Attackers Exploits Tornado Cash Dao via Vote Fraud

A malicious proposal has opened the gates for a cyber attack on Tornado Cash Governance.

The attacker withdrew all the locked votes, as well as the tokens in the governance contract and bricked the router after gaining full control.

At the start of the weekend, the attacker published a malicious proposal that hid the code function which grants access to fake votes which can be used to manipulate Tornado Cash, its token as well as withdraw the locked Torn tokens.

According to @samczsun of research-driven technology investment firm Paradigm, the proposal received more than 700,000 legitimate votes.

@samczsun.com

2023-05-22 09:58

On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control. https://t.co/nY87XmrYgT https://t.co/h9qjc3xRqz

1947 110

In his tweet, he added that the attacker used a technique similar to a proposal that has already been passed by the community. Although, the proposal had other functions at this time.

Clarifying the function of this malicious proposal, @samczsun explained that:

“Once the proposal was passed by voters, the attacker simply used the emergency-stop function to update the proposal logic to grant themselves the fake votes.”

The total amount of voters withdrawn by the attacker is 10,000 as TORN and sold it all, added by @samczsun

More About The Attack

Although the attack was not directed at the Tornado Cash protocol responsible for users to send funds through the service so as to hide the movement of funds and crypto addresses.

Meanwhile, Tornadosaurus-Hex, an active community for Tornado Cash affirmed that funds in Governance are compromised and advised users to quickly withdraw all their funds locked on the platform. According to a Tornado Cash community developer at the time this incident happened:

“There was an attack on the protocol this morning that you already know about. All day, another community developer and I thought about what to do, but the situation is close to hopeless – currently, the attacker controls Governance.”

Tornado Cash Scouting for Developers

The community added that they are trying to put a solution in place towards reverting the damages caused by this attack.

According to the organisation, they are currently in search of solidarity developers that can help salvage the protocol. The team additionally stated that they need to work closely with Binance because the exchange platform has more tokens than the attacker.

What Tornado Cash Users Need to Know

A former developer of the platform Tornado Cash is working on building a new crypto-mixing service from scratch to address the flaw existing in the protocol.

The developer added that in the hope of finding a solution to this cyber attack, he hopes that the solution will protect against further attacks on the operations of the system.

Pen Drop

What Tornado Cash users experience today shows that there is a need for users to be watchful with the exchanges and platforms they interact with especially when it comes to making money. It is also safe to say that these platforms need to be on their toes by providing efficient security for the safety of user’s funds.