Tornado Cash, a popular crypto mixer, has reportedly been targeted by a significant backend exploit, jeopardizing user deposits and sensitive information. Gas404, a community member, disclosed the security breach in a Medium post on February 26.

This exploit poses a critical threat to Tornado Cash, which had already seen a decline in trading volume after facing sanctions from the US Treasury Department's OFAC in August 2022. The exploit involved malicious JavaScript code inserted into the protocol's backend, allegedly introduced through a compromised governance proposal submitted by someone impersonating a Tornado Cash developer on January 1.

The code illicitly redirects user deposit details to a server controlled by the attacker, potentially exposing both deposit data and leading to outright theft. The community post delves into technical specifics, illustrating the attack's complexity, including how the code was crafted to encode and extract private deposit notes, breaching user anonymity and security.

In response, Gas404 proposed a solution: rolling back Tornado Cash to a previous version of its IPFS deployment to mitigate the damage and secure the platform against current vulnerabilities. The incident has led to the temporary shutdown of the Tornado Cash website and Discord channel, underscoring the severity of the exploit and ongoing efforts to manage its fallout.