Tornado Cash DAO has a suspicious governance proposal, with researchers warning it could be an attack targeting the $23 million treasury.

Blockchain security researcher Sergey Shemyakov issued a warning on June 25 that Tornado Cash DAO had a highly suspicious governance proposal approximately 8 hours prior, calling on the community to conduct an independent review. The proposal shows multiple red flags: First, its contract code is unverified, a rarity in Tornado Cash DAO’s historical proposals, which the researcher views as a clear sign of a malicious proposal. Second, the address that created the proposal received funds four days ago via privacy protocol Railgun, with obfuscated sources, making the behavior highly suspicious. Third, the proposal’s description appears misleadingly packaged, but its core lies in its target contract: once the proposal passes and is executed, the governance contract will call the target contract’s function via delegatecall, allowing attackers to gain extremely high privileges. The researcher noted that Tornado Cash’s mixing pools themselves remain secure, but if the proposal is approved, it would very likely constitute a direct attack on the Tornado Cash DAO itself. The DAO’s current treasury holds TORN tokens worth approximately $23 million, putting those funds at risk. In 2022, Tornado Cash DAO suffered a similar attack, where attackers successfully seized control of the protocol through a malicious governance proposal. The researcher is urging all TORN token holders to exercise extreme caution before voting on the proposal.