Suspicious Tornado Cash Proposal Puts $23 Million DAO Treasury at Risk

Tornado Cash is an Ethereum-based cryptocurrency mixer governed by holders of TORN, whose votes can authorize smart-contract changes and control DAO assets. Proposals are executed by the governance contract through delegatecall, a mechanism that runs external code in the caller’s context and gives approved code broad authority. That design makes independent review critical: malicious code could seize governance and treasury funds even if users’ deposits in the protocol’s mixing pools remain untouched.

L2BEAT researcher Sergey Shemyakov warned on June 25, 2026, that Tornado Cash proposal No. 67 pointed to an unverified contract, an unusual feature for the DAO. The proposer’s wallet had been funded through Railgun four days earlier. Researchers said hidden logic could replace the legitimate governance address with an attacker-controlled lookalike if the proposal were approved and executed, exposing about $23 million in TORN tokens and potentially relayer balances. They said the mixing pools themselves were not affected by the governance-layer threat.