Coverage of weather forecasts and weather event updates from across the nation and the world, including extreme weather and analysis of weather patterns.

U.S. had 300 tornadoes in April, second-most on record

Storm chaser Freddy McKinney is being praised for his heroics after he stopped to help a Texas family whose home had been destroyed by a tornado.

Storm Chaser Rescues Texas Family After Tornado Destroys Home — and It Was All Caught on Livestream

West Texas was hit hard with a rash of severe weather that spawned multiple tornadoes, large hail and heavy rain. Children in the town of Hawley were given the option of missing school if needed to help their families with ongoing recovery efforts. More severe weather could be on the way, making ...

Tornadoes Shove Through West Texas Town; Buildings Destroyed - Videos from The Weather Channel

For over a week, relentless severe weather has been torturing states across America. That trend will continue Thursday, with the bulk of the central U.S. facing another day of dangerous storms.

Tornado damage reported in Texas, Missouri after Thursday's round of severe storms

A North Texas couple survives a powerful tornado that ripped through Oklahoma on their drive from Minnesota to Colleyville,

Man trapped in Oklahoma tornado shares survival story – NBC 5 Dallas-Fort Worth

JONES COUNTY, Texas (KTAB/KRBC)— On Thursday, a tornado was spotted in the Hodges area, moving towards Abilene in Taylor County. It is no longer on the ground. A viewer reported sighting of the tornado at Highway 277 and 605 near Clear Fork Church. At 7:23 p.m., it was spotted at CR 494 and ...

TAKE COVER: Tornado spotted in Hodges | KTAB - BigCountryHomepage.com

FOX Weather Storm Trackers captured video of a large tornado in Jones County, Texas on Thursday evening.

Powerful tornado spotted outside of Abilene, Texas | Latest Weather Clips | FOX Weather

No injuries were reported in association with the tornado, which received a preliminary rating of EF0 and was said to have had winds of 60-65 mph.

Tornado causes minor damage near Joplin, no injuries reported: National Weather Service

An Oklahoma couple is now rallying around their best friend, Elaine Guilloz, who was in the direct path of the Sulphur tornado.

Oklahoma couple supports friend injured in Sulphur tornado

A backwards-spinning tornado, a train-cyclone collision and personal belongings miraculously appearing a hundred miles away make up just some of the most unbelievable moments from the recent tornado outbreak in the Plains. - Videos from The Weather Channel | weather.com

Top 3 Unbelievable Moments From The Plains Tornado Outbreak - Videos from The Weather Channel

Tornado

tornado

Quite often in the Python web world when asked to build a web application you choose between the two most popular Python web ecosystems, Django or Flask. However, there are other really capable web frameworks out there that may be better. is one of those frameworks. Tornado is often my secret weapon for specialized projects because of some its unique abilities. It’s definitely smaller than Django but comes prepackaged with a lot of little utilities that will make writing your Python web code a joy. Maybe it’s right for your next project? Here are a few of its abilities that make it stand out in my mind. Tornado Asynchronous From Before You Were Born AsyncIO is all the rage these days because of the rise of Node.js and other asynchronous tools. Tornado was built from day one to support async operations. So before Python supported async officially, Tornado was helping you write cleaner async code. It comes with many utilities to assist with it asynchronous operations such as an IOLoop, coroutines, futures, and more. Checkout Tornado’s and documentation. All async utilities also work in both Python 2 and 3. asynchronous networking concurrency Native Websocket Support With most web frameworks in Python, websockets are a feature that is added in. This makes their implementations feel a little clumsy or complex at times. Take for example. It can be used for some very advanced websocket and realtime features. So Django Channels makes . But if you just need a simple websocket, Django Channels is a really complex library to sprinkle in a little realtime capability into your app. With Tornado’s implementation it . This can be very useful in certain situations where you’re not concerned so much about scaling out initially. That’s not to say, that you couldn’t do that, it’s just that Tornado lets you implement websockets very easily and simply. Then you can add on from that. Contrast that with Django Channels which gives you more advanced capabilities but also requires a lot more setup and code to get started. Django Channels “the hard things possible” “keeps the easy things, easy” Third-party Login Support Tornado comes with support for right out of the box. I find this really convenient because for smaller web apps, if I need a login system, I like to use third-party logins. This lets me outsource a big chunk of my app that I really don’t want to worry about. social logins CLI Options and Config File Parsing A lot of times when I need to write web services, I would like to include some command line options or have the option to parse a config file or both. Tornado also includes built in . Again this just really makes it convenient to write web services and package in configuration options that make it operate like other common command line tools. options/config file utilities The Other Stuff Tornado also comes with other things you’d expect to see in a web framework like templating, routing, cookie utilities, request parsing, etc. I’ve also found that while it’s not the most popular framework, it still has a good ecosystem of people supporting it and building libraries that work with it. So check it out for your next project. Maybe it will be the perfect fit?

Django too big, Flask too small, Tornado just right!

Tornado Cash Is One Step Away from Full Censorship (and a Solution) 

টর্নেডো ক্যাশ সম্পূর্ণ সেন্সরশিপ থেকে এক ধাপ দূরে (এবং একটি সমাধান) 

Tornado Cash ist einen Schritt von der vollständigen Zensur entfernt (und einer Lösung)

Tornado Cash está a un paso de la censura total (y de una solución)

Tornado Cash est à un pas de la censure totale (et une solution)

टॉरनेडो कैश पूर्ण सेंसरशिप (और समाधान) से एक कदम दूर है

トルネード キャッシュは完全な検閲 (そして解決策) まであと一歩

토네이도 캐시는 전면 검열에서 한 걸음 떨어져 있습니다(그리고 해결책)

Tornado Cash está a um passo da censura total (e de uma solução)

Tornado Cash в одном шаге от полной цензуры (и решения)

Tornado Cash Tam Sansüre (ve Bir Çözüme) Bir Adım Uzakta

Tornado Cash sắp bị kiểm duyệt hoàn toàn (và một giải pháp)

