Deposits made to Tornado Cash using IPFS gateways through IPFS gateways like – ipfs.io, cf-ipfs.com, and eth.link – may have been compromised, potentially exposing users’ deposited funds to risk, according to pseudonymous Tornado Cash developer ‘Gas404.’

Affected users were advised to take immediate action to safeguard their deposits.

User Deposits Vulnerable

According to a blog post by Gas404, the community made a startling discovery about the presence of malicious JavaScript code, which was hidden within a governance proposal submitted by an alleged Tornado Cash developer known as Butterfly Effects.

This hidden code is speculated to have been leaking deposit notes to a private server controlled by the developer since January 1st.

Notably, the risk seems to be limited to IPFS deployments of Tornado Cash, as Gas404 mentioned that changes to the minified source code could easily be audited on local interfaces.

To mitigate the potential damage, the post recommended holders of Tornado Cash’s native token, TORN, vote for a veto on the two questionable proposals previously deployed by the exploiter.

“This would only count to the IPFS deployments of Tornado Cash since the minified source has become a hidden trap for a scammer and thus people who have interacted with the contract using local interfaces would be considered as safe since changes on commits could be audited easily.”

The Fall of Tornado Cash

Tornado Cash is one of the most popular crypto mixers in the world. In a major blow, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash in August 2022, prohibiting individuals, residents, and entities within the United States from engaging in financial transactions through the platform.

The Treasury Department alleged that the crypto mixer facilitated the laundering of over $7 billion in digital currencies, including $455 million believed to have been pilfered in 2022 by the Lazarus Group, a no