Is Tornado Cash illegal?

Dealing with Tainted ETH: A Privacy Nightmare

So I’ve hit an incredibly frustrating roadblock while trying to isolate my long-term personal holdings from a freelance client's wildly sloppy on-chain footprint.

Last October, a guy paid me exactly 3.15 ETH for an independent security review. Everything seemed fine until I ran his sending address through an AML screening API I sometimes test out. It spit back a nasty 74% risk score. Apparently, his funds had indirect, third-degree hops linking back to a highly publicized flash loan exploit.

I just want to sever the transactional link before moving this ETH into my primary cold storage vault—because nobody wants accidental association freezing their centralized exchange accounts, right?

Naturally, my first instinct was to run it through a privacy protocol. But I am genuinely terrified of accidentally committing a federal crime. Which brings me to my core confusion: is Tornado Cash illegal for an average retail user just trying to maintain basic financial privacy?

I know the US Treasury’s OFAC sanctioned the protocol back in August 2022. Yet, the actual boundaries seem incredibly confusing to someone who isn't a regulatory lawyer. From my late-night research binges, I’ve mapped out these assumptions:

• Smart Contract Interaction: Simply sending assets to the sanctioned router addresses (if you are a US person) is supposedly a strict liability violation.
• The Contamination Factor: Even if my original ETH is legally earned, dumping it into that specific liquidity pool means I am mathematically trading fragments with literal hackers.
• The Exit Liquidity Problem: Almost every major compliant platform will instantly flag and lock accounts receiving deposits traced back to those specific mixer contracts.

I really need some practical advice here from anyone who has dealt with this mess. Do I just swallow the compliance risk and send this sketchy client ETH straight to an isolated burner wallet? How do you actually sanitize accidental high-risk crypto dust without crossing legal lines?