Tornado Cash 距离全面审查仅一步之遥（并有解决方案）

Commonly, we only consider the members of a famous mailing list initiated by Tim May, John Gilmore, and Eric Hughes in 1992 as ‘cypherpunks’. Satoshi Nakamoto was around, too, and that’s partly why the mailing list became famous later. But cypherpunks are much more than people who just happened to be there. They’re skilled coders and privacy activists dedicated to creating new digital tools to foster online freedom and social change. Sometimes, sadly, they even pay a high price for it. That was the case with Julian Assange, and that’s also the case now with the Tornado Cash founders: Alexey Pertsev, Roman Semenov, and Roman Storm. Unlike Assange, they weren’t there for the mailing list in the 90s (they were far too young), but they can be considered cypherpunks for their considerable contribution to online privacy. Also, as with many other cypherpunks, we don’t know a lot about them beyond Tornado Cash and its legal intricacies. We know some things, though. All of them are of Russian origin, and their ages range between 31 (Pertsev) and 35 (Semenov). Pertsev was based in the Netherlands, and his co-founders were in the United States. The latter is also the country in which they registered PepperSec Inc. in 2018. This is a cybersecurity company staffed by white hat hackers —including the founders. Before this, they were doing different projects inside and outside the crypto world —and around Ethereum, specifically. For instance, Storm was a developer in the POA network, an Ethereum-based platform that offers a framework for smart contracts, and it’s now part of the Gnosis ecosystem. Pertsev was an independent security consultant in the meantime. And their lives would change in 2019 when they released Tornado Cash. What is Tornado Cash? Well, it’s apparently a headache for authorities, but it wasn’t done on purpose. In essence, Tornado Cash is a privacy tool on Ethereum that helps users keep their transactions mostly anonymous. When you send Ethereum-based tokens through Tornado Cash, it mixes your coins with those of other users, making it difficult for anyone to trace where your money came from or where it’s going. This way, your financial activities stay private. Here’s how it works: you deposit your cryptocurrency into Tornado Cash, which gives you a secret note. Later, you can use this note to withdraw your funds to a different address. Since your coins get mixed with others in the pool, the connection between your original deposit and the final withdrawal is broken, ensuring your privacy. It’s like putting your coins into a blender with others and then taking it out in a way that no one can tell whose money is whose. Does that sound harmless? It is, in theory. It could work to protect yourself against surveillance, to keep a business transaction secret, or to safely fund a project or group in a hostile territory. Sadly, it also worked for the malicious hacking team dubbed Lazarus Group to launder around $625 million in crypto from a robbery to the Ronin Network in 2022, and likely other illegal endeavors. That’s assuredly the worst use case for the tool, and the creators of this tool are being blamed for it. Money Laundering Accusations The same year of that really big hack and money laundering operation by the Lazarus Group, in August, the U.S. Office of Foreign Assets Control (OFAC) blacklisted Tornado Cash, alleging it was used for laundering billions in virtual currencies. This led to the suspension of developer accounts and the takedown of their domains. The blacklisting resulted in severe restrictions, including asset freezes and transaction bans, impacting anyone associated with Tornado Cash, even outside the U.S. Shortly after, Alexey Pertsev was arrested in Amsterdam, accused of money laundering through Tornado Cash. Pertsev faced significant legal hurdles, spending over nine months in prison before being placed under house arrest. His trial concluded in May 2024 with a sentence of 64 months in prison, which he is currently appealing. Pertsev's legal team is actively working on the appeal, but it may take several months before a new hearing is scheduled. Roman Storm and Roman Semenov were similarly accused in the U.S. in August 2023. Roman Storm was arrested in Washington but was released on a $2 million bond pending his trial. His trial is set for September, where he will face charges similar to those against Pertsev. Roman Semenov is also under investigation, but he’s said to remain at large. Despite these legal challenges, the Tornado Cash community and various advocacy groups have shown strong support for the developers. Organizations like Coin Center, DeFi Education Fund, and the Electronic Frontier Foundation have voiced their support and are assisting in the legal battles. The crypto community continues to rally behind the developers, emphasizing the importance of privacy tools in the digital age. What’s next? Tornado Cash itself remains operational as a decentralized protocol on the Ethereum network, with significant funds still deposited in the platform. However, all the services related to it that aren’t decentralized (domains, node providers, webpages, user-friendly interfaces) are being blocked by a lot of companies that aren’t willing to face the OFAC blacklisting. Also, if a centralized crypto exchange or stablecoin relates your tokens with Tornado Cash, they may freeze your funds, for the same reasons. In the end, despite it being a decentralized platform available for everyone, there are feasible ways to censor this and other similar services on blockchains. That doesn’t mean the work of Pertsev, Semenov, and Storm was for naught. Besides the fact there are other numerous crypto mixers around, the ongoing legal proceedings against Tornado Cash developers are a wake-up call that highlights the complex intersection of privacy, technology, and regulation around decentralized services. Our online privacy is something worth fighting for, and no centralized party seems really interested in letting us have that right. Creating code for it shouldn’t be a crime. As cypherpunks say in their manifesto, “We must defend our own privacy if we expect to have any.” Obyte, as a Directed Acyclic Graph (DAG) crypto network, offers a higher level of censorship resistance than any blockchain, and that translates to a higher level of privacy as privacy tools like Tornado Cash cannot be censored. It offers a decentralized, autonomous platform that operates independently of centralized intermediaries such as block producers in blockchains. Unlike blockchain services that can be censored or blocked by block producers due to regulatory pressures, Obyte's decentralized nature ensures that users retain control over their transactions without the risk of third-party interference. All developers are more than welcome to keep the cypherpunk ethos by building here! Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism
Wei Dai & B-money
Nick Szabo & Smart Contracts
Adam Back & Hashcash
Eric Hughes & Remailer
St Jude & Community Memory
Hal Finney & RPOW
Julian Assange & WikiLeaks
John Gilmore & EFF
Satoshi Nakamoto & Bitcoin
Gregory Maxwell & Bitcoin Core
Ian Grigg & Ricardian contracts
Vinay Gupta & Mattereum Featured Vector Image by Garry Killian / Freepik Photograph of Roman Semenov [right] from X (Twitter) Photograph of Pertsev [center] and Storm [left] from LinkedIn Commonly, we only consider the members of a famous mailing list initiated by Tim May, John Gilmore, and Eric Hughes in 1992 as ‘cypherpunks’. Satoshi Nakamoto was around, too, and that’s partly why the mailing list became famous later. But cypherpunks are much more than people who just happened to be there. They’re skilled coders and privacy activists dedicated to creating new digital tools to foster online freedom and social change. Sometimes, sadly, they even pay a high price for it. That was the case with Julian Assange , and that’s also the case now with the Tornado Cash founders: Alexey Pertsev, Roman Semenov, and Roman Storm. Unlike Assange, they weren’t there for the mailing list in the 90s (they were far too young), but they can be considered cypherpunks for their considerable contribution to online privacy. Julian Assange Julian Assange Also, as with many other cypherpunks, we don’t know a lot about them beyond Tornado Cash and its legal intricacies. We know some things, though. All of them are of Russian origin, and their ages range between 31 (Pertsev) and 35 (Semenov). Pertsev was based in the Netherlands, and his co-founders were in the United States. The latter is also the country in which they registered PepperSec Inc . in 2018. This is a cybersecurity company staffed by white hat hackers —including the founders. Also, as with many other cypherpunks, we don’t know a lot about them beyond Tornado Cash and its