An attacker exploited Tornado Cash governance by proposing a malicious proposal that appeared identical to a previously approved one, gaining voter trust. The malicious code granted 1.2M governance votes to the attacker, exceeding legitimate votes and gaining full governance control. The attacker drained 483,000 TORN tokens ($2.17M) from governance vaults before later proposing its reversal.

At 15:25 on May 20, Tornado Cash encountered a governance attack. The attacker granted himself 1.2 million votes through a malicious proposal, exceeding the number of legal votes (about 700,000), and gained full governance control. An attacker could withdraw all locked votes and drain all tokens in the governance contract, disabling routers, though the attacker would still not be able to drain individual pools. Tornado Cash governance attackers obtained a total of 483,000 TORN from governance vaults.