Decentralized crypto mixing platform Tornado Cash recently suffered a significant attack on its governance. A malicious proposal recently subverted its governance system, providing the threat actor with complete control over the protocol.
The threat actor successfully shifted 1.2 million votes to a proposal with deceptive intent on May 20th. This initiative received more than 700,000 legitimate votes, enabling the attacker to fully command Tornado Cash governance. This incident was highlighted by @samczsun, a researcher at Paradigm, a research-driven technology investment firm.
On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.https://t.co/nY87XmrYgT pic.twitter.com/h9qjc3xRqz
— @samczsun.com (@samczsun) May 20, 2023
The attacker claimed their proposal employed logic akin to a previously approved
We współpracy z: https://cryptodaily.co.uk/2023/05/malicious-proposal-exploits-tornado-cash-governance
