I’ve been following the twists and turns of this case for a while now, and every new court filing seems to stretch the timeline a little further. When the news broke that a federal judge had moved Roman Storm’s retrial to April 26, 2027, I honestly sat back for a second and thought about how long this has already dragged on. Six months later than the earlier October 2026 plan. That’s not a small shift. For a developer who already spent weeks in a Manhattan courtroom and still faces the possibility of decades in prison, the delay feels both like a temporary breath and another long stretch of uncertainty.
Why The Retrial Timeline Suddenly Shifted
The order came down on August 25. U.S. District Judge Katherine Polk Failla agreed to the defense request and locked in the new date. Prosecutors had wanted things to move faster. Storm’s team pointed to scheduling conflicts and, more importantly, a still-unresolved motion that could change the entire picture. That motion, filed under Rule 29 back on September 30, 2025, asks the court to throw out the one conviction the first jury actually returned. Oral arguments on it happened in April 2026, yet no ruling has landed. Until that decision arrives, the defense argued, rushing into a second trial makes little sense.
I’ve found that these kinds of procedural pauses often reveal more about the underlying tension than the flashier headlines. The government still wants its second shot at the two counts that produced a hung jury the first time around. Storm still wants the existing conviction wiped away before he has to face another panel of twelve people. The judge ultimately sided with the later calendar. Expert disclosures now sit in early 2027. The final pretrial conference is set for April 20, just six days before the new trial date.
The Charges That Still Hang Over Everything
Let’s be clear about what remains on the table. The first jury, after weeks of testimony and four full days of deliberation in the summer of 2025, found Storm guilty of conspiracy to operate an unlicensed money transmitting business. That count carries a maximum of five years. On the two heavier charges—conspiracy to commit money laundering and conspiracy to violate U.S. sanctions—the jury deadlocked. Each of those carries up to twenty years. Do the math and you quickly see why the defense treats every procedural lever as critical.
Storm has said publicly that another trial exposes him to as much as forty years if both remaining counts stick. His legal resources took a serious hit during the first four-week proceeding. That kind of pressure changes how a defendant approaches scheduling. I’ve watched enough of these cases to know that resource exhaustion is real, especially when the underlying technology sits at the center of a larger policy fight.
A Quick Look Back At How We Got Here
Tornado Cash launched as an Ethereum-based privacy tool. Users deposit crypto into smart contracts and later withdraw to a different address, breaking the easy on-chain trail. For many privacy-minded people that function felt legitimate. For prosecutors the same function looked like a ready-made money-laundering machine once they tied large volumes of criminal proceeds—including funds linked to North Korea’s Lazarus Group—to the protocol.
Storm and co-founder Roman Semenov were charged in August 2023. The government alleged the pair kept developing, promoting, and benefiting from the service even after they knew illicit actors were using it. The defense has always pushed back hard: the smart contracts were immutable, the developers never took custody of user funds, and ordinary users could interact with the contracts without any developer approval of individual transfers.
Before the first trial even started, prosecutors narrowed one piece of the money-transmission theory. They dropped the portion tied to registration failures under a specific subsection, citing a Justice Department memo that urged caution against using technical registration violations to regulate crypto. The remaining theories stayed intact.
The Sanctions Backdrop That Quietly Changed
Here’s one of the more interesting wrinkles. The Treasury Department sanctioned Tornado Cash itself in August 2022. Later court challenges produced a different outcome. In November 2024 a federal appeals court ruled that immutable smart contracts could not be treated as property under the relevant sanctions statute because no one could own or control them. Treasury removed the sanctions designation on March 21, 2025. That decision did not end the criminal case against Storm. Prosecutors continued to argue that his earlier conduct still supported the conspiracy charges.
In my view, the removal of the sanctions created an odd dual reality. On one hand the protocol itself is no longer designated. On the other, the people who built it still face criminal exposure for the period when it was. That tension sits at the heart of a lot of the current debate about developer liability.
What The Pending Acquittal Motion Could Decide
Rule 29 lets a judge enter a judgment of acquittal when the evidence presented at trial is legally insufficient to support a conviction. Storm’s team argues that prosecutors never produced enough proof on the money-transmitting count. If the judge grants the motion, that conviction disappears. If she denies it, the conviction stands and the retrial on the other two counts moves forward as planned.
I’ve noticed that these motions rarely succeed, yet they force the court to confront the strength of the government’s case in a way a jury never does. The fact that oral arguments happened months ago and still no decision has issued suggests the judge is taking the arguments seriously. Or at least carefully. Either way, the calendar now gives everyone more time.
Privacy software can serve lawful purposes, and open-source development should not by itself establish criminal liability.
That sentiment has found support in parts of the broader Ethereum community. Fundraising for Storm’s defense has drawn significant backing, including matching commitments that helped push the total well past several million dollars. The case has become something of a proxy fight over how far criminal law should reach into the writing and maintenance of decentralized code.
Developer Control Versus Decentralized Reality
Perhaps the most interesting aspect of this entire saga is the philosophical disagreement about control. Prosecutors say Storm and the other founders went beyond simply publishing open-source software. They maintained parts of the project, promoted its use, and continued to profit while knowing bad actors were moving funds through it. The defense answers that once the contracts became immutable they could keep running without any further developer involvement, and that users never needed permission from the founders to interact with them.
That distinction matters far beyond one courtroom. If writing code that later gets used by criminals can create conspiracy liability even after the code is out of the developer’s hands, a lot of people working on privacy tools and other dual-use software will start looking over their shoulders. If courts ultimately accept the defense framing, the opposite risk appears: genuinely centralized services might try to wrap themselves in decentralization language to avoid oversight.
