Hijacker’s Remorse in Tornado Cash Governance Tussle?

After a governance takeover, the perpetrator offers a proposal, but the community is skeptical

article-image

WindAwake/Shutterstock, modified by Blockworks

share

An unidentified hacker executed a hostile takeover of sanctioned cryptocurrency mixer Tornado Cash over the weekend. They successfully gained control over the protocol’s governance by submitting a malicious governance proposal, enabling them to assume full authority.

Samczsun, a security researcher at crypto-focused venture firm Paradigm, said in a tweet on Sunday that the attacker granted themselves 1.2 million votes through a malicious proposal. 

They gained complete control over Tornado Cash’s governance by generating more fake votes than legitimate votes, surpassing the threshold of 700,000.

Loading Tweet..

Tornado Cash is a decentralized privacy tool on the Ethereum blockchain that works by mixing funds pooled from multiple parties in uniform amounts, so it’s harder for anyone to trace specific deposits and withdrawals.

The protocol was built with a governance token called TORN, allowing token holders to participate in decision-making. The protocol is managed, at least partially, by a decentralized autonomous organization (DAO) comprised of these token holders.

By gaining control over Tornado Cash’s governance, the attacker has the power to withdraw all the locked votes and drain all the tokens in the governance contract. 

“Now that they have all the votes, they can do whatever they want. In this case, they simply withdrew 10,000 votes as TORN and sold it all,” samczsun said about the hack.

The protocol itself is immutable, so ETH deposited by users into the mixer is not at risk.

Tornado Cash faced sanctions from the US Treasury in August 2022 due to allegations of laundering about $7 billion in crypto since its establishment in 2019. Among the laundered funds is a significant amount of $445 million that authorities say was hacked by the North Korean hacker group Lazarus.

Following news of the exploit, Binance announced a temporary suspension of TORN deposits until further notice.

Blockworks has reached out to Tornado Cash for comment.

TORN recovers as proposal to reverse attack gains support

Technically, the code that was executed was not what token holders had voted for, but the contract contained an updatable dependency, and the attacker was able to replace part of it after the vote — effectively a bait and switch.

TORN plunged over 36% after the attack, according to Blockworks Research data. 

But the token recovered over 8% on Monday after the person who anonymously gained control of the protocol’s governance suggested a plan to undo the harmful code.

According to the new proposal, the attacker’s ownership of tokens would be reduced to zero. 

Based on current indications, it appears likely that the proposal will be approved once voting concludes on May 26. As of press time, there were over 517,000 votes in favor of the proposal.

In the Tornado Cash community forum, one user, using the pseudonym Tornadosaurus-Hex expressed belief that there is a “good chance” the attacker will follow through with the proposal. 

The user emphasized the significance of the proposal, even though the community may not have a say in its implementation.

Meanwhile, 0xdeadf4ce, another community member, said on Twitter that the new proposal could revert the damage done to the protocol’s governance.

“Either they’re giga trolling or it will end up being an expensive but not disastrous lesson in Governance security,” they added.

Loading Tweet..

They speculated that the new proposal might be an effort to increase the price of TORN, which plunged after the governance takeover.

Funds at risk on Gnosis Chain

The true target may also be a smaller implementation of Tornado called Nova, deployed on Gnosis Chain. Unlike the primary Ethereum pool, Nova is fully upgradeable by governance, meaning the ether in the pool are fully at risk of loss.

There is a 7-day timelock on upgrading the protocol’s contract, meaning any users with ETH in the pool, have a window of time to rescue their funds.

https://twitter.com/samczsun/status/1660042906500214784?s=20

Currently, there are roughly 500 ether, worth about $900,000 in the contract.

Macauley Peterson contributed reporting.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

recent research

LTIPPanalysis.png

Research

This report is a retroactive analysis of Arbitrum's Long Term Incentives Pilot Program (LTIPP). We collect relevant data at a protocol level and review bi-weekly updates to analyze recipients, their strategies, and the impact of the incentives on high level growth metrics. In particular, we want to highlight outperformers and underperformers, and glean any best practices or lessons learned for protocols distributing ARB incentives in the future. The overarching goal is to synthesize lessons learned that the DAO can reference as it begins thinking about future incentives programs–namely, the working group for incentives that is being actively discussed–especially as Timeboost introduces new conditions for trading and economic activity.

article-image

Sponsored

AI project Zerebro intersects the spheres of artificial intelligence, finance, art, music, and culture

article-image

Allmight is focused on furthering the United States’ leadership in crypto

article-image

The conditions Charles Schwab is waiting for before jumping headfirst into crypto could take shape soon

article-image

The FCA’s director of payments and digital assets shared some takeaways from chats with crypto companies and law firms

article-image

Let’s take a look at how US equities typically perform this time of year and what we might see in the coming days

article-image

Lumina introduces transparency and permissionless integration via an OP stack-based optimium, challenging traditional oracle designs