legal intricacies. range range PepperSec Inc PepperSec Inc Before this, they were doing different projects inside and outside the crypto world —and around Ethereum, specifically. For instance, Storm was a developer in the POA network, an Ethereum-based platform that offers a framework for smart contracts, and it’s now part of the Gnosis ecosystem. Pertsev was an independent security consultant in the meantime. was a developer was a developer security consultant security consultant And their lives would change in 2019 when they released Tornado Cash. What is Tornado Cash? Well, it’s apparently a headache for authorities, but it wasn’t done on purpose. In essence, Tornado Cash is a privacy tool on Ethereum that helps users keep their transactions mostly anonymous. When you send Ethereum-based tokens through Tornado Cash, it mixes your coins with those of other users, making it difficult for anyone to trace where your money came from or where it’s going. This way, your financial activities stay private. Tornado Cash Tornado Cash When you send Ethereum-based tokens through Tornado Cash, it mixes your coins with those of other users, making it difficult for anyone to trace where your money came from or where it’s going. Here’s how it works: you deposit your cryptocurrency into Tornado Cash, which gives you a secret note. Later, you can use this note to withdraw your funds to a different address. Since your coins get mixed with others in the pool, the connection between your original deposit and the final withdrawal is broken, ensuring your privacy. It’s like putting your coins into a blender with others and then taking it out in a way that no one can tell whose money is whose. Does that sound harmless? It is, in theory. It could work to protect yourself against surveillance, to keep a business transaction secret, or to safely fund a project or group in a hostile territory. Sadly, it also worked for the malicious hacking team dubbed Lazarus Group to launder around $625 million in crypto from a robbery to the Ronin Network in 2022, and likely other illegal endeavors. That’s assuredly the worst use case for the tool, and the creators of this tool are being blamed for it. It could work to protect yourself against surveillance, to keep a business transaction secret, or to safely fund a project or group in a hostile territory. Money Laundering Accusations The same year of that really big hack and money laundering operation by the Lazarus Group, in August, the U.S. Office of Foreign Assets Control (OFAC) blacklisted Tornado Cash, alleging it was used for laundering billions in virtual currencies. This led to the suspension of developer accounts and the takedown of their domains. The blacklisting resulted in severe restrictions, including asset freezes and transaction bans, impacting anyone associated with Tornado Cash, even outside the U.S. blacklisted blacklisted Shortly after, Alexey Pertsev was arrested in Amsterdam, accused of money laundering through Tornado Cash. Pertsev faced significant legal hurdles , spending over nine months in prison before being placed under house arrest. His trial concluded in May 2024 with a sentence of 64 months in prison, which he is currently appealing . Pertsev's legal team is actively working on the appeal, but it may take several months before a new hearing is scheduled. Shortly after, Alexey Pertsev was arrested in Amsterdam, accused of money laundering through Tornado Cash. significant legal hurdles significant legal hurdles currently appealing currently appealing Roman Storm and Roman Semenov were similarly accused in the U.S. in August 2023. Roman Storm was arrested in Washington but was released on a $2 million bond pending his trial. His trial is set for September, where he will face charges similar to those against Pertsev. Roman Semenov is also under investigation, but he’s said to remain at large . remain at large remain at large Despite these legal challenges, the Tornado Cash community and various advocacy groups have shown strong support for the developers. Organizations like Coin Center, DeFi Education Fund, and the Electronic Frontier Foundation have voiced their support and are assisting in the legal battles. The crypto community continues to rally behind the developers, emphasizing the importance of privacy tools in the digital age. Despite these legal challenges, the Tornado Cash community and various advocacy groups have shown strong support for the developers. advocacy groups advocacy groups Electronic Frontier Foundation Electronic Frontier Foundation What’s next? Tornado Cash itself remains operational as a decentralized protocol on the Ethereum network, with significant funds still deposited in the platform. However, all the services related to it that aren’t decentralized (domains, node providers, webpages, user-friendly interfaces) are being blocked by a lot of companies that aren’t willing to face the OFAC blacklisting. Also, if a centralized crypto exchange or stablecoin relates your tokens with Tornado Cash, they may freeze your funds, for the same reasons. significant funds significant funds are being blocked are being blocked In the end, despite it being a decentralized platform available for everyone, there are feasible ways to censor this and other similar services on blockchains. That doesn’t mean the work of Pertsev, Semenov, and Storm was for naught. Besides the fact there are other numerous crypto mixers around , the ongoing legal proceedings against Tornado Cash developers are a wake-up call that highlights the complex intersection of privacy, technology, and regulation around decentralized services. feasible ways feasible ways numerous crypto mixers around numerous crypto mixers around the ongoing legal proceedings against Tornado Cash developers are a wake-up call that highlights the complex intersection of privacy, technology, and regulation around decentralized services. Our online privacy is something worth fighting for, and no centralized party seems really interested in letting us have that right. Creating code for it shouldn’t be a crime. As cypherpunks say in their manifesto, “We must defend our own privacy if we expect to have any.” As cypherpunks As cypherpunks Obyte , as a Directed Acyclic Graph (DAG) crypto network, offers a higher level of censorship resistance than any blockchain, and that translates to a higher level of privacy as privacy tools like Tornado Cash cannot be censored. It offers a decentralized, autonomous platform that operates independently of centralized intermediaries such as block producers in blockchains. Unlike blockchain services that can be censored or blocked by block producers due to regulatory pressures, Obyte's decentralized nature ensures that users retain control over their transactions without the risk of third-party interference. All developers are more than welcome to keep the cypherpunk ethos by building here! Obyte Obyte Read more from Cypherpunks Write Code series: Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism Wei Dai & B-money Nick Szabo & Smart Contracts Adam Back & Hashcash Eric Hughes & Remailer St Jude & Community Memory Hal Finney & RPOW Julian Assange & WikiLeaks John Gilmore & EFF Satoshi Nakamoto & Bitcoin Gregory Maxwell & Bitcoin Core Ian Grigg & Ricardian contracts Vinay Gupta & Mattereum Tim May & Crypto-anarchism Tim May & Crypto-anarchism Tim May & Crypto-anarchism Tim May & Crypto-anarchism Wei Dai & B-money Wei Dai & B-money Wei Dai & B-money Wei Dai & B-money Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Adam Back & Hashcash Adam Back & Hashcash Adam Back & Hashcash Adam Back & Hashcash Eric Hughes & Remailer Eric Hughes & Remailer Eric Hughes & Remailer Eric Hughes & Remailer St Jude & Community Memory St Jude & Community Memory St Jude & Community Memory St Jude & Community Memory Hal Finney & RPOW Hal Finney & RPOW Hal Finney & RPOW Hal Finney & RPOW Julian Assange & WikiLeaks Julian Assange & WikiLeaks Julian Assange & WikiLeaks Julian Assange & WikiLeaks John Gilmore & EFF John Gilmore & EFF John Gilmore & EFF John Gilmore & EFF Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Gregory Maxwell & Bitcoin Core Gregory Maxwell & Bitcoin Core Gregory Maxwell & Bitcoin Core Gregory Maxwell & Bitcoin Core Ian Grigg & Ricardian contracts Ian Grigg & Ricardian contracts Ian Grigg & Ricardian contracts Ian Grigg & Ricardian contracts Vinay Gupta & Mattereum Vinay Gupta & Mattereum Vinay Gupta & Mattereum Vinay Gupta & Mattereum Featured Vector Image by Garry Killian / Freepik Featured Vector Image by Garry Killian / Freepik Freepik Freepik Photograph of Roman Semenov [right] from X (Twitter) Photograph of Roman Semenov [right] from X ( Twitter ) Twitter Twitter Photograph of Pertsev [center] and Storm [left] from LinkedIn Photograph of Pertsev [center] and Storm [left] from LinkedIn

