So addresses receiving money from the mixer are barred from various exchanges/defi protocols.
How does that work? Can't the addresses just send ETH from the mixer for example to some other addresses and use the new addresses? They can use a smart contract to relay the money to new addresses too if the protocols detect 'sending' transactions.
tl;dr: basically the sanctions are for show and are unlikely to achieve whatever OFAC and DOJ imagines it would achieve. It doesn't work and cannot work to deal with APTs thanks to the ability to directly call the contracts and instead may create harm and a chilling effect to speech. It is either a bad faith effort or instituted out of ignorance, but either way, futility is the word that comes to mind on the subject in a substantive way, but the implications.
Oh, disclaimer: Not legal advice. I'm not your lawyer and will never be your lawyer and without an active case in court my assessments are based on press releases and regulatory filings on the legal side, not an actual set of facts specific to a case in question.
I feel like this question should almost be moved to the law stackexchange because the "how does this work" part has a much better legal answer to address it than a technological one, one that is more comprehensive and can allow for room to discuss the nuances and contradictions and failures on the side of the regulators and by implication, the lack of meaningful understanding between the two industries that brought us to what is effectively a nonsensical and in all likelihood performative but wasteful and futile policy that nevertheless had a major impact on the 90+% of legal users as extrapolated from Cyclone Finance, a clone of TORN, and an analysis of their on-chain data as compiled by a crypto and blockchain analysis firm in a white paper (it has no new insights and requires PII to obtain a copy so I won't link it here, although if you are truly curious, let me know in the comments and I'll see if I can accomodate). But the short answer is that they are essentially sanctioning the theoretical controllers of private keys who interact with the TORN contract. Without court filings it's not really possible to grasp OFAC and DOJ, the criminal end of the sanctioning regime, intends/believes, but what they can and seems to have actually achieved is something different, which is to chill speech (in the American, 1st Amendment sense of speech), full stop.
Because there are several aspects of the sanctions that are facially ludicrous and arguably outside of what OFAC is mandated to do unless one gives them the benefit of the doubt in the form of ignorance, which isn't ideal either. Yes, they are blacklisting Ethereum addresses, but OFAC has little jurisdiction control directly when a country says no to their demands and you can easily create new addresses, since Ethereum keypairs are ultimately just very large integers, and the criminal justice system can't prosecute a number for a billion obvious reasons but the most salient one is the fact that one cannot put a number behind bars, cross examine a number on the stand, or attribute intent to a number (hence, the 'dusting attack' on celebrities ends up a project to give said celebrities a bit of free money).
TORN is also not even close to the only on-chain - not to mention off-chain - solution to swap, bridge, transform, deposit, burn, mint, etc. There are multiple privacy coin implementations like XMR, with significant market capitalization and acceptance, that in court filings concerning the blockchain, that Chainanalysis, the most prominent crypto analysis company that for all intents and purposes is in a position of regulatory capture when it comes to blockchain tracing, does not have the capability to directly track XMR transactions. Clustering and OSINT/customer-sourced attribution is the primary manner by which, at least on EVM-based chains, individual addresses, and that, too, is insufficient to represent anything on its own, not to mention that while clustering itself is likely accepted as a method of grouping addresses together, its reliability - largely in its inability to eliminate false-positives thanks to the fact that mnemonics and keys, even mnemonics of hardware wallets, can be used, stolen, expropriated, and hence, throw off the reliability of clustering.
Without attribution that is accurate, not only is the DOJ unable and in all likelihood unwilling to charge anyone, but OFAC would have a hard time getting funds frozen as long as the balance stays on chain. Taint analysis, at this point, seems woefully inadequate as well. I've had deposits made from Uphold and Binance blocked by Nexo because of some sort of alleged connection to a DNM, which, when the funds are coming directly from hot wallets of large, established, and registered exchanges, is indicative of the state we're in when it comes to taint analysis and the identification of source of funds - one of these instances happened last week for, in fact, although it was cleared up pretty quickly.
Without a reliable attribution system that can link specific transactions made by specific public keys to specific acts of individuals, it the most that can be accomplished involves not the government instituting fines and starting criminal prosecutions but essentially relying on the assumption that most end-users are ignorant enough to create a chilling effect. On a tech level, your intuition would be, at least under current law and rules of evidence on the federal level, be more or less correct in that it's more bark than bite, and all of the bite is biting the wrong end-user - imagine if you need to get crypto, which is the one thing of monetary value that one can truly own in China, out of the country. The CCP will call that money laundering. Would the US government go out of their way to help the CCP in stripping assets from those whose crime is entirely political (since there's no working legal system in the country). On-chain transactions are capable of circumventing the worst excesses of authoritarian regimes. Sanctions, by reducing liquidity available in the protocol, endanger dissidents, journalists, or those who are oppressed for a variety of reasons. So the sanctions aren't exactly "doing nothing", it's just not capable of achieve anything the government wishes it could achieve, and have tremendous potential to cause actual, IRL harm to others.
I realize that tech and legal people tend to fall into the jargon trap so feel free to ask for clarifications. I've been involved in both spheres for so long that I can't tell what is jargon and what is common knowledge sometimes and if there's something I wrote that sounds like gibberish, feel free to ask.
Every address that interacts with Tornado Cash (i.e. sends OR receives funds from Tornado Cash) is flagged.
So even a smart contract receiving money from Tornado Cash and then sending it to an address could have the address flagged if the US government forensic team does a good job.
One of the downside (and upside) about dealing with the blockchain is that it's an open decentralized ledger, so anyone can follow the money.
Edit: To extend on that, here are 2 quotes from 2 articles linked below:
From this article: "OFAC’s sanctions on Tornado Cash also blacklisted a number of wallet addresses associated with the tool. Interacting with those addresses in any manner is theoretically tantamount to conducting business with a hostile government or terrorist organization"
Another one: "Recently, entities distributed 0.1 ETH to a variety of celebrities in a "dusting" attack. Recipients of these Tornado-tainted digital assets may technically have transacted with a sanctioned entity and themselves be in violations of U.S. sanctions. However, it appears unlikely that the celebrity dusting attack victims will be charged.19".
