Cyber Incident Victim: Tornado Cash
Date:
May 2023
Location:
United States of America
Summary
A hacker exploited the decentralized crypto mixer Tornado Cash by concealing malicious code within a governance proposal. Once validators approved it, the attacker gained full control of the platform and stole approximately $1 million in cryptocurrency. The stolen funds were subsequently laundered through the platform's own obfuscation service. Following the theft, the hacker later proposed returning control to the community and patching the vulnerability.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 19, 2023, a hacker exploited the decentralized cryptocurrency mixer Tornado Cash. The attacker concealed malicious code within a proposal submitted to the platform's governance system. This governance system is operated by validators who review and vote on proposals to manage the platform. The validators responsible for reviewing this specific proposal overlooked the embedded malicious code and approved it. The passage of this proposal granted the hacker full and unrestricted control over the Tornado Cash platform.
With control of the platform secured, the hacker proceeded to steal assets. The total value of cryptocurrency stolen was one million dollars. The stolen funds consisted of Ethereum (ETH) and TRON tokens. Following the theft, the hacker utilized the platform's own obfuscation service, the Tornado Cash Router, to launder the stolen tokens. This action was an attempt to obscure the origin and ownership of the illicitly gained funds.
Subsequently, the hacker's behavior exhibited a significant shift. On Monday, May 22, the same individual who executed the exploit proposed a new action to the Tornado Cash governance system. This new proposal outlined a plan to patch the vulnerability that had been exploited and to return control of the platform to the community of users. A voting process on this proposal was initiated and was expected to reach a conclusion by the following Saturday, May 27. The outcome of this community vote was not detailed in the provided information.
The incident had immediate financial consequences, resulting in the direct loss of one million dollars in digital assets from the platform. Beyond the monetary impact, the exploit demonstrated a critical weakness in the governance model of a decentralized autonomous organization. The validators, who are a core component of this decentralized structure, failed to identify malicious code, which led to a complete compromise of the system. This breach of trust undermined the security assurances typically associated with decentralized governance and smart contract-based platforms.
In a separate but related ongoing legal matter, plaintiffs involved in a Coinbase-funded lawsuit concerning Tornado Cash referenced the platform's nature. They argued against the U.S. Department of the Treasury's sanctions on the mixer, stating that smart contracts are not property and that the sanctions prevent citizens from interacting with open-source code, which they claimed is a form of speech protected by the First Amendment. The Treasury Department, in its own filing, contested the characterization of Tornado Cash as purely decentralized, referring to it as a group of individuals organized to operate and promote a mixing service. This legal context forms a backdrop to the operational incident but is a distinct proceeding.
The technical response to the incident was initiated by the attacker themselves through the governance proposal to patch the vulnerability. The community's response was channeled through its governance mechanism, with a vote on the proposal to remediate the issue and restore community control. This represents an unusual case where the perpetrator of an attack also proposed the corrective action. The reliance on a decentralized voting process to address a security breach highlights the unique response dynamics within a DAO structure where there is no central authority to immediately enact fixes or countermeasures.
The broader ecosystem during this period also experienced other security events, though they were unrelated to the Tornado Cash exploit. These included a phishing-as-a-service operation known as Inferno Drainer that was used to steal $5.9 million from thousands of victims, a claimed hardware vulnerability in Trezor T model wallets that required physical access to the device, and a patched bug in the cross-chain protocol Celer that was discovered before any funds were lost. These simultaneous incidents illustrate the variety of threats present in the cryptocurrency environment during the same timeframe as the Tornado Cash governance attack.