Tornado Cash’s TORN Token Up 10% as Attacker Submits Proposal to Undo Attack
The proposal would revert Tornado Cash’s governance back to token holders, but not everyone in the community agrees that it's a benevolent plan.
The Tornado Cash token (TORN) is up 10% after a proposal submitted by a wallet address linked to a recent attack on the decentralized autonomous organization’s (DAO) governance state looks to reverse the malicious changes.
“The attacker posted a new proposal to restore the state of governance," user Tornadosaurus-Hex wrote in the Tornado Cash community forum, adding that there is a "good chance" that the attacker would execute it.
Tornadosaurus-Hex said that the attacker is reverting the TORN tokens they gave themself – which gave them a controlling share of the governance votes – back to zero.
Given the attacker's holdings of TORN governance tokens, the proposal looks as though it will pass when voting closes on May 26, though it's unclear when the action will be executed. When the proposal passes, the malicious code that the attacker integrated into the protocol, which allowed them to steal voting power from others, will be removed, and the governance of Tornado Cash's DAO will go back to token holders.
As a result, TORN was up as much as 10%, according to CoinGecko data, before settling back down.
0xdeadf4ce, an active member of the TORN community, pointed out that this might all be a “gigatroll” to depress the price of the token to increase their holdings at a discount.
TornadoCash attacker deployed new proposal that, if executed, would seemingly revert the damage done to the Governance functionality. Either they're giga trolling or it will end up being an expensive but not disastrous lesson in Governance security.https://t.co/QMWYFsi8kP
— 0xdeadf4ce (@0xdface) May 21, 2023
“We don’t even have a choice in regards to this proposal, but it is still important nonetheless,” Tornadosaurus-Hex added.
Structural attacks on DAOs and DeFi protocols, which differ from hacks where the attacker breaks code instead of exploiting it, have resulted in charges, but the attacker behind this exploit is likely counting on the fact that Tornado Cash was recently designated as a sanctioned entity.
More For You
Protocol Research: GoPlus Security

What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Coinbase Sees Crypto Recovery Ahead as Liquidity Improves and Fed Rate Cut Odds Climb

The crypto exchange also took note of a so-called AI bubble that continues to go strong and a weaker U.S. dollar.
What to know:
- Coinbase Institutional is seeing a potential December recovery in crypto, citing improving liquidity and a shift in macroeconomic conditions that could favor risk assets like bitcoin.
- The firm's optimism is driven by rising odds of Federal Reserve rate cuts, with markets pricing in a 93% chance easing next week, and improving liquidity conditions.
- Several recent institutional developments, including Vanguard's crypto ETF policy reversal and Bank of America's greenlighting of crypto allocations, have contributed to bitcoin's rebound from recent lows.












