Tornado Cash Theft Uncovered: Malicious Code Drains Funds for Months

Key Points

• 
  Sophisticated Supply chain attack: The Tornado Cash open source project was compromised with malicious JavaScript code inserted by a developer.


• 
  Impact: Users who conducted transactions using the targeted Tornado Cash project through IPFS gateways were unknowingly impacted for a couple of months.


• 
  Discovery: The compromise, discovered by Security researcher Gas404, marks the second major security issue for Tornado Cash within a year, emphasizing the importance of community vigilance in decentralized finance.


• 
  Ongoing risks in decentralized …

attack cash code compromise compromised developer discovery funds gateways impact ipfs javascript key key points malicious open source points project security supply supply chain supply chain attack theft tornado tornado cash transactions uncovered