An old privacy-pool deposit can be withdrawn only when its original private note still maps to the exact, unspent pool commitment; the wallet that made the deposit is not the credential. That conclusion holds where the contracts and a transaction route remain reachable, and it says nothing about whether a particular person may lawfully transact. A broken interface, no gas, or an unavailable relayer can block a transaction without making an intact note cease to control the deposit.
Can tornado cash deposits still be withdrawn?
Yes—an old deposit remains technically withdrawable when the private note is intact, the selected pool is the one used for the deposit, and its nullifier has not already been spent. tornado cash is a privacy-pool protocol: it records a public commitment on-chain while the user retains the secret material needed to prove a later claim.
A zero-knowledge proof, meaning proof that a statement is valid without disclosing the secret behind it, is what lets the contract verify eligibility without identifying the original deposit. The note is therefore closer to a bearer credential than to a wallet backup phrase.
3 checks separate a recoverable deposit from a dead end
The first check is whether the complete note exists. A deposit transaction hash, wallet history, screenshot, or seed phrase may help identify a deposit, but none recreates the secret values required to produce the proof.
The second check is pool identity. Classic pools use fixed denominations, and the note must correspond to the right asset, denomination, network, and contract context; the protocol’s fixed-pool design stores commitments rather than customer balances.
The third check is spent state. A nullifier is a public value used to prevent a valid private credential from being used twice. If a withdrawal already succeeded, its nullifier marks that note spent. No interface can reverse that cryptographic condition.
2 execution failures do not prove the funds are gone
A relayer failure is an execution problem, not a custody verdict. Relayers can broadcast a withdrawal and cover gas from the withdrawal amount; if one is unavailable, that does not alter the note’s validity. Likewise, a direct Ethereum transaction still needs a signing account and a fee: transactions change network state only after they are broadcast and included in a validated block, and they require gas. Ethereum’s transaction model explains why an empty recipient address cannot itself submit the transaction.
| Available evidence | What it establishes | Likely result |
|---|---|---|
| Complete note and correct pool details | Control of the withdrawal credential | Technically recoverable if unspent |
| Complete note but unavailable relayer | Control exists; execution route failed | Wait for or use a lawful viable route |
| Deposit hash or old wallet only | Evidence that a deposit occurred | Not enough to create a withdrawal proof |
| Complete note with a spent nullifier | The credential has already been redeemed | Not recoverable a second time |
The first row fits someone who preserved the original note. The second fits someone diagnosing a failed attempt. The third is an evidence-and-records problem, while the fourth is final at the protocol level.
21 March 2025 changed one U.S. sanctions fact, not the mechanics
On 21 March 2025, the U.S. Treasury removed economic sanctions against Tornado Cash. That historical action did not add account recovery, change the proof system, or make a missing note recoverable. Legal exposure can depend on jurisdiction, source of funds, counterparties, and later rules; technical possibility and legal permission are separate questions.
FAQ
Can support restore a lost note?
No. The system has no conventional account-recovery database holding the secret note.
Does a deposit transaction hash prove ownership?
No. It proves that a transaction occurred, not that its holder possesses the private withdrawal credential.
Can the original deposit wallet withdraw without the note?
No. The protocol checks the proof derived from the note, not ownership of the depositing wallet.