Tornado Cash Theft Uncovered: Malicious Code Drains Funds for Months

Tornado Cash Theft Uncovered: Malicious Code Drains Funds for Months

Key Points


  • Sophisticated Supply chain attack: The Tornado Cash open source project was compromised with malicious JavaScript code inserted by a developer.

  • Impact: Users who conducted transactions using the targeted Tornado Cash project through IPFS gateways were unknowingly impacted for a couple of months.

  • Discovery: The compromise, discovered by Security researcher Gas404, marks the second major security issue for Tornado Cash within a year, emphasizing the importance of community vigilance in decentralized finance.

  • Ongoing risks in decentralized finance: This incident highlights the persistent challenges in ensuring safety and trust in decentralized platforms.

  • What is Tornado Cash?


    Tornado Cash is a decentralized privacy solution built on the Ethereum blockchain, offering users non-custodial and anonymous transactions. Functioning as a cryptocurrency mixer, it provides a mechanism to obfuscate the origins and destinations of digital asset transfers, enhancing user privacy and security. While Tornado Cash has faced scrutiny for its potential misuse in illicit activities, such as money laundering notably by entities like North Korean hackers, it remains an innovative tool in the realm of decentralized finance.


    In 2022, The original Tornado Cash service encountered challenges due to U.S. government sanctions, impacting its usage among certain user demographics. Despite this setback, the project's open-source codebase has fostered the emergence of new independent mixing services.


    The Compromise of the Open Source Tornado Cash


    Tornado Cash recently fell victim to a sophisticated attack. This attack was executed through a deceptive contribution by a developer, who secretly embedded malicious JavaScript code within the project’s user interface. This code was designed to covertly capture and send users' private deposit notes to an unauthorized external server. Deposit notes in Tornado Cash act like private keys, crucial for accessing and ma ..

    Support the originator by clicking the read the rest link below.