Cypherpunks Write Code: Pertsev, Semenov, Storm, and Tornado Cash

সাইফারপাঙ্কস কোড লিখুন: Pertsev, Semenov, Storm, and Tornado Cash

Cypherpunks schreiben Code: Pertsev, Semenov, Storm und Tornado Cash

Código de escritura de Cypherpunks: Pertsev, Semenov, Storm y Tornado Cash

Cypherpunks écrivent du code : Pertsev, Semenov, Storm et Tornado Cash

साइफरपंक्स कोड लिखते हैं: पर्टसेव, सेमेनोव, स्टॉर्म और टॉरनेडो कैश

サイファーパンクがコードを書く: ペルツェフ、セミョーノフ、ストーム、トルネード キャッシュ

Cypherpunks 작성 코드: Pertsev, Semenov, Storm 및 Tornado Cash

Cypherpunks escrevem código: Pertsev, Semenov, Storm e Tornado Cash

Шифропанки пишут код: Перцев, Семенов, Шторм и Торнадо Кэш

Şifrepunklar Kod Yazıyor: Pertsev, Semenov, Storm ve Tornado Cash

Cypherpunks viết mã: Pertsev, Semenov, Storm và Tornado Cash

密码朋克编写代码：Pertsev、Semenov、Storm 和 Tornado Cash

On May 13th, tornado cash governance was hacked. Let’s understand how it was possible and what was the vulnerability. This post won’t be about the statistics but more about the technical route of the attack. The attacker mainly used CREATE, CREATE2, and selfdestruct to exploit the governance. They proposed a contract identical to the previously passed proposal, but this proposal has a selfdestruct function that went unnoticed. After getting accepted, the hacker deletes the proposal contract and deploys a malicious contract at the same address. As this address was already accepted by the governance, they got full control of the governance contract. First of all, governance works in a way where members submit their proposals, and the other members vote for approval or rejection of the proposal. To participate in the governance, you need to lock the specific tokens( ). TORN tokens in this case After voting or creating a proposal, the tokens are completely locked until the execution or rejection of the proposal. The proposal must be submitted as a verified smart contract, and if approved by the , the code executes via delegate-call in the governance contract. DAO Everything seems good till now unless we get to know the main vulnerability used by the attacker was along with CREATE2 opcode. selfdestruct() Let’s break this down into several steps. The hacker locks their TORN tokens to participate in the governance. 2. Deploys a proposal contract, which was claimed to be the same as an earlier proposal that has been accepted by the governance. But it was not the truth, the attacker introduced a change in the contract which is the inclusion of a function that was supposed to execute the function and delete the contract. We can use the term Trojan horse for this. emergencyStop selfdestruct 3. When this proposal got passed by the voters, the attacker uses and then deploys a new malicious contract on the same address. selfdestruct 4. And now that the logic of the passed proposal has been changed to whatever they wanted, they first allocated the majority of votes to themselves and then drained all the funds they could. But the question is how was it possible? What was the main point of failure in this attack? Let’s understand step 2 mentioned above. How could they deploy a new contract with a different code to the same address? To answer this question, the most basic concept we should know is the process of address generation of a smart contract while using CREATE and CREATE2 opcodes. CREATE When we use CREATE opcode to deploy a contract, the address generated for that contract depends on the address of the creator and the nonce of the creator. This is how the address is generated using the sender’s address and nonce: address of contract = last 20 bytes of sha3(rlp(sender,nonce)) Smart contract addresses also have a nonce. But it’s different from an EOA nonce because it only increases when the contract deploys another contract, and not every time a contract calls some other contract functions that we call “internal transaction”. And after EIP 161, the nonce starts from 1 instead of 0 in a newly deployed contract. Keep this in mind as we move forward. Did you know? CREATE2 In CREATE2 there is no need for nonce. The address generation depends on 4 parameters. 0xFF — A constant that is used to prevent collisions with CREATE sender’s address — deployer contract’s address salt — arbitrary data in bytes format sent by the creator creation code— creation code of the contract to be deployed We can compute the address even before the deployment. is a small practical you can check. The solidity code to generate the address looks something like this. Here address of contract =  
          address(
                 uint160(
                    uint256(
                        keccak256(
                            abi.encodePacked(
                                bytes1(0xFF),
                                address(this),
                                salt,
                                keccak256(creation code)
                            )
                        )
                    )
                )
            ); We can now say that in order to deploy a contract on the same address as before, we need to meet these 2 conditions. The deployer address should be the same in both CREATE and CREATE2. In CREATE the nonce should be the same, whereas in CREATE2 the contract creation code should be the same. Now let’s see how the hacker combined the potentials of , , and in this case. I will again write the steps but this time in a more understanding way. selfdestruct CREATE CREATE2 The attacker deploys a contract. let’s say the “ ” contract. Deployer From this Deployer Contract they deploy another contract but with CREATE2, let’s name this “ ” contract. Sender From the Sender contract, they deploy the proposal contract using the CREATE opcode. As of now, the flow looks something like this: 4. As soon as the governance voted and passed the proposal, the attacker used selfdestruct in both the Proposal and and again deployed the Sender contract at the same address. And then similar to before they used the Sender contract to deploy the malicious contract at the address of the previously destructed proposal contract. Sender contracts Here comes the crucial part about CREATE and CREATE2.CREATE depends on the sender’s address and the nonce, every time the contract deploys another contract, the nonce increases by 1. And CREATE2 depends on the sender’s address, salt, and creation code. This means the nonce needs not to be the same but the contract creation code should be the same. It’s very much clear that to deploy the malicious contract on the same address as the proposal contract’s address, we can’t use CREATE2 because the code has changed so as the creation code. That means we need to go with the default deployment method which is CREATE. But here we got another problem, i.e. after deploying the proposal contract the nonce of the Sender contract would have been increased by 1, and while deploying the malicious contract, a different contract address will be generated. That’s the reason why the hacker destructed the Sender contract as well, . So that after deploying the Sender contract using CREATE2 the nonce will be again 1, and the address is already the same. And this leads to the deployment of the malicious contract at the same address where the accepted proposal contract was deployed before. selfdestruct also resets the address nonce to 0 This way the attacker got full control. With this takeover, they unlocked the locked TORN tokens and 10,000 governance tokens were assigned to each address controlled by the attacker for a total of 1.2 million votes. With this many votes, the attacker had complete control over the Tornado Cash governance system since only about 70,000 legitimate votes existed. They took out around a million dollar worth of assets. Also used Tornado Cash itself to get the ETHs out. I hope it was easy to understand, in case there is some confusion about anything you can reach out to us . here Also published here.

Inside the Governance Hack of Tornado Cash

The Tech Behind Tornado Cash (Line by Line for Programmers)

