Backdoor has been discovered in the Tornado Cash interface to intercept deposit data

According to community representatives, it has been functioning for two months

26.02.2024 - 08:27

228

3 min

What’s new? Yu Xian, the founder of SlowMist, an audited blockchain company, has reported an exploit of the interface of the crypto mixer Tornado Cash, which is included in the US sanctions list. Thus, according to anonymous blockchain developers cited by Xian, a backdoor capable of intercepting certificates of deposit has been functioning in the IPFS version of the service’s frontend for two months.

Source: Twitter.com

What else is known? According to Xian, the malicious mechanism was introduced through a voting-based attack on Tornado Cash’s decentralized autonomous organization (DAO) governance mechanism. At risk are the funds of users who made deposits into the mixer using IPFS over the past two months.

According to the community, malicious code was covertly injected into a management proposal made two months ago by a developer under the nickname Butterfly Effects. Since January 1, Tornado Cash deposit records have been leaking to a private malicious server under his control. At least one case of a mixer user’s deposit being stolen in ETH coins has been identified.

GoFundMe has stopped a fundraiser to support Tornado Cash’s founders

All contributions were returned to the sponsors

Earlier, the Cyber Security Agency of Singapore discovered a vulnerability in the WordPress cryptocurrency widget “Cryptocurrency Widgets — Price Ticker & Coins List Plugin” versions 2.0-2.6.5, which could leak sensitive information. Attackers can add SQL queries to extract it from the database.

Late last year, hardware crypto wallet maker Ledger reported that users lost $600 000 due to a vulnerability in its blind signature mechanism. The company pledged to reimburse the losses and replace the mechanism of interaction with DApps with a fully transparent one by June 2024.

Author: