Is Tornado Cash illegal?

Okay, I'm seriously stressing out right now and need some blunt advice before I accidentally get my entire portfolio frozen.

Yesterday afternoon I ran my main hardware wallet through an online tracing tool—just doing some basic hygiene checks before the dreaded tax season begins—and a massive red warning immediately popped up. My stomach literally dropped. Back in November 2022, I bought 3.15 ETH off a reputable guy in a local trading Discord. Everything seemed totally fine at the time. Fast forward to today, and the forensics tracker shows those specific coins hopped straight out of a sanctioned mixer pool less than an hour before hitting my address.

So, I have to ask the obvious question: is Tornado Cash illegal simply to be downstream from?

I completely understand that the U.S. Treasury's OFAC department dropped the ban hammer hard in August 2022 by sanctioning the actual smart contracts. They essentially blacklisted open-source code. But I didn't mix anything myself!

My tracing dashboard slapped a highly specific 68.4% "critical risk" score on my entire balance. It's just sitting there mocking me.

Where I'm Getting Completely Lost

• Direct Interaction: Actively sending money to the sanctioned protocol addresses is a severe federal offense for US persons, right?
• Passive Receipt: What actually happens if you get dusted or buy tainted bags completely unknowingly? Am I holding literal contraband?
• Exchange Ruin: I suspect if I try to off-ramp this specific ETH chunk at any major centralized spot, they'll lock my account and demand a painful source-of-funds interrogation.

I genuinely need a practical exit strategy from folks who actually handle compliance friction on a daily basis. Privacy code is just math, but these strict liability regulations are terrifying. Have any of you accidentally triggered a severe exchange freeze because of historical mixer ties? Tell me exactly how you cleared your name without losing your stack.