Tornado Cash Users' Deposits Potentially Compromised Due to Malicious JavaScript Code

According to CryptoPotato, deposits made to Tornado Cash using IPFS gateways, such as ipfs.io, cf-ipfs.com, and eth.link, may have been compromised, potentially exposing users' deposited funds to risk. Pseudonymous Tornado Cash developer 'Gas404' advised affected users to take immediate action to safeguard their deposits. A blog post by Gas404 revealed the presence of malicious JavaScript code hidden within a governance proposal submitted by an alleged Tornado Cash developer known as Butterfly Effects. This hidden code is speculated to have been leaking deposit notes to a private server controlled by the developer since January 1st. The risk seems to be limited to IPFS deployments of Tornado Cash, as Gas404 mentioned that changes to the minified source code could easily be audited on local interfaces. To mitigate potential damage, the post recommended holders of Tornado Cash's native token, TORN, vote for a veto on the two questionable proposals previously deployed by the exploiter. Tornado Cash, one of the most popular crypto mixers in the world, was sanctioned by the US Department of the Treasury's Office of Foreign Assets Control (OFAC) in August 2022. The Treasury Department alleged that the crypto mixer facilitated the laundering of over $7 billion in digital currencies, including $455 million believed to have been pilfered in 2022 by the Lazarus Group, a notorious entity linked to the North Korean government.