Key Points:
- An attacker succeeded in obtaining complete control of the governance of the decentralized crypto mixer Tornado Cash with a counterfeit proposal.
- The project development team urges the community to withdraw from the protocol and is working on possible measures to resolve the incident.
Tornado Cash’s governance was compromised as a result of a fraudulent proposal. The attackers removed all TORN tokens from the protocol’s vault and sold them on the open market.
An attacker successfully gave 1.2 million votes to a fraudulent proposal on May 20 at 3:25 ET. Assuming that the proposition garnered over 700,000 valid votes, the attacker gained complete control over Tornado Cash.
The information was given by @samczsun of research-driven technology investment company Paradigm, who disclosed that while presenting the fraudulent proposal, the attacker claimed that it employed reasoning similar to a proposal previously approved by the community. This time, though, the suggestion had an extra purpose.
As @samczsun describes, this malicious recommendation is identical to prior regular ideas, except for the addition of a distinct line of code-named emergencyStop. After the proposal has been accepted by the voters, the attackers will use this emergencyStop function, which will result in a fresh logic update for the proposal that creates additional bogus votes.
With complete control over Tornado Cash governance, the attacker may remove all locked votes, drain all tokens in the governance contract, and brick the router. According to @samczsun, the attacker simply sold it 10,000 votes as TORN all at the time of writing.
The Tornado Cash attacker got 483,000 TORn from the Tornado Cash governance vault and 6,000 TORN into Bitrue before selling 379,300 TORN on the network for 375 ETH. There are 97,700 TORNs that have yet to be sold or transferred.
The hack serves as a caution to cryptocurrency investors to thoroughly review proposal descriptions and arguments. Tornado Cash’s active community member, Tornadosaurus-Hex or Mr. Tornadosaurus Hex, acknowledged that all money in governance is possibly compromised and asked that all members remove any funds held in Governance.
The team is presently looking for Solidity developers who can assist in saving the protocol from extinction. They also indicated that they need interaction with Binance, which has more tokens than the attacker.
Binance said that it would temporarily cease accepting TORN deposits owing to a governance assault on the Tornado Cash protocol.
A former Tornado Cash developer is reporting on the creation of a new crypto mixing service from the ground up, which tackles the “critical weakness” in Tornado Cash.
TORN is now trading at about $4.5, down over 30% in the previous 24 hours. The price is expected to plummet more as word of the assault travels around the community.
DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
Join us to keep track of news: https://linktr.ee/coincu
Harold
Coincu News
Source: https://news.coincu.com/188781-tornado-cash-governance-taken-by-attacker/