Loading article…
Tornado Cash DAO proposal linked to Railgun threatens $23 million governance address; researchers flag it as malicious and urge TORN holders to reject.
A governance proposal submitted to the Tornado Cash DAO that references an unverified contract and was funded by competing privacy protocol Railgun is being labeled malicious, with the potential to swap a $23 million governance address for an attacker‑controlled lookalike [1].
| At a glance | |
|---|---|
| Governance address at risk | $23 million in TORN tokens |
| Funding source of proposer | Railgun (recent transfer) |
| Proposal claim | New fee structure & dynamic deflationary model |
| Researchers’ assessment | Malicious – aims to replace key addresses and zero relayer balances [2] |
The proposal, on its face, seeks to introduce a revised fee schedule and a “dynamic deflationary economic model” for Tornado Cash [1]. However, L2BEAT researchers highlighted that it points to an unverified contract—a rarity for DAO submissions and a clear warning sign [2]. The wallet that submitted the proposal received funding from Railgun only four days before the vote, raising suspicion about the proposer’s motives given that Railgun competes directly with Tornado Cash in the privacy space [2].
Security Alliance researcher Pascal Caversaccio warned that the proposal would replace the current governance address—controlling $23 million of TORN—with a spoofed address that shares the same initial 15 characters, effectively handing control to an attacker [1][2]. A second, more damaging clause could allow the new address to zero out any relayer’s balance, undermining the core privacy‑preserving infrastructure that relayers provide for users [1].
The stakes echo a 2023 attack where a similar malicious proposal gave an attacker majority voting power, enabling the sale of roughly $800 000 of TORN and subsequent laundering through the protocol [1][2]. That episode led to a loss of confidence and highlighted the vulnerability of Tornado Cash’s governance design.
The governance turmoil unfolds amid unresolved legal proceedings against Tornado Cash developer Roman Storm, whose prosecution for operating an unlicensed money‑transmitting business remains pending [1][2]. The legal uncertainty adds another layer of risk for the protocol and its token holders.
The proposal’s alleged intent to hijack a multi‑million‑dollar governance address underscores the persistent security and governance challenges facing privacy‑focused protocols, and the upcoming vote will be a litmus test of community vigilance.
Coverage is mostly measured — 63 of 68 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 3 outlets · Jun 28, 2026 · How we report
CertiK reported 29 incidents with $651 million in losses, driven largely by the Drift and Kelp DAO attacks, which together accounted for $579 million.
TRM Labs indicated that 76% of crypto value extracted from hacks in 2026 is connected to North Korea, based on the Drift and Kelp DAO incidents.
MakerDAO is a decentralized autonomous organization where MKR token holders propose and vote on changes to the DAI protocol's parameters.
Banks cite security vulnerabilities and the lack of transaction reversibility on open networks as barriers to institutional adoption.
The rebrand in August 2024 marked the organization's evolution, and by early 2026 Sky's USDS stablecoin was the third largest issuer with a $21 billion supply.