In a significant setback for decentralized crypto mixer Tornado Cash, a rogue actor managed to gain complete control of the governance through a harmful proposal. The attacker succeeded in adding 1.2 million votes to a damaging proposal on May 20 at 3:25 ET. Coupled with over 700,000 legitimate votes, this maneuver granted the attacker full governance authority.
Details of the Malicious Proposal
Paradigm’s @samczsun, who works with a research-oriented technology investment company, shared this information. The attacker, when promoting the harmful proposal, asserted it used logic akin to a previously community-approved proposal. However, this proposal introduced an additional function.
As @samczsun explicated, “Following the approval of the proposal by voters, the attacker exploited the emergencyStop function to modify the proposal’s logic and allocate themselves fabricated votes.”
Implications of the Attack
With total control over Tornado Cash’s governance, the attacker is in a position to withdraw all the locked votes, empty all the tokens in the governance contract, and dismantle the router. @samczsun reported that at the moment of writing, “the attacker simply pulled out 10,000 votes as TORN and sold them all.”
Also Read: Tornado Cash Developer to Remain Jailed for Money Laundering
A Call to Action for the Crypto Community
This incident serves as a warning for crypto investors to scrutinize proposal descriptions and logic carefully. A member of the Tornado Cash community, known as Tornadosaurus-Hex or Mr. Tornadosaurus Hex, confirmed the potential compromise of all funds in Governance. He urged all members to withdraw any funds locked in governance.
A Ray of Hope Amid Despair
Despite the bleak situation, attempts were made to deploy a contract that could potentially reverse the changes while still advising the community to withdraw their funds. Furthermore, a distress call from one of Tornado Cash’s community developers affirmed these developments and called for assistance from Solidity developers to save the protocol from demise.
Additionally, the team is reportedly seeking help from Binance, as the exchange holds more tokens than the attacker. This is a testament to the direness of the situation and the urgency of action needed to address it.
Interestingly, a former Tornado Cash developer is allegedly developing a fresh crypto mixing service from the ground up. This solution aims to fix Tornado Cash’s “critical flaw” and could potentially empower “the community to defend against hackers abusing the anonymity sets of honest users without requiring blanket regulation or sacrificing on crypto ideals.”
