A Malicious Proposal Briefly Handed One Address Control of Tornado Cash's DAO

Tornado Cash's governance system was seized by a single address through a disguised proposal — and then, unexpectedly, handed back.

01What happened

An attacker took control of Tornado Cash's DAO by smuggling malicious code into what looked like a routine governance proposal. The underlying privacy-pool contracts, holding roughly $275 million, were never at risk of being drained directly. What the exploiter did gain was control of the TORN governance token, the ability to alter the router contract governing deposit and withdrawal flows, and admin privileges over Nova, Tornado's deployment on the Gnosis chain.

In an unusual twist, the attacker submitted a follow-up proposal the day after the takeover, just before midday UTC, aimed at reversing the changes. If that proposal executes cleanly, the community may avoid lasting damage. Motives remain unclear — theories floated online range from a change of heart, to a Lazarus Group operative testing the waters, to someone simply planning to sell off their remaining TORN after the fact.

Credit: samczsun, SlowMist, BlockSec, Apoorv Lathey

02A rough stretch for Tornado Cash

The incident lands during an already difficult period for the mixing protocol. It was hit with OFAC sanctions the previous August, and core developer Alexey Pertsev was jailed before being released pending trial.

There had also been an earlier warning sign: the prior week, someone was seen creating multiple addresses and locking zero TORN into the governance vault, in what looked like an attempt to game the system. Because nothing materialized from it at the time, the community wrote it off as a failed attempt — though in hindsight it may have been reconnaissance for what followed.

Two addresses tied to the exploiter have been identified:

• 0x092123663804f8801b9b086b03b98d706f77bd59
• 0x592340957ebc9e4afb0e9af221d06fdddf789de9

03How the takeover was engineered

The malicious code rode in on a proposal ostensibly designed to penalize relayers caught cheating. On its face, the logic matched an earlier, legitimate proposal, but the attacker had quietly inserted an additional function enabling the contract to self-destruct.

The proposal contract was itself deployed through an intermediary deployer contract. As Apoorv Lathey noted, the attacker combined the CREATE and CREATE2 opcodes to exploit deterministic address generation, letting them later push new code into an address that governance had already approved.

Once the initial proposal was approved, the attacker triggered selfDestruct on the deployer contract. This wiped out the previously approved code and reset the deployer's nonce, clearing the way to redeploy an entirely different, malicious contract at that exact same address.

BlockSec's Yajin Zhou broke down the mechanics in a thread:

Option I: Use CREATE2 opcode to create a malicious proposal contract. This will raise a flag since CREATE2 and self-destruct are used together.

Option II: Use CREATE2 to create the deployer contract (0x7dc8), which further deploys the malicious proposal contract (0xc503) using CREATE.

Then the deployer contract is self-destructed (to reset the nonce), and it can create a new proposal at the same address (0xc503).

4/ That's because the address of the deployed contract using CREATE depends on the sender and nonce (nonce = 1), enabling the attacker to create a new proposal with the same address (0xc503)

This approach — building so-called "metamorphic contracts" that can swap their own bytecode after deployment — is part of why some in the Ethereum community have pushed to deprecate the selfDestruct opcode entirely.

04Cashing in the votes

The swapped-in malicious proposal minted 10,000 TORN to every address that had been created during the previous week's presumed failed exploit attempt. Those tokens were then unlocked and withdrawn from the governance vault, giving the attacker roughly 1.2 million votes against about 700,000 legitimate votes — enough to seize outright control of Tornado Cash governance. BlockSec published a chart mapping out each stage of the attack in detail.

05The reversal

Contrary to expectations, the attacker subsequently filed another proposal intended to undo the takeover and restore governance to its prior state.

Beyond the governance seizure, the attacker also profited about 430 ETH (roughly $750,000) from selling off TORN, funds that were reportedly routed toward a laundering address. Speculation about the attacker's intent continued, with one observer suggesting: "Either they're giga trolling or it will end up being an expensive but not disastrous lesson in Governance security."

Community member Tornadosaurus-Hex remarked on the irony that token holders had no real say in accepting the reversal proposal either, despite how consequential it was.

06Aftermath

Whether the exploit should have been caught beforehand is an open question. The DAO had been dealing with recent friction among contributors, including publicly aired tensions, which may have left it under-resourced to catch the attack. An earlier warning — "You will be at the helm of negligent tokenholders" — reads as notably prescient in retrospect.

For now, the hope within the community is that the episode ends up being a contained scare rather than a lasting blow to the protocol's governance.