Over the years, Centralized Exchanges used to be the main focus of hackers until they shifted their attention to Defi Protocols and Bridges. According to on "The Block", over $2.66 Billion in crypto has been stolen from Defi Protocols between February 2020 to October 2022. data When hackers launch successful attacks, they turn to tools such as Crypto Mixers to further obfuscate the footprints of illegal transactions. What is Tornado Cash? Tornado Cash is a Smart Contract Crypto Mixer built on the Ethereum blockchain. Tornado Cash is also a non-custodial mixer—meaning: no entity runs it, therefore, Tornado Cash runs on auto-pilot. Tornado Cash allows its users to deposit assets (a maximum of 100ether per transaction) and then provide the user with a cryptographic note that would be needed as evidence of deposit when the user wants to withdraw the assets. Tornado Cash has proven to be the best and the most populous mixer amongst others—one reason is due to its frequent use by hackers. Since its creation in August 2019, Tornado Cash has since mixed over $7.6 billion worth of ether and about 30% of the funds sent through it are known to have come from hackers. October alone saw the highest number of crypto attacks than every other month of 2022 put together. The following are some of the Defi protocols whose assets were stolen by hackers and then sent to Tornado Cash for further obscurity from the beginning of 2022 to October 2022. AXIE INFINITY-RONIN BRIDGE HACK Axie Infinity is a decentralized blockchain game built on the Ethereum network. The game was built by a team called Sky Mavis and it rewards its players with cryptocurrencies and NFTs. is an Ethereum sidechain built for Axie Infinity, it enables users to transfer assets between the sidechain and the Ethereum mainnet. Ronin bridge On March 23, 2022, a hacker had carted away with Ethereum and USDC which amounted to a whopping sum of $620M from Axie Infinity's Ronin Bridge, making it the biggest crypto heist of all time to date. The attack was later discovered on the 29th of March after which the attacker had already moved a bulk of the stolen assets to tornado cash for ease of passage for laundering. The hacker stole and tokens from the bridge exploit; with the bear market rocking the crypto space today, those coins are now worth $297M. 173,600 Ethereum 25.5 million USDC On April 14, 2022, the FBI released a report the attack to two North Korean hacking groups, The Lazarus group and BlueNorOff (aka APT38). linking A month after that, The Block also released a from an exclusive interview they had with two staff of Sky Mavis. According to one of the staff, "the attack started as a fake job offer in which a senior engineer at Sky Mavis showed interest. During one of the interviews between the Engineer and the hacker, the Engineer received a PDF file containing the job details, which he downloaded and then opened on the company's computer system". This simple approach paved the way for the hacker to penetrate the Ronin system. report Good news In April, Sky Mavis raised US$150 million from Binance, Animoca Brands, a16z, Dialectic, and Paradigm to pay back all affected users. On April 22, 2022, Binance $5.8 million and attributed the funds to the stolen funds of the Ronin Bridge attack. The CEO of Binance CZ highlighted in the tweet that the attackers had started moving the stolen proceeds and part of it found its way into 86 accounts in Binance. recovered On September 8, 2022, Chainlysis rolled out a claiming that with the help of law enforcement and leading organizations in the cryptocurrency industry, over $30 million of the stolen funds (approximately 10% ) had been seized from the Hackers of Ronin Bridge. report HARMONY HACK On June 23, 2022, A hacker took over Harmony's Layer-1 Blockchain Bridge and stole Cryptos worth $100M. The hacker stole Wrapped Ethereum (WETH), AAVE, SUSHI, DAI, USDT and USDC, and then swapped them all for ETH. Three days after the hack, the Harmony team for the stolen funds (a bounty many considered to be an insult to the hacker). The hacker refused the offer and on the following day, Peckshield that the hacker had started moving the funds to Tornado Cash in batches. announced a 1% bounty offer announced TRANSIT SWAP Transit Swap is a Cross-Bridge Decentralise Finance (Defi) Platform. On October 1, 2022, the Transit Swap Finance team announced that a hacker had attacked Transit swap and that the team had also halted services immediately to curb further damages. The following day the team came out with a detailed report on the attack一 that the hacker took advantage of a bug in the code. The vulnerability of in code allowed the attacker to drain over $21 Million from the wallets of users who had approved the protocol swap contracts. claiming The team also noted that they had gotten some information leading to the IP address of the hacker and also highlighted that the discovery of the information of the hacker was due to the joint efforts of the , the , the security team, the team, and the team. SlowMist Team Bitrace Team Peckshield Token Pocket Transit Finance Later that day, the team again, that 70% of the assets were returned by the hacker due to the joint effort of all collaborators. announced On October 10, 2022, Transit Swap Team tweeted an update about the hack一alleging that a pact had been reached and the hacker would return 10,000 BNB while he keeps 2,500 BNB as a white hat hack bounty reward. Hours later Peckshield between the hacker and Tornado Cash. According to on-chain transactions, the hacker had successfully returned the remaining 10,000 BNB and moved his own 2,500 BNB through Tornado Cash. reported an interaction TEMPLE DAO EXPLOIT: On October 11, 2022, a user was the the TempleDAO exploit, and 23 minutes later, Blockchain Security Firm, Peckshield, also quoted the tweet—stating that the DAO was exploited. , the user had already moved the stolen funds of 1,831 $ETH which amounted to $2.34 Million, to a new wallet. The stolen funds amounted to 4% of the total assets of TempleDAO. Twitter first to notice According to Peckshield Later that day, STAX, a DEX powered by TempleDAO on Twitter recounting what had happened to the Defi company. They also warned users not to deposit in any of its contracts until further notice and promised the affected users remediation in due time. released a thread statement On October 16, 2022, Peckshield made of the hack on Twitter; apparently, the hacker ignored the white hat hack that was put out by the devs of TempleDAO, and instead they started moving the stolen assets to Tornado Cash in a bid to white-wash them. another follow-up tweet bounty BITKEEP HACK On October 18, 2022, The official account of BitKeep on Twitter, stating that the BitKeep Swap feature was hacked and that the attack which saw a loss of $1 million, occurred on the BNB Chain. released a report PeckShield, being the first to , stated that the $1 Million BNB Coins were later moved through Tornado Cash. release a tweet about the hack The hacker carried out a simultaneous attack on the Polygon and Binance Smart Chain Networks. All the stolen ERC-20 tokens were converted to Stablecoins and bridged to BSC Network. The hacker then purchased BNB with the bridged Stablecoins and deposited all the BNBs in Tornado Cash. Good news BitKeep gave assurances to the affected users on a full compensation plan, and on the 21st of October, the was rolled out—stating step-by-step instructions on what users needed to do for them to get refunded. compensation plan In conclusion On August 8th, Tornado Cash was by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) for its role in laundering over $455 million worth of cryptocurrency stolen by the North Korean hacking organization Lazarus Group. sanctioned It is estimated that so far in 2022, North Korea-linked groups have stolen approximately $1 billion of cryptocurrency from Defi protocols. Although Tornado cash has been sanctioned, its compliance is rather complicated and that is due to its non-custodial nature, its encoded smart contract design, and its decentralized development team—all these coupled together are the forces still driving Tornado Cash even after its sanctions.

