Tornado cash is a mixer that allows people to have privacy in their Ethereum transactions. Ethereum works on an 'Account' based model which means if someone gets your account details in order to pay you, they can also see your entire transaction history and balance. They can also look into the balances of everyone you send to, or receive from, as well as all the NFTs you may have purchased. While we like the open nature of blockchains, this level of openness is very invasive and could be a terrible inhibitor for Ethereum's ambition of becoming a global "Ultra sound" money.

Tornado cash breaks the chain of surveillance by having multiple people put their funds into a 'mixing bowl' and then withdrawing their amount back out. Anyone watching the blockchain will not be able to connect the sender with the recipient.  

Any technology can be used for good or bad purposes. Take for example a hammer, which can be used to build something or to attack someone. Tornado cash can be used to create privacy by good or bad actors.

To quote directly the US Treasury as to how they justified these sanctions, "Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned virtual currency mixer Tornado Cash, which has been used to launder more than $7 billion worth of virtual currency since its creation in 2019. This includes over $455 million stolen by the Lazarus Group, a Democratic People’s Republic of Korea (DPRK) state-sponsored hacking group that was sanctioned by the U.S. in 2019, in the largest known virtual currency heist to date."

While you don't want money laundering by bad actors you also have the issue of hurting those that are using the tool for legitimate purposes. There is also concern because this is the first time in history a piece of open source code has been sanctioned. There have been outcries that this is sanctioning free speech, and rightfully so as code has been previously seen as speech by the US Courts.

Communication does not lose constitutional protection as “speech” simply because it is expressed in the language of computer code - Digital Law online.

To make matters worse, not all of that money was technically laundered, according to a crypto analytics firm, Elliptic. Roughly $7.6 billion worth of crypto has indeed passed through Tornado, but only $1.5 billion of those funds were illegally obtained (and, thus, laundered), Elliptic said in a report. 
Chainalysis, another blockchain monitoring firm, also reported that nearly half of that $7.6 billion sum came from DeFi (none of which, according to their research, is not necessarily illicit).

We even had Ethereum co-founder, Vitalik Buterin out himself as a TC user to send funds to the Ukrainian people in the middle of their war effort as a means to gain privacy on what should be a private donation, as well as provide security for those receiving the funds.