Tornado Cash Attacker Funnels 360 ETH Through Crypto Mixer After Weekend Governance Exploit

Summary:

• The Tornado Cash attacker swapped 483,000 TORN tokens for 360 Ether before sending the ETH back to the Ethereum-based crypto tumbler.
• Wallets controlled by the exploiter still hold some 125 ETH and 38,300 TORN tokens lifted from the crypto mixer’s governance contract over the weekend.
• The transactions come after the attacker hijacked Tornado Cash’s governance forum through an “emergencyStop” function in a malicious proposal.
• The attacker also submitted a proposal that would seemingly return governance functionality to its original state.

The Tornado Cash attacker sent 360 Ether (ETH) to the Ethereum-based crypto mixer after swapping TORN tokens siphoned from the protocol over the weekend.

On May 20, an attacker hijacked the Tornado Cash governance functionality by using a malicious proposal. The proposal was built using the same coding logic as a previously passed proposal but held an “emergencyStop” function. This allowed the attacker to essentially take over the protocol’s governance system and obtain an inordinate number of voting power.

After granting themselves 1,200,000 votes – 700,000 more than the real votes from community members – the attacker stole hundreds of thousands of TORN tokens used to incentivize private relayers.

Notably, the attacker was not able to access individual pools or drain assets deposited into Tornado Cash, Paradigm research @samczsun said on Twitter.