Hijacker’s Remorse in Tornado Cash Governance Tussle?

Tornado Cash is a decentralized privacy tool on the Ethereum blockchain that works by mixing funds pooled from multiple parties in uniform amounts, so it’s harder for anyone to trace specific deposits and withdrawals.

The protocol was built with a governance token called TORN, allowing token holders to participate in decision-making. The protocol is managed, at least partially, by a decentralized autonomous organization (DAO) comprised of these token holders.

By gaining control over Tornado Cash’s governance, the attacker has the power to withdraw all the locked votes and drain all the tokens in the governance contract. 

“Now that they have all the votes, they can do whatever they want. In this case, they simply withdrew 10,000 votes as TORN and sold it all,” samczsun said about the hack.

The protocol itself is immutable, so ETH deposited by users into the mixer is not at risk.

Tornado Cash faced sanctions from the US Treasury in August 2022 due to allegations of laundering about $7 billion in crypto since its establishment in 2019. Among the laundered funds is a significant amount of $445 million that authorities say was hacked by the North Korean hacker group Lazarus.

Following news of the exploit, Binance announced a temporary suspension of TORN deposits until further notice.

Blockworks has reached out to Tornado Cash for comment.

TORN recovers as proposal to reverse attack gains support

Technically, the code that was executed was not what token holders had voted for, but the contract contained an updatable dependency, and the attacker was able to replace part of it after the vote — effectively a bait and switch.

TORN plunged over 36% after the attack, according to Blockworks Research data. 

But the token recovered over 8% on Monday after the person who anonymously gained control of the protocol’s governance suggested a plan to undo the harmful code.

According to the new proposal, the attacker’s ownership of tokens would be reduced to zero. 

Based on current indications, it appears likely that the proposal will be approved once voting concludes on May 26. As of press time, there were over 517,000 votes in favor of the proposal.

In the Tornado Cash community forum, one user, using the pseudonym Tornadosaurus-Hex expressed belief that there is a “good chance” the attacker will follow through with the proposal. 

The user emphasized the significance of the proposal, even though the community may not have a say in its implementation.

Meanwhile, 0xdeadf4ce, another community member, said on Twitter that the new proposal could revert the damage done to the protocol’s governance.

“Either they’re giga trolling or it will end up being an expensive but not disastrous lesson in Governance security,” they added.