the extent to which Tornado Cash was decentralized, highlighted the precautions Roman Storm and the other Tornado Cash co-founders took to prevent bad actors from using the service, and called into question the validity of the analysis presented by two former witnesses.<\/p>\n

During the cross-examination, the prosecution prodded Dr. Edman to share details and to provide nuance regarding some of the claims he made and the data he presented in his testimony.<\/p>\n

Describing How Tornado Cash Works<\/h2>\n

In his slides, Dr. Edman described Tornado Cash as a noncustodial service that used immutable smart contracts to anonymize transactions<\/a>.<\/p>\n

As he introduced crypto-specific words and phrases that might have been unfamiliar to the jury such as \u201ccryptographic signatures,\u201d \u201csmart contracts,\u201d and the aforementioned \u201cimmutable,\u201d he defined them in layperson\u2019s terms.<\/p>\n

He was so thorough in doing so that his efforts became seemingly counterproductive in that he lost some of the members of the jury in the process.<\/p>\n

\n

Yep, jury has a serious case of the Mondays today. Many slouched in their seats, one with her head in her hands rubbing her temples, another mindlessly picking her split ends, a few others frequently staring up at the clock on the back wall. <\/p>\n

To be fair, it\u2019s 12 non\u2013tech-savvy\u2026 https:\/\/t.co\/Qrmmuh9dXD<\/a><\/p>\n

\u2014 Eleanor Terrett (@EleanorTerrett) July 28, 2025<\/a>\n<\/p><\/div>\n

That said, he did make a number of notable points in his testimony, including that the Tornado Cash pool contracts had been immutable since May 18, 2020, that the Tornado Cash DAO played a role in governing Tornado Cash (as opposed to just Storm and his co-founders), and that a \u201cminified\u201d (reduced) version of the source Tornado Cash user interface (UI) source code had existed on GitHub since nearly the onset of the project for the technically inclined to copy and use as they pleased.<\/p>\n

Dr. Edman also noted that even the UI for Tornado Cash was decentralized in a sense in that it existed on IPFS (InterPlanetary File System)<\/a>, a peer\u2013to-peer storage system for sharing data across distributed networks.<\/p>\n

The Precautions The Tornado Cash Developers Took<\/h2>\n

Dr. Edman highlighted the fact that Storm and his co-founders applied a geoblocking system to the UI, making it more difficult for people or entities from certain regions of the globe, like North Korea or Cuba, to use the UI.<\/p>\n

He also noted that the Tornado Cash developers implemented the Chainalysis Sanctions Oracle<\/a> \u2014 a smart contract that includes a list of sanctioned addresses \u2014 within a month of Chainalysis\u2019 creating the tool.<\/p>\n

Criticizing The Testimony of Two Other Witnesses<\/h2>\n

Dr. Edman stated that he\u2019d reviewed the data that FBI Special Agent DeCapua presented last week<\/a>, while pointing out that the wallets associated with the Ronin hack didn\u2019t move funds through Tornado Cash. He said that there were a number of hops from the Ronin hack wallet to Tornado Cash, making the analysis harder to validate.<\/p>\n

He added that from September 1, 2020 to August 8, 2022, 85% of funds that moved through Tornado Cash were \u201cunidentified\u201d while only 13% were from hacks from DeCapua\u2019s demonstrations, making the point that the majority of Tornado Cash users weren\u2019t necessarily criminals<\/a>.<\/p>\n

Dr. Edman also critiqued the testimony from Philip Werlau, a blockchain auditor from AnChain.AI<\/a> and a witness for the prosecution.<\/p>\n

Dr. Edman was particularly critical of Mr. Werlau\u2019s unique \u201cgas ratio analysis,\u201d which tracked crypto deposits into Tornado Cash. He stated that he doesn\u2019t know of this methodology\u2019s known error rates and that neither did Mr. Werlau. (He said as much in his testimony.)<\/p>\n

Cross-Examining Dr. Edman<\/h2>\n

Toward the beginning Dr. Edman\u2019s cross-examination, the prosecution harped on the fact that, from December 2020 until August 8, 2022, almost all of the funds that moved through Tornado Cash were put through a router that Storm and his co-founders had set up.<\/p>\n

The prosecution showed a slide illustrating Tornado Cash\u2019s 7,764 deposits and 7,322 withdrawals for the 100 ETH Tornado Cash pool<\/a> via the router in February 2022, a month in which no funds were processed through said pool directly.<\/p>\n

While Dr. Edman largely agreed with this being the case, he didn\u2019t support the prosecution\u2019s claim that the criminals were moving illicit funds through the router because doing so helped them to increase their anonymity. (The prosecution argued that the criminals\u2019 putting the funds through the same entry point as all of the other users helped to make the transactions not stand out.)<\/p>\n

Also during the cross-examination, the prosecution stated that the owners of the Tornado Cash organization\u2019s GitHub account (Storm and his two co-founders) made the final decisions regarding what was included in the UI and they added that the source code for the UI wasn\u2019t as open source as Dr. Edman claimed it was during his testimony.<\/p>\n

To the latter point, the prosecution argued that only providing the minified source code wasn\u2019t the same as providing the full source code.<\/p>\n

Dr. Edman was reluctant to agree with this assessment, and settled by stating that under the strict definition of open source the prosecution provided, the Tornado Cash UI wasn\u2019t technically fully open source from the onset.<\/p>\n

The prosecution also asked Dr. Edman whether Storm and the other Tornado Cash developers actually incorporated the geoblocking code.<\/p>\n

They showed a commit for the code that Dr. Edman had included in his slides, and pressured Dr. Edman to share whether or not he knew for sure the code was merged. Dr. Edman said that it was to the best of his knowledge.<\/p>\n

A Second Witness Takes The Stand<\/h2>\n

With approximately 10 minutes left in the trial day, the defense called their second witness of the day, Tyler Alameida, to the stand.<\/p>\n

Mr. Alameida works in cybersecurity at Coinbase and testified to the fact that he once used Tornado Cash to preserve his privacy as he sent funds from his wallet to the Ukrainian war fund<\/a>.<\/p>\n

While Judge Failla hadn\u2019t allowed much space for the witnesses to talk about the privacy use case for Tornado Cash, she did permit Mr. Alameida to tell his story within the just over five minutes he was on the stand.<\/p>\n

What\u2019s Next?<\/h2>\n

The defense will call more witnesses to the stand tomorrow, one of which will be a custodian for Chainalysis.<\/p>\n

After that the defense has stated that it plans to bring approximately four more witnesses to the stand, including potentially Roman Storm himself.<\/p>\n

This post Tornado Cash Trial Enters Week Three, Defense\u2019s Expert Digital Forensics Witness Takes the Stand<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Frank Corva<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Tornado Cash Trial Enters Week Three, Defense\u2019s Expert Digital Forensics Witness Takes the Stand Today, on day 11 of the Tornado Cash trial, Dr. Edman, co-founder and partner at Naxo, a digital forensics and investigations firm, took the stand for the majority of the trial day. In his direct testimony, he defined key […]<\/p>\n","protected":false},"author":0,"featured_media":4411,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-4410","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-bitcoin"},"acf":[],"_links":{"self":[{"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/posts\/4410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/comments?post=4410"}],"version-history":[{"count":0,"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/posts\/4410\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/media\/4411"}],"wp:attachment":[{"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/media?parent=4410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/categories?post=4410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digkrypton.com\/index.php\/wp-json\/wp\/v2\/tags?post=4410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}