Tornado Cash website, discord offline after community finds malicious code in protocol’s backend Tornado Cash website, discord offline after community finds malicious code in protocol’s backend
The backend exploit that has put user deposits and sensitive data at risk.
2 min read
Updated: Feb. 26, 2024 at 5:04 pm UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
Crypto mixer Tornado Cash has reportedly fallen victim to a significant backend exploit that has put user deposits and sensitive data at risk.
The security breach was revealed in a Medium post by Gas404, a community member, on Feb. 26.
The exploit represents a critical vulnerability for Tornado Cash, whose trading volume already suffered a dramatic decline following sanctions from the US Treasury Department’s Office of Foreign Asset Control (OFAC) in August 2022.
The sanctions, which were part of broader measures targeting the crypto sector, had significantly reduced the mixer’s operational scale even before the exploit.
Malicious code
According to the Medium post, malicious JavaScript code was discovered in the protocol’s backend. It was reported injected through a compromised governance proposal submitted by an individual posing as a Tornado Cash developer on Jan. 1.
The code surreptitiously redirects user deposit information to a server controlled by the attacker, posing a dual threat — the exposure of deposit data and the outright theft of the deposits themselves.
One such theft has been confirmed through transaction records on Etherscan, highlighting the exploit’s immediate impact.
The exploit’s technical details were discussed at length in the community post, illustrating the sophisticated nature of the attack.
Specifically, the malicious code was designed to encode and exfiltrate private deposit notes, effectively breaching the anonymity and security that Tornado Cash users depend on.
Proposed solution
In response to the crisis, Gas404 has proposed a solution to mitigate the damage: reverting Tornado Cash to a prior version of its IPFS deployment.
The move aims to secure the platform against the current vulnerability by utilizing a previously established and ostensibly secure infrastructure setup.
The proposed change emphasizes the urgency of addressing security flaws within decentralized platforms, where governance proposals can be manipulated for malicious purposes.
The Tornado Cash website and Discord channel were taken offline following the revelation and have yet to come back online — an indication of the exploit’s severity and the ongoing efforts to contain its repercussions.
Mentioned in this article
Author 
Assad Jafri
AJ, a passionate journalist since Yemen's 2011 Arab Spring, has honed his skills worldwide for over a decade. Specializing in financial journalism, he now focuses on crypto reporting.
Featured Story
Advertise Here
In this article
Tornado Cash
$3.66441
Tornado Cash is a decentralized, non-custodial privacy solution built on Ethereum.