I’ve sat through enough conversations with builders to know this uncertainty already affects decisions. Some teams deliberately avoid any ongoing governance role. Others add more formal compliance layers early. The Storm case sits right in the middle of that live debate.
How The First Trial Actually Unfolded
The Manhattan trial ran for several weeks in the summer of 2025. After four days of jury deliberations the panel returned a split verdict on August 6. Guilty on the money-transmitting conspiracy. Hung on the money-laundering and sanctions conspiracies. The judge declared a mistrial on the unresolved counts and left prosecutors free to try again.
That outcome left both sides with partial victories and partial defeats. The government secured one conviction. The defense avoided two much heavier ones—for the moment. The retrial was originally eyed for the fall of 2026. The latest order pushes it deep into the following spring.
- One conviction already on the books carrying up to five years
- Two unresolved counts each carrying up to twenty years
- A still-pending motion that could erase the existing conviction
- A new trial date more than seven months away
Those four facts frame the next chapter. Everything else is commentary layered on top of them.
What The Delay Means For The Broader Industry
Cases like this rarely stay confined to the people named in the indictment. Other developers watch the procedural moves. Investors watch the legal risk premium attached to privacy projects. Policymakers watch whether courts treat code as speech, as a product, or as something closer to a financial service.
The fact that the sanctions designation itself was later withdrawn only sharpens the questions. If the protocol is no longer under Treasury’s designation, does that change how a jury should view the earlier conduct? The criminal case continues regardless, but the optics are different. I’ve spoken with people on both sides of the compliance debate who see the delay as giving everyone more time to refine those arguments.
There is also the practical reality of defense resources. Running a multi-week federal trial is expensive. Running a second one after the first has already depleted reserves is harder. The later date gives Storm’s team additional runway to prepare, raise funds, and perhaps benefit from any ruling on the Rule 29 motion.
Looking Ahead To Spring 2027
Under the new schedule the final pretrial conference lands on April 20, 2027. The retrial itself is set to begin six days later. Between now and then the judge will almost certainly rule on the acquittal motion. That single decision could reshape the entire remaining case.
If the motion succeeds, Storm walks into the second trial without a prior conviction hanging over him. If it fails, he walks in already carrying one felony count and facing two more that carry far longer sentences. Either way the underlying dispute about developer responsibility for decentralized tools will get another full airing.
In my experience these long-running cases often produce unexpected turns right before trial. New expert reports, shifts in government theory, or even settlement discussions can appear once the calendar forces everyone to focus. Right now the calendar has simply been moved. The underlying questions have not.
Storm remains free on bond while the process continues. That fact alone keeps the human element visible. Behind the legal arguments and the policy implications sits a person who helped build a tool that millions of people used for privacy and that, according to the government, also processed more than a billion dollars in criminal proceeds. Both descriptions can be true at the same time. Sorting out the legal consequences of that overlap is what the next trial will attempt to do.
The Larger Stakes For Privacy Technology
Step back from the individual case and the pattern becomes clearer. Privacy-enhancing tools keep running into the same collision: legitimate users want them, criminal users exploit them, and governments struggle to draw clean lines. Tornado Cash is only one example. Mixers, zero-knowledge systems, and other approaches face similar scrutiny.
The removal of the sanctions designation showed that courts are willing to push back when the government tries to treat immutable code as controllable property. The ongoing criminal case shows that prosecutors still believe individual developers can be held responsible for how that code is later used. Both outcomes can coexist, and both will influence the next generation of privacy projects.
I’ve found that the most constructive conversations happen when people stop treating the issue as purely ideological. Code that enables privacy also enables crime. Refusing to acknowledge either side produces bad policy. The Storm proceedings force that acknowledgment into the open, even if the final answers remain years away.
For now the concrete news is simple. The retrial that was once expected in the fall of 2026 will instead begin in the spring of 2027. A motion that could erase the existing conviction is still pending. Two serious charges remain unresolved. And a developer who helped create one of the most scrutinized privacy protocols on Ethereum continues to wait for the next chapter of a case that has already outlasted many expectations.
Whatever the eventual verdicts, the questions raised by this prosecution will linger. How much control must a developer exercise before criminal liability attaches? When does publishing open-source software cross into conspiracy? Can immutable smart contracts ever be treated as something a person still “operates”? Those questions will outlive any single trial date, even one pushed all the way to April 2027.
The delay buys time. It does not buy clarity. That will have to wait for the courtroom itself.
Practical Implications For Builders And Users Right Now
While the legal process grinds forward, people still build and use privacy tools every day. The practical takeaway for many teams has been caution mixed with continued development. Some projects have added more explicit disclaimers. Others have moved governance further away from the original creators. A few have simply accepted higher legal risk as the cost of offering strong privacy guarantees.
Users face their own calculus. The same features that protect ordinary people from surveillance also attract actors who want to hide stolen funds. No court ruling will eliminate that dual use. What courts can do is decide where the liability boundary sits. Until that boundary is clearer, the industry will keep operating in a gray zone that feels wider some months and narrower others.
The April 2027 date gives everyone a fixed point on the horizon. Between now and then the Rule 29 decision will likely land, expert reports will be exchanged, and the legal theories on both sides will be polished one more time. When the second jury finally sits, they will confront the same core dispute the first jury could not fully resolve: where does legitimate privacy software end and criminal conspiracy begin?
That question is bigger than any single defendant. It is also the reason this case continues to draw attention long after the first verdict came down. The calendar has changed. The underlying conflict has not.
Watching the procedural moves can feel dry. Understanding what those moves protect or delay is anything but. For Roman Storm the new date means more months of waiting and preparing. For the broader conversation about crypto privacy and developer responsibility it means the debate stays alive a little longer. Sometimes the most important developments are the ones that simply refuse to end on schedule.
