Tornado Cash Hacked: Governance Is In The Hands of The Hacker

Cryptocurrency tumbler Tornado Cash got hacked through a proposal made by a hacker. A Hacker made a proposal that executes code from a contract, and users voted for the proposal since contract code looked good, proposal passed. Hacker deployed the second contract which may result in drains in the governance contract.

Tornado Cash is an open source, non-custodial, fully decentralized cryptocurrency tumbler that runs on Ethereum Virtual Machine-compatible (EVM-compatible) networks.It provides a service that combines various cryptocurrency money with potentially traceable or “tainted” monies to obfuscate the origin of the funds. In EVM networks, where all transactions are by default public, this is a privacy mechanism that is employed.

On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.

A Hacker made a proposal that executes code from a contract, and users vote for the proposal since contract code looks good, proposal passed. Hacker self-destructed contract and deployed malicious one in same address, and 2nd contract is executed.

How did this happen? For more detailed investigation made by Twitter user @samcszun, check out his Twitter thread here.

What does this mean for Tornado Cash?

Through governance control, the attacker can:

  • Withdraw all of the locked votes.
  • Drain all of the tokens in the governance contract.
  • Brick the router.

However, the attacker still can’t:

  • Drain individual pools.

Users are advised to remove their funds from Tornado Cash Nova for further safety.

To withdraw funds from the Nova pool, you can either:

  • choose from a set of four predetermined amounts (0.1, 0.3, 0.5 & 1 ETH),
  • choose a completely customized amount by going through the button Set custom.

for more detailed explanation about withdrawing funds from Tornado Cash Nova, check the full article here.

Previous Article

Bitcoin Onchain Analysis 21.05.2023

Next Article

Hotbit Exchange Suspends All Transactions According to the Latest Announcement

Related Posts