Hackers broke into the governance mechanism of the decentralized autonomous community (DAO) of crypto mixer Tornado Cash, gaining full control over it and starting to withdraw TORN tokens. The attack made the voting protocol completely dysfunctional.
The attackers gained full control of the Tornado Cash project by manipulating the crypto mixer’s DAO governance mechanism. According to an analyst at investment firm Paradigm, Tornado Cash’s governance mechanisms “effectively ceased to exist” due to the attack.
The hackers put a malicious proposal to the DAO’s vote. After community members began voting, the attackers used the EmergencyStop feature to get 1.2 million fake votes. The proposal was accepted, and the hackers gained full control of Tornado Cash’s governance, enabling the attackers to:
- withdraw all blocked votes;
- drain all the tokens locked in the governance contract;
- block the mixer’s governance mechanism.
Immediately after the attack, the hackers withdrew 10,000 votes as TORN. Afterward, according to a report from PeckShield analysts, they withdrew about 6,000 more TORN to the Bitrue platform and exchanged ~380,000 TORN for 372 ETH, which was transferred to the Tornado Cash crypto mixer. TORN quotes immediately plummeted by 25%, CoinGecko reported.
The Tornado Cash community tried to undo the changes by introducing a proposal, but it wasn’t accepted due to the fact that the attackers had full control over the voting mechanisms. The DAO participants noted that the crypto exchange Binance could theoretically help to remedy the situation, as it has more governance tokens than the hackers. However, Binance only announced the suspension of deposits in TORN. Tornado Cash users were advised to withdraw their assets from the app’s smart contracts.
A day after the attack, the hackers brought a new proposal to the DAO, which, if implemented, could fix the router’s damage. Some users believe that the hackers may have achieved their goals and are ready to give the community back the ability to control the crypto mixer, or perhaps they are just trolling.
On the other hand, the hackers may still be pursuing self-serving goals. For example, according to CoinGecko, TORN quotes rose by 10% after the release of the new proposal, so the hackers’ actions could simply be an attempt to gain community trust and artificially raise the price of tokens to sell them at a higher rate. The hackers voted in favor of their proposal but reserved the right to make the final decision. The vote will last until May 26, 2023, 11:53:38 a.m. (GMT+1).
Recall that in August 2022, Tornado Cash came under U.S. sanctions, but this didn’t stop criminals from continuing to use it to launder stolen funds. The arrest of Tornado Cash Developer Alexey Pertsev in the Netherlands sparked outrage from the cryptocurrency community, whose members said that the actions of the U.S. Treasury Department could have a detrimental effect on each Web3 protocol.
