Can a DAO Be Sanctioned? What Tornado Cash and Ooki DAO Prove

TL;DR - OFAC can list a DAO treasury's on-chain address directly, the way it did with 45 Tornado Cash wallets in 2022, and separately courts can hold individual DAO members personally liable, the way the CFTC did in the Ooki DAO case.

Your DAO's Snapshot vote just passed, the treasury multisig needs a third signature, and one of the signers is asking in the Discord whether approving the transfer could get the DAO itself sanctioned. It's a fair question. Two federal actions already answered pieces of it, and they answer it in different ways.

Two Separate Ways a DAO's Wallet Gets You in Trouble

The first path runs through the Treasury Department. The Office of Foreign Assets Control adds specific on-chain addresses to its Specially Designated Nationals list, and once an address is on that list, US persons can't transact with it, full stop. It doesn't matter whether a human, a multisig, or a DAO's governance contract holds the keys. An address is an address.

The second path runs through enforcement law, not sanctions law. Regulators like the CFTC can sue a DAO as an unincorporated association and go after the people who vote in it. No SDN listing required, no wallet freeze. Just a lawsuit and, if nobody shows up to defend it, a default judgment.

Both have already happened to a real DAO. Neither one is hypothetical, and neither one requires the DAO to have a legal entity, a website, or even a name most people recognize.

Can OFAC Actually Put a DAO Treasury on the SDN List?

Yes, and Tornado Cash is the proof. On August 8, 2022, OFAC added Tornado Cash and 45 associated Ethereum addresses, including the protocol's own smart contracts, to the SDN list under Executive Order 13694, citing roughly $7 billion in laundered crypto routed through the mixer. That designation treated the addresses themselves as the sanctioned party, not a named individual behind them.

A DAO treasury Safe works the same way, technically. OFAC's crypto SDN list currently runs to 780 addresses, and any screening tool that syncs it flags a match the instant one lands on the list, regardless of who governs the wallet or how many signatures it needs. The listing stuck for two and a half years before a court forced a reversal.

In November 2024, the Fifth Circuit ruled in Van Loon v. Treasury that Tornado Cash's immutable smart contracts aren't "property" under the statute OFAC relied on, and by March 2025 those addresses came off the SDN list. That reversal is its own story, and it doesn't undo the core fact: OFAC listed on-chain smart contract addresses once, and nothing in the statute stops it from listing a DAO treasury address the same way if the underlying conduct fits.

What the Ooki DAO Case Actually Decided

This one has nothing to do with OFAC. On September 22, 2022, the CFTC filed a civil action against Ooki DAO, arguing that a DAO with no legal wrapper is still an unincorporated association and can be sued as one. The bZeroX founders, who had handed the protocol's keys to DAO token holders, settled the same day for a $250,000 penalty.

Ooki DAO itself never showed up to court. There was no registered agent, no office, no CEO to serve papers on. So the CFTC served notice through the DAO's website help-chat box and its online forum - a first for a federal regulator, and a workaround that a judge later accepted as valid service.

On June 8, 2023, the US District Court for the Northern District of California granted a default judgment: a $643,542 civil penalty, a permanent trading ban, and an order requiring any host or registrar to pull the DAO's website offline. No wrapper, no shield.

Does Voting on a DAO Proposal Make You Personally Liable?

The CFTC's theory in Ooki was that governance-token holders who vote are members of the association, exposed to the same violations the association committed. A default judgment accepted that theory, but nobody contested it in court, so it's precedent by default, not by trial.

Signing a multisig transaction is a more direct act than casting a single Snapshot vote, and a treasury signer who executes a disbursement sits closer to the conduct than a token holder who voted yes three weeks earlier. Both roles sit inside the same association the CFTC argued it could sue. That gap hasn't been tested by a DAO that actually fought back, because Ooki DAO never mounted a defense in the first place.

The safer read for anyone who signs treasury transactions: assume the association theory holds until a contested case says otherwise. Screen the recipient before the signature, document why the funds moved, and don't treat "the DAO voted for it" as legal cover.

FAQ

Is Tornado Cash still on the OFAC sanctions list?

No. OFAC delisted Tornado Cash's addresses in March 2025 after the Fifth Circuit's ruling. Wallets with Tornado Cash history can still get flagged by individual exchange risk models even though the federal designation is gone - a gap covered in our breakdown of what changed after the delisting.

Does the Ooki DAO case mean OFAC can freeze a DAO's treasury wallet?

No. Ooki was a CFTC civil enforcement action against DAO members as an unincorporated association, not an OFAC sanctions designation against an address. The two tracks use different laws and produce different remedies - a penalty against people in one case, a frozen address in the other.

How does a DAO check whether a proposed treasury recipient is already sanctioned before a vote passes?

A signer can manually paste the address into Etherscan and cross-reference it against the published SDN list by hand, but that misses one-hop exposure to a sanctioned address and any mixer or stolen-funds history entirely. Plastron runs that same address against all 780 OFAC SDN crypto addresses plus a labeled corpus of more than 3,900 known scam, mixer, and stolen-funds wallets instantly, and shows the underlying exposure, not just a direct match - screen a treasury address with Plastron before the signature goes on-chain.

Does routing the treasury through a multisig protect it from being sanctioned?

No. OFAC matches addresses, not governance structures, so a Safe with five required signers gets flagged exactly the same way a single-key wallet does. A multisig doesn't change how sanctions screening treats the address underneath it.