---
title: "Sanctioned crypto mixer Tornado Cash hijacked by hackers"
description: "Tornado Cash, a service that allows users to mask cryptocurrency transactions, suffered a hostile takeover by hackers through a malicious governance proposal."
type: "NewsArticle"
publisher: "Daily Maverick"
site: "https://www.dailymaverick.co.za"
section: "Business Maverick"
author: "Bloomberg"
author_url: "https://www.dailymaverick.co.za/author/bloomberg/"
canonical_url: "https://www.dailymaverick.co.za/article/2023-05-22-sanctioned-crypto-mixer-tornado-cash-hijacked-by-hackers/"
published: "2023-05-22T06:06:52"
lang: "en-ZA"
word_count: 284
---

# Sanctioned crypto mixer Tornado Cash hijacked by hackers

> Tornado Cash, a service that allows users to mask cryptocurrency transactions, suffered a hostile takeover by hackers through a malicious governance proposal.

By Bloomberg · Published 22 May 2023, 08:06 SAST

## Key points
- An attack on Tornado Cash allowed the malicious actor to gain full control of the service, and its $8-billion worth of transactions since 2019 have raised concerns from the US Treasury Department.
- Attacker granted themselves 1.2 million fake votes, exceeding 700,000 legitimate votes and gaining full control of Tornado Cash governance.
- TORN token price dropped by over a third after news of the exploit.
- Over $8-billion has been sent through Tornado Cash since 2019.
- US Treasury Department imposed sanctions on Tornado Cash in August for North Korean hackers laundering illicit gains.

## Content

[Samczsun](https://twitter.com/samczsun), a security researcher at crypto investment firm Paradigm, said on Twitter that an attacker granted themselves 1.2 million fake votes on Saturday. As the fake votes exceeded the 700,000 legitimate votes, it allowed the attacker to gain full control over the governance of Tornado Cash.

Tornado Cash couldn’t immediately be reached for comment via Twitter.

On 2023/05/20 at 07:25:11 UTC, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1,200,000 votes. As this is more than the ~700,000 legitimate votes, they now have full control.[https://t.co/nY87XmrYgT](https://t.co/nY87XmrYgT)[pic.twitter.com/h9qjc3xRqz](https://t.co/h9qjc3xRqz)

— @samczsun.com (@samczsun) [May 20, 2023](https://twitter.com/samczsun/status/1660012956632104960?ref_src=twsrc%5Etfw)

Tornado Cash is a blockchain protocol and TORN, its governance token, enables holders to vote on proposed changes in the service.

“Now that they have all the votes, they can do whatever they want. In this case, they simply withdrew 10,000 votes as TORN and sold it all,” Samczsun said in a tweet.

Soon after the news of the exploit, crypto exchange Binance said that it will temporarily pause deposits of TORN. The token steadied on Monday in Asia after sliding on Sunday. Its price is down by over a third to about $4.56 compared with an intraday high on Saturday, according to CoinGecko data.

Tornado Cash is allegedly the preferred tool for hackers and criminals to launder stolen or illicit funds. Data from Dune Analytics [showed](https://dune.com/poma/tornado-cash_1) over $8-billion had been sent through Tornado Cash since the service started in 2019.

The US Treasury Department imposed sanctions on Tornado Cash in August after saying the service was used by North Korean hackers to launder illicit gains. North Korea’s Lazarus Group laundered about $450 million through the service, a Treasury official said then.**DM**