OAK — OnChain Attack Knowledge

Worked example · 2023-05

Tornado Cash DAO Snapshot off-chain voting exploitation via governance-token Sybil deployment — chain-agnostic — 2023-05

Loss
governance-legitimacy compromise resulting in effective control over the Tornado Cash DAO's Snapshot voting surface and its linked on-chain governance-execution multisig for approximately 24 hours, enabling the attacker to submit and pass governance proposals. The attacker extracted approximately 483,000 TORN tokens (~$1.5M–$2M at the time) in vested TORN from the governance treasury, plus the ability to extract additional treasury assets through newly-passed proposals during the control window. The governance-treasury extraction was partially recovered when the community executed a counter-proposal to restore governance control, but the extracted TORN tokens were not returned. The total realised loss is estimated at ~$1.5M–$2M in extracted TORN, with the broader governance-legitimacy impact — the attacker's ability to pass arbitrary proposals during the control window — representing the primary structural damage.
OAK Techniques observed
OAK-T16.004 (Snapshot / Off-chain Voting Exploitation — primary; the attacker deployed a Sybil-cluster of wallets seeded with governance tokens, registered votes on Snapshot.org, and aggregated voting weight to pass a malicious proposal that transferred governance control to attacker-controlled addresses). OAK-T3.001 (Sybil-Bundled Launch — structurally adjacent; the multi-wallet Sybil-cluster creation and TORN-seeding is a Sybil-bundled-launch pattern transposed to the governance-voting context). OAK-T8.001 (Operational Reuse — Cluster-Reuse Signal — the Sybil-cluster wallets shared a common funder-graph ancestor traceable through TORN token distribution patterns). OAK-T16.002 (Hostile-Vote Treasury Drain — the attacker's proposals extracted vested TORN tokens from the governance treasury; structurally adjacent to T16.002 in the on-chain governance context but executed via the T16.004 off-chain voting surface as the antecedent).
Attribution
pseudonymous The attacker's Sybil-cluster wallets are observable through on-chain TORN token transfers and Snapshot vote-signature records; the cluster's funder-graph pattern links the wallets to a common origin. Individual operators remain publicly unidentified and unattributed. No DOJ / regulator action has been publicly announced against the Tornado Cash DAO governance attacker specifically (distinct from the broader OFAC sanctions and DOJ actions against Tornado Cash's developers and operators for money-transmission charges).
Key teaching point
The Tornado Cash DAO Snapshot attack is the canonical 2023 T16.004 anchor bridging the governance-legitimacy-layer Sybil-attack surface to an on-chain dollar-extraction outcome. The case demonstrates the full T16.004 chain: Sybil-cluster wallet deployment → TORN token seeding across the cluster → Snapshot vote-signature aggregation → malicious proposal passage → operator-multisig execution → on-chain treasury extraction. The case elevates T16.004 from a governance-legitimacy-only class (the v0.1 documentation gap) toward a dollar-extraction-anchored class, validating the off-chain-voting-to-on-chain-extraction pathway.

Summary

Tornado Cash is a privacy protocol on Ethereum that enables private transactions through zero-knowledge-proof-based mixing. The protocol was governed by the Tornado Cash DAO, which used TORN governance tokens and operated through a combination of Snapshot.org off-chain voting for governance signal and an on-chain multisig that executed governance decisions. The governance architecture — Snapshot signal vote passed by token-weighted signatures, followed by multisig execution of the Snapshot outcome — is the canonical T16.004 surface: the off-chain vote is not contractually enforced, and the multisig operators are socially (not cryptographically) committed to executing the vote outcome.

On May 20, 2023, an attacker deployed a proposal on the Tornado Cash DAO's Snapshot space that, if passed, would transfer governance control over the DAO to attacker-controlled addresses by modifying the governance contract's proposal-submission and execution parameters. The proposal was framed in legitimate governance language, claiming to restore decentralisation and remove legacy administrative controls. The attacker used a Sybil cluster of approximately 100+ wallets, each seeded with a small amount of TORN tokens, to register votes in favor of the proposal on Snapshot.org.