How Tornado Cash Helped Hackers Launder Money in 2022

I﻿n August, thousands of Solana wallets were drained of their funds in an epic GitHub hack. The attack itself was not limited to Solana, but affected many blockchain projects and 'software supply chains' which rely upon code repositories stored on the centralised servers. And then, as if GitHub hadn't seen enough controversy﻿, there was the removal of the Tornado Cash source code. If you're a little lost as to what all of this means and why it affects us humble end users, you're not alone! After recently reviving the greatest Crypto news quiz podcast in the world in an all new-live show format recently, I realised, I wasn't the only one a little confused about these issues. Being the 'work smart, not hard' type of guy I am, I asked the ever eloquent and overly educated on such matters, Mitja Goroshevsky,﻿ if he would be so kind as to explain it all. He is CEO and cofounder of GOSH - Git Open Source Hodler - after all. For those who prefer to listen to the whole interview in full, it's available  over on (as well as all good audio podcast platforms!) Youtube Spotify Video And for those who prefer to skim over the key points, keep reading my eager to learn amigos! Mitja - "Well let me start by saying I'm not an expert on Solana per se. I have been on Antoly's podcast, although it never aired, we mostly spoke about Bitcoin. So I don't want to directly talk too much about Solana's problems. Solana is a great project. A wonderful idea. I mean, it's the wrong idea but it's still a wonderful idea! For perspective though, the security issues (seen recently) are not a fault with Solana itself. This was a bug in the software supply chain. And this bug originated within GitHub." Ben - "So just to slow you down a little, for our less technical users (like me!), what is GitHub, and what is the software supply chain?" Mitja - "I'll start with the easy thing: GitHub is basically a place where you store you code - a cloud service. GIT is a version control for developers working on many different versions of the same file who need to control the development process. There were others before, but GIT is the most popular version now. Think of it like revisions on a shared Google document, you'll have the latest version with revisions, but also earlier versions. In this way GitHub is just a way for developers to collaborate on the same shared codes. Now, the software supply chain is when you take the source code you've wrote, and it passes through a series of events until eventually making its way to the end user. These steps are processes such as taking the code and compiling it, taking the binary (the end result of compiling the code) and putting it into some sort of environment (Windows or Android for example), then delivering it to the app store or whichever distribution platform you use." Ben - "Tying all these ideas together then, ﻿and using Solana just as the example, GitHub works using chains or branches, and these will eventually merge as the project progresses)." Mitja - "So what happened there is, usually today when you write software, you don't write the whole thing yourself, you'll use 3rd party code libraries and so on." Ben - "I like to use an analogy of using Lego bricks." Mitja - "﻿Aha, yes. You need to put all of these things together, taking someone else's third party libraries and putting this into your product. And on every step of this road, you have potential security vulnerabilities. You can't verify all the code someone else has wrote. And so you can't be sure whether someone may have inserted malicious code into one of these libraries. And that's exactly what happened here. So to put it into perspective, these things which happened to these two wallets they had nothing to do with Solana. It has had other security problems in the past on a more core level, but that's not what happened here. " Ben - "Well, I've already made the 'where did they touch you on the doll' jokes﻿ about Sol last week, so we'll leave that there. But, leading nicely into the project you're working on at present, GOSH. Tell me more." Mitja - "GOSH is a service for storing the GIT and collaborating on the Git, like GitHub, but completely decentralised. Everything is stored on the blockchain.﻿ And the two main things we achieve with this. First, is that you can build consensus around your code, because when you add a decentralisation layer to this you can create DAOs, tokenisation and so on and so forth. Everything that Web3 is offering can be applied to the source code of your software. People don't care really, they just want to use the software but it all comes back to the source. What happened at Tornado cash recently is actually really interesting as an example. Shall we go into that?" Ben - "Yes, of course!" Mitja - "Tornado Cash is built by these guys who I know personally, who developed a Zero Knowledge Proof (ZKP) base, a cryptography system which offers an anonymity layer, ie, you cannot identify the sending or receiving wallet of the transaction. They uploaded these smart contracts to the Ethereum blockchain, and people used it. And so the US federal agencies got really annoyed by Tornado Cash, in particular, which is strange as there are many services like Tornado Cash. There is a whole blockchain running ZKP (ZCash)! They said the service was being used by North Korea, which, of course, no one supports the regime there, but you can't use this as an excuse to take away peoples rights to privacy! These are developers from democratic countries, and users from democratic countries, and what they did, it's the same as they've done with the banks for the past ten years. The 'terror' which the United States put on the banking system is beyond imagination!" Ben - "I remember the tweets from Julian Assange thanking them for the sanctions against Wikileaks, as this was the reason they starting accepted Bitcoin for donations!" Mitja - "For WikiLeaks again you have this controversy. Some people were completely siding with governments saying, you know, Wikileaks is bad..." Ben - "He didn't look after his cat!" Mitja -"Aha, yeah. But I'm talking much simpler. Real people who could not execute basic financial transactions. I could not send money to my own Mother! I tried to buy a small apartment, but wasn't allowed because my money originates in crypto and Bitcoin. Banks are so afraid of these potential sanctions they don't even want to touch it. They're not detectives so you can't expect them to do detective work, we've spoke about this many times. And with Tornado Cash, what is beyond belief is they now make the developers of the software someone uses liable." Ben - "I believe they arrested one of the developers?" Mitja - "Yes, exactly! They really arrested people for writing software someone uses! This is a horrible precedent! They should be bitten for this, bitten hard! Not literally, but in the court, of course! So, first, before they arrested him, they just deleted them from GitHub. Their whole lives work, gone, in the push of a button without a court order! Just because someone said it's wrong. And I think this is definitely not going to happen anymore! You should just abandon all centralised platforms! It's not just Github. I know a man who drove arms to the Ukrainian border from Germany. I don't know if you know but it's something a lot of people are doing. And he wad documenting it, and uploading this to Facebook. This is real reporting, real news., he's just filming what he did. A lot of people know this man personally. And they just deleted his account the other day. 15 years he'd had that account. That's his whole life. We can't allow this to happen, we are WebFree. This is what blockchain should be preventing!" Ben - "Amen! Well, I'll be keeping a close on your work at GOSH and hoping to get involved down the line. I miss your face buddy! That's an awesome end there though, so thank you very much. Let's do this again soon!" Mitja - "Anytime!" Learn more about the work at GOSH Watch/listen to the . full﻿ interview

