Hacker backs off control of Tornado Cash protocol after hijacking it

May 28, 2023

Barely days after a malicious hacker took over the Tornado Cash protocol, they have proposed to revert the changes and return control to the community. However, the attacker failed to clarify if they’d be returning the illegally obtained TORN tokens in the process.

This proposal followed the hacker’s forceful takeover of the protocol’s governance after granting 1.2 million votes to a malicious proposal. Having a proposal get more than the possible number of legitimate votes breached Tornado Cash’s governance, giving all control to the hacker.

After illegally accessing the protocol, the anonymous hacker drained $1 million worth of TORN from the governance system, making it one of the biggest crypto-related breaches this year.

Proposes to return protocol control to the community

In an unexpected turn of events, the anonymous hacker has submitted a proposal to hand over the protocol’s control back to the community after illegally moving $1 million worth of ETH and TORN tokens over the past week. Since the attack didn’t affect the protocol or any related technologies, there’s still hope for rebuilding.

The community passed the proposal by an enormous majority and is now awaiting implementation by any member of the organization in two days. However, some industry experts opine that the trust lost from the incident could slow down or completely stall Tornado Cash’s development going forward.

Auditing proposals might be necessary for DAOs – Experts

While talking to Fortune, CertiK co-founder Ronghui Gu explained that similar attacks are becoming increasingly widespread. He also suggested proposal audits as a possible solution to the problem, but in his words, “we currently definitely do not have such a thing as a practice in this industry.”

Even if the hacker agrees to give back the protocol’s control to the community, using it without fixing the inherent vulnerability is like sitting on a time bomb; someday, another malicious hacker will eventually discover a proposal-related vulnerability, allowing them to take over the system again.