An attacker who gained control over Tornado Cash put forward a proposal on May 21 that could reverse his original exploit.

Exploiter could undo his attack

Tornadosaurus-Hex, a community member, wrote:

“The [Tornado Cash] attacker posted a new proposal to restore the state of Governance. I think that there is a good chance he’s going to execute it.”

Tornadosaurus-Hex also noted that, because the attacker has control over Tornado Cash, other governance members have no choice in whether the proposal passes.

Other members of the community have warned that the attempt to restore the project’s default governance may not be benevolent. On Twitter, 0xdeadf4ce said that the plan could be an attempt to further manipulate the price of Tornado Cash’s TORN token.

A recovery could allow the attacker to capitalize on the fact that his original attack led the value of #TORN to drop significantly. TORN fell from $6.08 to as low as $3.57 in hours, marking a decline of 41%. The price has only partially recovered to $4.73 as of May 21, and even a brief recovery could make any stolen cryptocurrency more valuable.

If the recovery proposal is not an attempt to raise prices, it could be an attempt at trolling or an “expensive but not disastrous” lesson, 0xdeadf4ce concluded. The outcome of the recovery proposal will not be clear until May 26, he added.

Tornado Cash attack began on Saturday

On May 20, an attacker gained control over Tornado Cash by creating and voting for a proposal that gave him sole control over the project’s governance.

Paradigm researcher Samczun said that this allowed the attacker to withdraw all locked votes and withdraw all tokens in #Tornado Cash’s governance contract. Samczun said that though the attack allows the attacker to “do whatever they want,” the attacker ultimately chose to withdraw 10,000 votes as the TORN token and sell those assets.

It should be noted that Tornado Cash remains active in spite of the fact that the U.S. Treasury imposed sanctions on the project in August 2022.

The service is a decentralized coin mixer that handles only cryptocurrency. It seems that the U.S. government either is unable to directly enforce sanctions against Tornado Cash due to its lack of centralized operations or is uninterested in enforcement.

TORN price fell more than 40%, dropping from highs of $7.29 to lows of $3.55.

This is after the Tornado Cash DAO had passed a malicious proposal that included a bug from an attacker.

With complete control over the Tornado Cash governance system, the attacker proceeded to drain locked votes.

The price of TORN fell sharply as the market reacted to cryptocurrency news about a malicious takeover of the Tornado Cash governance.

In the initial market reaction, TORN price plummeted by nearly 50%, with sellers pushing the token’s value from highs of $7.29 to lows of $3.55. While further losses could still materialize, the token’s value has rebounded to above $4.40 as buyers attempt to keep the bears at bay.

At the time of writing, Tornado Cash is ranked 1,103 by market cap on CoinGecko. It has a market cap of $6.8 million, but has seen a total of $25.7 million worth TORN traded in the past 24 hours.

Attacker maliciously takes over Tornado Cash DAO

The price of Tornado Cash fell after an attacker took over the governance of the Tornado Cash DAO. The compromise happened after the community passed a malicious proposal, which the attacker used to drain funds from the governance treasury.

Tornado Cash is a crypto mixing service that runs on Ethereum. It was sanctioned by the US Treasury in February 2023. The governance system controls upgrades to the protocol and is run by those holding the project’s native TORN tokens.

On May 20, 2023, an attacker purportedly added an extra function to an upgrade passed by TORN holders. This gave the unknown entity an extra 1.2 million votes and effective control of the cryptocurrency’s governance system.

As highlighted by a pseudonymous crypto intelligence account Samczsun, control allowed the attacker(s) to withdraw 10,000 votes in TORN tokens. They sold these for $25,600 before draining the remaining amount of locked votes.

In total, 483,000 TORN was taken from the vault. 6,000 TORN was deposited on crypto exchange Bitrue, 379,000 was sold on-chain for $680,000 of ether, and just under 100,000 #TORN remains under the attacker’s control.

In the aftermath of the compromise, #Binance announced it would be halting TORN deposits until further notice.

Tron founder Justin Sun said TORN deposits and withdrawals on Huobi would remain open. Meanwhile, the Tornado Cash team says its working on a fix for the vulnerability.