NeverMind the Tornado Cash/Solana GitHib Attacks

On 8 August 2022, the Office of Foreign Assets Control of the U.S. Department of Treasury The rationale, according to the department, was simple; Tornado Cash was running an illegal crypto service that made it easy for criminals to launder money. The blacklisting of the service made it illegal for any resident or citizen of the United States to send or receive money through the service. blacklisted Tornado Cash. That same day, the domain used to host the project was taken down, and GitHub . Web3 companies were not left out of the loop either, as Circle, the second biggest issuer of stablecoins suspended the developer's accounts froze about $75,000 in USDC from Ethereum addresses belonging to Tornado Cash. However, the feds were not only going after Tornado Cash as an entity. They were also going after the builders of the protocol. Two days after it was blacklisted, Alexey Pertsev, one of the founders of the protocol, was . He's yet to be out. arrested and detained in Amsterdam With that, the Department of Treasury had effectively taken down Tornado Cash in almost its entirety. However, the question remains; why? What made Tornado Cash so dangerous that the federal government deployed everything they had to bring it down? The Mixing Conundrum When people talk about the benefits of Bitcoin as a currency and indeed Crypto as a financial system, they never fail to mention anonymity. Bitcoin, they often say, is great because it offers anonymity, which is something traditional banking doesn't offer by design. However, that isn't entirely true. For example, if you hold your coins in a centralized exchange, you have very little anonymity. Even if you hold your coin in your address, on-chain analysis could help snoopy third parties either link the address to your real-world Identity or trace what you're doing with your funds. For people who require complete financial privacy, this would simply not do. Since the world of cryptocurrency is probably the closest approximation of a free market anyone can find, it wasn't long before this problem was solved. The solution to the pseudonymous problem of crypto was something called . Bitcoin mixing is a service that mixes tainted or potentially tainted crypto tokens with others, to make it difficult to track down the coin's whereabouts. This is usually done by pooling funds from diverse sources together and then dispersing them at random at different intervals. It makes it very difficult for even the most motivated third party to track the funds and hereby taint it. Since both legal and illegal actors can use Bitcoin mixing services, it's near impossible to taint any crypto that originates from the mixing address. Bitcoin mixing This gives law enforcement a huge headache. Before the popularity of these mixing services, law enforcement could trace laundered or stolen crypto funds with a great degree of accuracy. In fact, they could make it so that no other reputable organization makes transactions with tainted addresses or crypto. Bitcoin mixers throw a spanner in that wheel and make that idea completely untenable. It's easy, as a crypto maximalist, to argue that the government is wrong to be against these mixers. However, the facts paint a more nuanced picture. In 2013, in the wake of the robbery of Sheep Marketplace, Bitcoin fog, a mixer, was used to . Two years later, Bitcoin fog was also used to from Chinese exchange Bter.com. From 2014 to 2017, an Ohio man named Larry Dean Harmon through his Bitcoin mixing service Helix. launder some of the 96,000 stolen bitcoins launder a total of 7,170 Bitcoin stolen laundered around $300 million in stolen coins In other words, it's clear that these mixers are being used for illegal transactions, and the government is correct to be interested in them. Tornado Cash's Tornado The US government has been on the trail of Bitcoin mixers for a long while. Bitcoin blender, one of the biggest bitcoin mixers, after it was hounded by law enforcement forces. Last year, , the founder of Bitcoin Fog, was arrested by US forces on charges of money laundering. Early this year, US forces also went after the Russian and were able to close its servers and sanction the site itself. closed down Roman Sterlingov darknet site Hydra One of the biggest Bitcoin mixing services in the world, Blender.io also got its share of sanctions after The U.S. Treasury Department's Office of Foreign Assets Control . According to the Treasury Department, the service had links to North Korea and hosted at least $21 million of the $622 million in the Axie Infinity hack. issued sanctions against it in May These arrests made it clear that the government was increasing its surveillance of the crypto space, and was hell-bent on making it difficult for criminals to launder stolen funds. However, Tornado Cash's present troubles are not just because it is a Bitcoin mixer. In other words, it wasn't targeted because it was just a run of the mill Bitcoin mixing service. There was something else. In May 2022, there was an audacious hack on Ronin bridge — a blockchain project associated with the popular play-to-earn game Axie Infinity. The hack . Lazarus is infamous across cyberspace for planning and executing some of the most incredible hacks the cyber world has ever seen. The group made use of Tornado Cash to launder a huge chunk of the $622 million stolen by it earlier this year. was linked to notorious North Korean cybercrime group Lazarus But that heist is just the biggest in a long string of incredible money laundering activities. According to law enforcement, Tornado Cash, since 2019, has been a willing tool used to in criminally acquired funds. After the explosion of DeFi in 2020, the service has picked up the pace in terms of running illicit funds and obfuscating their sources. According to analysis by TRM, were illegal funds. Asides from that, the Lazarus group has used Tornado Cash to launder funds in all ten of its most recent heists. launder over 7 billion over 40% of all the funds connected to the service in June and July of 2022 Lazarus isn't Tornado Cash's only client either. The service was also used to launder funds stolen from the where a hacker stole over $180 million of crypto. All of that money went through Tornado Cash. Even smaller criminals have made use of Tornado Cash's open source largesse. In 2021, the and the Visor finance hackers moved around 350 ETH through Tornado Cash. In July, a hacker stole , an NFT money market platform, and immediately ran it through Tornado Cash to clean the money. Around the same period, cybercriminals sent $36 million in stolen funds from bridge to the service. April 2022 Beanstalk hack Bent Finance hackers about 1,300 ETH from OMNI Harmony Protocol's Horizon These all show that Tornado Cash, at least in the eyes of law enforcement, wasn't just an innocent open source protocol anyone could use. It was a favorite tool for hackers and criminals, and they used it whenever they could and however they could. Like almost every Bitcoin mixing service, Tornado Cash has almost no guardrails to stop cybercriminals from using it. Despite public statements proposing KYC protocols, the service has continued to operate in the most laissez-faire manner. In retrospect, this meant that the service was always going to get sanctioned. It was completely Inevitable. What Does This Mean For The Future Of Bitcoin Mixing It's difficult to envision a future where law enforcement efforts are enough to stop Bitcoin mixing. While they can always take the big players out of the game, the fact that these services have no regulatory obligations and can be used for legal and illegal purposes means that they are going away no time soon. Right now, it seems like the big players in crypto are content to disavow these mixers. Tether, for example, involved with Tornado Cash. However, the rationale for this is that the government is yet to ask it to do so and that it would do so immediately after they make the request. For crypto maximalists, this may be bad news as it means that crypto may be prone to state capture. However, one might argue that the threat that these hackers and services that help them pose to the cryptoverse is greater than the threat of state capture. If the Department of Treasury is right, hackers have made away with at least 7 billion dollars through the help of Tornado Cash in the last four years. hasn't sanctioned any Ethereum addresses These are funds that could have helped countless innovations and may have helped build a more vibrant and safe crypto ecosystem. These are funds that may never be recovered. While it's unlikely that Bitcoin mixing, and indeed Bitcoin mixers, go out of fashion by themselves, there's hope that they may eventually become obsolete. According to , the next few years may birth even more rigid fund tracing algorithms that may render Bitcoin mixing obsolete. If this happens, it would mean that crypto has taken its trash out, and solved the mixing conundrum once and for all. Chainalysis

