Tornado Cash Heist: Attacker Holds Community Hostage
After entirely disrupting the Tornado Cash governance, the attacker is apparently trying to make a benevolent move, offering to restore the state of governance.
On May 20th, a malicious individual attacked Tornado Cash, disrupting its governance. As a result of the attack, the person received 1.2 million votes, significantly surpassing the 700,000 legitimative votes.
The person can now withdraw all the locked votes, drain all the tokens in the governance contract, and break the router. The only thing they can’t do is drain individual pools.
Despite such a huge advantage, the attacker has reportedly reached out to the community, offering a settlement. The proposal is available on the Tornado Cash forum, with a user called Tornadosaurus-Hex publishing the details and admitting that if the community doesn’t accept the proposal, it will end up in a highly precarious situation.
The original proposal contains a contract that should be able to reverse state changes. It is followed by another proposal that, according to Tornadosaurus-Hex, has a high chance of being executed.
A post by Tornadosaurus-Hex. Source: Tornado Cash forum
“If the proposal goes through (and it isn’t malicious), governance should be aware that they have to kill every single proposal that includes some type of SELFDESTRUCT call.
This until I or someone else pushes a proposal to update the Governance contract. I already have the fix logic ready, but I need to verify storage layouts such that a proxy upgrade doesn’t break the contract,” Tornadosaurus-Hex wrote.
The proposal is available via this link.
The native coin of Tornado Cash, Torn, took a significant hit in its price due to the hack, experiencing a 50% loss in value once the hack became known to the public. As of now, it is being traded at $4.45.
Torn’s price dynamics over the past seven days. Source: Coinmarketcap.
Previously, GNcrypto reported about the Horizon Bridge exploit.
