BTC

$98168.445

4.51%

ETH

$3353.251

9.68%

BNB

$620.922

2.71%

XRP

$1.191

9.82%

News

Tornado Cash Back-End Attack, Putting User Deposits at Risk!

February 26, 2024 - Around 2 mins mins to read

Key Points:

  • Tornado Cash back-end attack exposes user deposits as malicious code infiltrates Tornado Cash.
  • Significant drop in trading volume follows U.S. Treasury Department sanction in August.
  • Gas404 suggests reverting to a secure IPFS ContextHash deployment for resolution.
User deposits on the decentralized token mixer, Tornado Cash back-end attack face a severe security threat.
Tornado Cash Back-End Attack, Putting User Deposits at Risk!

A Medium post by community member Gas404 has exposed the insertion of malicious code into the protocol’s back end, potentially compromising the safety of user funds.

According to Gas404, the nefarious javascript code was cleverly concealed within a governance proposal submitted by an alleged Tornado Cash developer on January 1. The malicious code’s primary function is to redirect deposit data to a public server controlled by the alleged developer, jeopardizing the confidentiality of user information.

Tornado Cash Under Siege, Urgent Measures Proposed for Recovery!

Tornado Cash Back-End Attack, Putting User Deposits at Risk!

The exploit not only leaks deposit data but also includes a function designed to outright steal a deposit. Gas404 reported a successful execution of this exploit, resulting in the theft of at least one deposit as evidenced on etherscan.

This security breach comes as a significant blow to Tornado Cash, as its trading volume has plummeted by over 90%. The decline follows the sanction imposed by the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) in August 2022, underscoring the regulatory challenges faced by privacy-focused projects.

Tornado Cash Faces Unprecedented Threat, Solutions in Gas404’s Proposal!

In response to the crisis, Gas404 has proposed a solution—suggesting a rollback to a previous IPFS ContextHash deployment utilized in an earlier version of Tornado Cash. This recommendation aims to mitigate the impact of the malicious code and restore user confidence in the platform’s security.

As the Tornado Cash community grapples with this security incident, the broader crypto community is closely monitoring developments, highlighting the ongoing importance of vigilance and transparency in the rapidly evolving landscape of decentralized finance.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

Tornado cash

Tornado Cash Back-End

Tornado Cash Back-End Attack

Avatar of Annie

Author

Annie

Championing positive change through finance, I've dedicated over eight years to sustainability and environmental journalism. My passion lies in uncovering companies that make a real difference in the world and guiding investors towards them. My expertise lies in navigating the world of sustainable investing, analyzing ESG (Environmental, Social, and Governance) criteria, and exploring the exciting field of impact investing. "Invest in a better future," I often say. That's the driving force behind my work at Coincu – to empower readers with knowledge and insights to make investment decisions that create a positive impact.
News

Tornado Cash Back-End Attack, Putting User Deposits at Risk!

Key Points:

  • Tornado Cash back-end attack exposes user deposits as malicious code infiltrates Tornado Cash.
  • Significant drop in trading volume follows U.S. Treasury Department sanction in August.
  • Gas404 suggests reverting to a secure IPFS ContextHash deployment for resolution.
User deposits on the decentralized token mixer, Tornado Cash back-end attack face a severe security threat.
Tornado Cash Back-End Attack, Putting User Deposits at Risk!

A Medium post by community member Gas404 has exposed the insertion of malicious code into the protocol’s back end, potentially compromising the safety of user funds.

According to Gas404, the nefarious javascript code was cleverly concealed within a governance proposal submitted by an alleged Tornado Cash developer on January 1. The malicious code’s primary function is to redirect deposit data to a public server controlled by the alleged developer, jeopardizing the confidentiality of user information.

Tornado Cash Under Siege, Urgent Measures Proposed for Recovery!

Tornado Cash Back-End Attack, Putting User Deposits at Risk!

The exploit not only leaks deposit data but also includes a function designed to outright steal a deposit. Gas404 reported a successful execution of this exploit, resulting in the theft of at least one deposit as evidenced on etherscan.

This security breach comes as a significant blow to Tornado Cash, as its trading volume has plummeted by over 90%. The decline follows the sanction imposed by the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) in August 2022, underscoring the regulatory challenges faced by privacy-focused projects.

Tornado Cash Faces Unprecedented Threat, Solutions in Gas404’s Proposal!

In response to the crisis, Gas404 has proposed a solution—suggesting a rollback to a previous IPFS ContextHash deployment utilized in an earlier version of Tornado Cash. This recommendation aims to mitigate the impact of the malicious code and restore user confidence in the platform’s security.

As the Tornado Cash community grapples with this security incident, the broader crypto community is closely monitoring developments, highlighting the ongoing importance of vigilance and transparency in the rapidly evolving landscape of decentralized finance.

DISCLAIMER: The information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.