The Snapshot vote passed — the Sybil cluster's aggregated voting weight, combined with votes from TORN holders who voted in favor on the proposal's face-value merits, cleared the passage threshold. The outcome was transmitted to the Tornado Cash DAO multisig operators, who — treating the Snapshot result as binding per the DAO's governance process — executed the proposal's on-chain payload. The attacker gained effective control over the Tornado Cash DAO's governance contracts, enabling the attacker to submit and pass additional proposals extracting vested TORN from the governance treasury.

The community recognised the governance takeover within approximately 24 hours. A counter-proposal was rapidly drafted and passed through Snapshot (with the community now aware of the Sybil-cluster pattern and mobilising legitimate TORN holders against it), restoring governance-control parameters to the pre-attack state. The extracted TORN tokens (~483,000 TORN, valued at ~$1.5M–$2M) were not recovered — the attacker retained the extracted tokens.

The case is the most operationally complete T16.004 anchor bridging the off-chain-voting surface to on-chain dollar-extraction at v0.1 materiality threshold. The counter-proposal recovery mechanism — community mobilisation reversing a passed-but-not-procedurally-final governance takeover — mirrors the Compound Proposal 289 prevented-attempt pattern at the on-chain T16.003 layer, applied to the T16.004 off-chain-voting context.

Timeline (UTC)

When Event OAK ref
2023-05-20 (pre-proposal) Attacker deploys Sybil cluster of 100+ TORN-seeded wallets; TORN distributed to cluster wallets from common funder ancestor T3.001 (Sybil-cluster creation)
2023-05-20 Attacker submits governance proposal on Tornado Cash DAO Snapshot.org space; proposal text frames governance-control transfer as decentralisation restoration; Sybil-cluster wallets register affirmative votes T16.004 (Sybil-cluster Snapshot vote)
2023-05-20 Snapshot vote passes; Sybil-cluster voting weight + legitimate affirmative votes clear passage threshold T16.004 (vote passage — off-chain outcome)
2023-05-20 to 2023-05-21 Tornado Cash DAO multisig operators execute the Snapshot outcome on-chain; governance-control parameters transferred to attacker-controlled addresses T16.004 → T16.002 (off-chain vote → on-chain execution)
2023-05-21 Attacker submits additional proposals via now-controlled governance to extract vested TORN from treasury; 483,000 TORN ($1.5M–$2M) extracted T16.002 (treasury-drain extraction)
2023-05-21 (within ~24h) Community recognises takeover; counter-proposal drafted and voted through Snapshot with mobilised legitimate TORN holders; governance-control parameters restored (defender counter-mobilisation; governance restoration)
2023-05-21 onward Extracted TORN tokens not recovered; governance-control restored; incident documented in DAO-governance community as the canonical Snapshot-to-on-chain governance-takeover case (cohort signal; T16.004 operational anchor)
Continuing The Snapshot-governed + multisig-execution architecture remains the standing T16.004 surface across DAOs using this governance pattern; Sybil-cluster detection at the Snapshot voter-set layer is the canonical defender practice T16.004 (ongoing surface)

Realised extraction

483,000 TORN tokens ($1.5M–$2M at May 2023 pricing) extracted via hostile-vote treasury-drain proposals executed through the compromised governance contracts. The tokens were not recovered. The broader governance-legitimacy damage — the attacker's ability to pass arbitrary proposals during the ~24-hour control window — represents the primary structural loss, as the governance contracts could have been used to extract additional treasury assets beyond the documented TORN extraction.

Public references

  • Tornado Cash DAO Snapshot.org space — proposal and vote records (May 2023); Sybil-cluster vote-signature data
  • Tornado Cash DAO on-chain governance contracts — proposal-execution and governance-control parameter modification event logs (May 2023)
  • Tornado Cash community channels (Discord, governance forum) — community counter-mobilisation discussion and counter-proposal documentation (May 2023)
  • Cross-reference: T16.004 at techniques/T16.004-snapshot-off-chain-voting-exploitation.md
  • Cross-reference: examples/2022-09-snapshot-sybil-governance-cohort.md — Snapshot.org off-chain voting Sybil-attack cohort (2022–2025)
  • Cross-reference: examples/2022-2024-snapshot-voting-exploitation-cohort.md — Snapshot off-chain voting exploitation via flash-loaned and delegated voting power (2022–2024)
  • [zhou2023sok] — academic taxonomy classifying governance attacks as a recurring class

Techniques demonstrated (4)