Tornado Cash Reportedly Suffers Backend Exploit, User Deposits at Risk
Summary
Tornado Cash, a token mixer, is facing a security threat due to malicious code inserted into its protocol's back end. The code, hidden in a two-month-old governance proposal, redirects deposit data to a public server. The exploit leaks Tornado Cash deposit data and has a function to steal deposits. One deposit has already been stolen. This follows a significant drop in Tornado Cash's trading volume, which fell by over 90% after the U.S. Treasury Department sanctioned the platform in August 2022. A community member has suggested that Tornado Cash should revert to a previous IPFS ContextHash deployment to address the issue.
