Share this article
BTC
$77,275.20
-
2.04%ETH
$1,475.62
-
5.86%USDT
$0.9996
-
0.01%XRP
$1.8285
-
2.65%BNB
$557.28
-
0.09%USDC
$1.0001
+
0.00%SOL
$106.66
-
1.65%TRX
$0.2295
-
2.37%DOGE
$0.1463
-
2.82%ADA
$0.5709
-
2.10%LEO
$9.1387
+
1.68%TON
$3.0529
-
1.83%LINK
$11.35
-
2.02%AVAX
$16.58
-
1.93%XLM
$0.2220
-
3.18%SHIB
$0.0₄1096
-
2.24%HBAR
$0.1520
-
2.45%SUI
$1.9692
-
2.88%OM
$6.2171
-
0.71%BCH
$273.08
-
2.34%Sign Up
- Back to menuPrices
- Back to menuResearch
- Back to menuConsensus
- Back to menu
- Back to menu
- Back to menu
- Back to menuWebinars & Events
Tornado Cash Reportedly Suffers Backend Exploit, User Deposits at Risk
The exploit has the function to steal deposit data and deposited funds.
- Tornado Cash deposits and deposit data is reportedly at risk.
- A proposal has been made to revert back to a previous version of the protocol's IPFS deployment.
User deposits on token mixer Tornado Cash are reportedly at risk following the insertion of malicious code in the protocol's back end, according to a Medium post by community member Gas404.
The post explains that a malicious javascript code was hidden from a two-month-old governance proposal submitted by an alleged Tornado Cash developer on Jan. 1. The code redirects deposit data to a public server hosted by the alleged developer.
STORY CONTINUES BELOW
The function of the exploit is to leak Tornado Cash deposit data and there is also a function to steal a deposit itself. According to Gas404, one deposit was stolen out of this batch seen on etherscan.
Tornado Cash trading volume nosedived by more than 90% after the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) sanctioned Tornado Cash in August 2022.
Gas404 has proposed that Tornado Cash should revert to a previous IPFS ContextHash deployment used in a previous version of TornadoCash.
Oliver Knight
Oliver Knight is the co-leader of CoinDesk data tokens and data team. Before joining CoinDesk in 2022 Oliver spent three years as the chief reporter at Coin Rivet. He first started investing in bitcoin in 2013 and spent a period of his career working at a market making firm in the UK. He does not currently have any crypto holdings.
