Backdoor Discovered in IPFS Version of Tornado Cash

A malicious backdoor has been discovered in the frontend of the IPFS version of the cryptocurrency mixer Tornado Cash. This was highlighted by researcher Gas404.

Following the shutdown of the main service, the source code of Tornado Cash was used to create new darknet mixers.

It is believed that the backdoor was concealed within a governance proposal submitted for voting by a developer on January 1. After its approval, the malicious code remained active for nearly two months.

The backdoor allowed an attacker to redirect copies of deposit certificates to their own external server. These certificates function as private keys for funds placed in the mixer and can be used to regain access to assets after mixing.

As a result, funds from some users who made deposits to Tornado Cash through IPFS gateways during this period were likely stolen. The amount of the alleged damage is currently unknown.

In August 2022, OFAC added Tornado Cash to the sanctions list for its involvement in laundering over $7 billion in illicit funds.

In the same month, Alexey Pertsev was arrested. In April 2023, his pre-trial measure was changed to house arrest.

Later, U.S. authorities also charged Roman Storm and another co-founder of the mixer, Roman Semenov. The former was subsequently released on bail, while the latter remained free but came under sanctions.

Since January 2024, Storm and Pertsev have been raising $1.5 million for legal defense. For this purpose, the JusticeDAO fund was created. The initiative has been supported by former NSA and CIA employee Edward Snowden, as well as members of the crypto community.