Tornado Cash DAO faces suspicious governance proposal linked to

A governance proposal submitted to the Tornado Cash DAO on June 25 flags a potential attack on the protocol’s $23 million treasury, with the proposer’s address having received funds from the competing privacy protocol Railgun just four days earlier [2].

Proposal mechanics and immediate risk

The proposal points to an on‑chain contract that is not verified—a rarity for Tornado Cash DAO submissions—and would, if executed, use delegatecall to replace the DAO’s governance address with a look‑alike address that shares the first 15 characters of the legitimate one [3]. That spoofed address would give the attacker control over the $23 million of TORN held in the DAO’s treasury and over the staking governance proxy contract. A second function in the proposal could also zero out any relayer’s balance, undermining a key piece of the protocol’s privacy infrastructure without touching user deposits [3].

Security researchers highlight that the proposer’s address was funded by Railgun, a competing privacy protocol, four days before the submission [1]. While the funding path does not prove intent, the link fuels speculation about who might benefit if the attack succeeds. The proposal’s description frames the change as a “new fee structure” and a “dynamic deflationary economic model,” likely intended to mask the underlying malicious code and lure inattentive voters [3].

Market context and precedent

Tornado Cash’s token (TORN) has been trading near $8‑$9 in late June 2026, with a market cap that varies between $18 million and $45 million depending on the data source [3]. The token’s 7‑day price decline of roughly 9% lags the broader crypto market, and daily volume sits well under $200 000, making the market thin enough that a forced token sale from a hijacked treasury could move the price sharply [3]. This is not the first governance scare for Tornado Cash; a similar attack in 2023 let an attacker seize a majority of votes, drain the treasury, and sell about $800 000 of TORN, causing a 40% price drop in a single day [1].

Community response

Researchers from L2BEAT and the Security Alliance have publicly warned TORN holders to reject the proposal, emphasizing the need to verify the full address character by character rather than relying on a quick visual check [1][3]. ZK researcher Sergey Shemyakov posted the find on X and called for an independent review, noting the proposal’s “convoluted logic” [1]. The DAO’s governance process remains open to any token holder, but the technical complexity of the attack underscores a structural vulnerability for DAOs that manage sizable treasuries.

What to watch

• Governance vote outcome – whether the proposal passes or is rejected in the upcoming vote.
• Address verification – any further proposals that use look‑alike addresses or unverified contracts.
• TORN price movement – especially if a large token sale follows a successful hijack, given the thin trading volume.

The episode adds a new layer to Tornado Cash’s ongoing security challenges, highlighting how address spoofing can bypass casual checks and how on‑chain governance can become a vector for treasury theft. The ultimate test will be whether the community’s vigilance can stop the proposal before any funds are transferred.