Tornado Cash And The Problem of Bitcoin Mixers

This article is my personal point of view and not connected to any other people or companies Everybody in crypto knows what's happening with Tornado. Here is my own explanation of the situation for a wider number of people, not only software-related guys. Tornado is a mixer. You take 10 ETH, send them to the mixer (open the site, or you use your own software) from your "good" address, receive a secret piece of information (a "small file" or "secret text string"), and can use this "secret" later. From any other computer, device, or with other software, you can send "secret" to the mixer, and it will send your 10 ETH to the address you’ve sent along with the secret. That's all. Tornado Cash mixer is a smart contract. It's just a piece of code that was placed ("deployed") in the Ethereum blockchain. This piece of code cannot be changed, it's code is fully open. What does "open" mean for blockchains? The first thing - is that "deployed" machine code can be read by anyone, and provably full, from the first bit to the last. Second - the algorithm is also fully open, there are tons of articles, posts, and discussions about the building of such systems, as well as deployed examples and proofs-of-concept. Third - the source code ("text" from which the "deployed" code can be generated) is also fully open on GitHub and there are tons of copies of this code on dev's computers, on GitHub, in personal dev's repositories, and in articles. You can choose from tens of implementations, download it absolutely free and deploy your own "Tornado" mixer when you want. Now, why they launched it? Why Tornado team deployed a service for money laundering? Tornado is based on a technology called zkSNARKs. It's a new cryptographic technology, allowing a lot of very powerful algorithms to be launched. For example - to defend your personal data from leaks from different services, to simplify misc verifying actions, that allow you to "prove that I have something, written in some document (ownership right, allowance to drive, absence in list of criminals, etc)" without the need to show this document in plain to verifier", because the verifier can be a malicious actor too and can leak the document itself. It's a very, very important technology for the whole IT area, not only for crypto. It allows users to build distributed networks, where computers perform large computations without trust. In theory, such networks can be thousands of times more powerful than traditional centralized networks, helping to find new medicines, materials, teach ML algorithms, and so forth. All this is possible in public networks without the risk of accounts takeover, with honest payment for each computed byte by participants. It's not an easy tech to figure out, but everybody who understands it knows that each working implementation of zkSNARKs can potentially become a breakthrough. For any blockchain developer or team - making a successful project using zkSNARKs  is an excellent achievement, because any practical use of such software gives very valuable info about the security of such protocols to all the developer community. zkSNARKs for many tasks have multiple serious drawbacks - you need huge "proving" keys (tens of gigabytes), or generation of the proof + calculation takes too much time(days), or the verifier cannot verify the result in a short time. But, some particular tasks can be implemented with zkSNARKs in a way that is suitable for users - in the case that they work with “numbers”, “sets” and - the simplest “atoms” of data science. One of the simplest applications of these kinds of proofs - is the mixer algorithm, where you prove that you previously have put a value to the secret list. The work of designing such algorithms and making them better is performed by top cryptographers, and scientists from top world universities - because they can totally change the way distributed systems work. And, as it's common in cryptography, everything is fully open, every article, every algorithm. The days when cryptography was a secret are already passed, now, any "secret protocol" means "insecure protocol", because top world cryptographers didn't audit it. Ok, interesting. But why did they implement a mixer? First, technical zkSNARKS has some specific types of "proofs" that are very useful for "proving that something is in some list (set membership proofs)". And the simplest type of data is proving the fact, that "I've added some number to this SECRET list" (without opening the number and the list). These proofs are short, can be computed by user computers quite fast, and can be verified efficiently (enough for the Ethereum blockchain could check the proof in one transaction). For this proof, it doesn't matter what number you prove "I have 28 from 30 points on the last exam in university" or "I have put 28 ETH to the protocol earlier". The mixer is good enough to be implemented because there is no connection with the outside world, which is always a pain in the ass for any decentralized project. Second, financial Why TORN token? Guys wanted to become millionaires using "dirty money"? In DeFi, in many cases, a special token is the easiest and most secure way to achieve many goals at the time, and "monetization" is not the main reason in many cases. Of course, the project needs to pay to the team, or how do you think the open source development is funded? But a token can be used also for tens of different functions - voting for the protocol changes, grants, insurance funds in case the protocol will be hacked, etc. In a mixer, it seems to not be a good decision to take part of users’ money (like centralized banks can do easily without your permission), so, the only way to organize the support of a project - it's own token TORN. How it was distributed - can be read in public and every operation with the TORN tokens is public. Third, ethical So, the team, participating in many public hackathons, making excellent and deep technical talks at public conferences, and presenting a lot of important info to ALL developers, decide to launch the project to make a special money laundering service?? So, how do I see the pseudo-dialog when a "potential" project, deciding to start or not to start a mixer on zkSNARKs: - "zkSNARKs are excellent, what can we build using them?" - "requirements?" - "must work in current Ethereum, be decentralized, user experience should be good (without huge keys, proving times, etc), the project must be useful in real life" - "(after research) It's very strict requirements, now the only thing that can be built with 99% probability and have users - it's a mixer. Proofs of “set membership” with the simplest type of data - numbers, all data is on chain, the value of the project - privacy" - "mixer? seems like it can be dangerous, money laundering, etc.." - "(tons of talks, tons of questions, consultations with lawers)" - "project, that can test promising cryptographic algorithm, with real value, on real data, protecting user's privacy, fully open and decentralized, a real “rocket”" - "A "good" part seems bigger than "bad", fuck it, let's try" (SORRY TO THE TORNADO TEAM, IT'S ONLY MY "DETECTIVE" VERSION) The success and money for such risky startups are unpredictable. The project can receive ten users and be stopped after the first serious bug. And, of course, the Tornado team, having experience with many startups, and hackathons fully understand it. It definitely wasn’t: "we know those bad guys will bring their money and we'll take part of it". It was: “Something really important and big is hidden in such solutions, let’s try” WTF was that, SEC? The result is very bad. The only thing that happened - many people (mostly from the “good” part of Tornado users) were really scared. Any other results? Tornado deposits continued, while actions of the regulator only proved the quality of the algorithm. Now, there will be tons of Tornado copies with the untrusted setup, from untrusted teams, with definitely less control. Tornado publicly performed all required actions from the regulator, by blocking “bad” addresses on their frontend. Nothing else can be done with the protocol now. The problem is not solved, funds still go through; the site, restricting users using regulatory rules is down; members, trusted by the open community but compromised. Instead of one mixer from the team with a good reputation, following all regulation requests, with good funding and public presence, users will have tens of shady copies, working exactly as original, that will continue to avoid your “regulation”. Excellent result, applause… zkSNARKs primitives are extremely important for the creation of large-scale networks, unbreakable and flexible telecom, and distributed supercomputing. They are not only about "anonymity" or "money". Sorry, that "number" is the simplest type of data in computer science, and cryptographers first try to defend "numbers". Sorry, that the best way to defend "numbers" are public blockchains. Sorry that many people preferred to call these numbers "a currency" to build their businesses. Special thanks to the "financial regulation" (of all countries) for the absence of the ability to build really important things on zkSNARKs and public blockchains: Self Sovereign Identity protocols, Verified Credentials, "anonymity-by-government", "100%-legal-onchain" solutions. Crypto, and mixers as its part, are so successful because they’re not connected to all this old mammoth shit. Every time new algorithms meet off-chain laws, made for old and stupid fiat money, shit happens. And for almost 5 years of crypto-adoption you didn't do anything significant with it, simply repeating old scenarios, repeating the same errors, and ignoring technical progress. Good luck.

Tornado is not “Cash”

The U.S Government that it would be placing a ban on the Ethereum coin mixing service Tornado Cash. The reason for the ban: Tornado Cash allows users to make private Ethereum transactions by pooling together large volumes of transactions and mixing them to prevent tracking. The site is popular among privacy-minded crypto enthusiasts but it’s also used by hackers looking to launder their ill-gotten gains. Bad actors like the North Korea backed Lazarus Group are specifically cited as having a particular affinity for Tornado Cash. They were behind the ~$8 million Nomad Bridge hack . announced recently last week The Treasury Department claims that combating hackers is the impetus behind the ban in the United States, however, security experts argue that this will not deter criminals from laundering their crypto. This will undoubtedly open up Pandora’s box for a slate of new Tornade Cash style contracts. The federal government will then need to deal with these new Tornado clones in an endless game of whack a mole. Legitimate Applications: A friend in my Alpha Chat asked if there were any legitimate use cases for Tornado Cash as a service. The best answer I could muster was to avoid the ire of oppressive government entities…however, that would probably make the use of a service like Tornado Cash illegal under the said regime. Privacy enthusiasts argue that the ban on Tornado Cash is just another step towards more restrictive crypto regulation. This move brings us ever closer to the surveillance state that we have been trying to escape with decentralized Web 3 technology. Jeff Coleman, co-founder of a startup called Counterfactual posited another legitimate use case for Tornado Cash on Twitter: “Wanting to donate to Ukraine is a great example of a valid need for financial privacy: even if the government where you live is in full support, you might not want Russian government to have full details of your actions.” In an ironic twist, the founder of Ethereum, Vitalik Buterin who was born in Russia wrote back: “I’ll out myself as someone who has used TC to donate to this exact cause.” While we continue to process the fallout from this ban, chaos agents have taken matters into their own hands as a way to make a statement. “Max chaos — someone is sending TC’d ETH to big doxxed wallets like Shaq, Beeple, Randi Zuckerberg, Ben Horowitz, Brian Armstrong, etc” -0xJim If Ethereum coming out of Tornado Cash is illegal now, it could be an issue that so much of it is ending up in celebrity wallets. Perhaps they all got with the times and started paying for their schedule 1 substances with crypto. Also, Jimmy Fallon always gave me North Korea-backed hacker vibes…they can have him back. Privacy may have taken an L today but the internet remains undefeated. Thank you for reading. Check out my unfiltered thoughts on Twitter: https://twitter.com/wasifmrahman Follow my career on LinkedIn: https://www.linkedin.com/in/wasifmrahman/ Also published . here Disclaimer: Nothing in this article constitutes professional investment advice. Please do your own thorough research before making any investment decisions.

Stories, News & Mentions about TORNADO

Tornado’s Stories on HackerNoon

Tornado's News & Mentions