Tornado Cash is an open source, non-custodial, fully decentralized cryptocurrency tumbler that runs on Ethereum Virtual Machine-compatible (EVM-compatible) networks.It provides a service that combines various cryptocurrency money with potentially traceable or “tainted” monies to obfuscate the origin of the funds. In EVM networks, where all transactions are by default public, this is a privacy mechanism that is employed.
On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.
A Hacker made a proposal that executes code from a contract, and users vote for the proposal since contract code looks good, proposal passed. Hacker self-destructed contract and deployed malicious one in same address, and 2nd contract is executed.
What does this mean for Tornado Cash?
Through governance control, the attacker can:
- Withdraw all of the locked votes.
- Drain all of the tokens in the governance contract.
- Brick the router.
However, the attacker still can’t:
- Drain individual pools.
Users are advised to remove their funds from Tornado Cash Nova for further safety.
To withdraw funds from the Nova pool, you can either:
- choose from a set of four predetermined amounts (0.1, 0.3, 0.5 & 1 ETH),
- choose a completely customized amount by going through the button
for more detailed explanation about withdrawing funds from Tornado Cash Nova, check the full article here.