Search
Search for projects by name or address
Tornado Cash
About
A classic Ethereum mixer design based on fixed-denomination pools and zk withdrawals.
About
A classic Ethereum mixer design based on fixed-denomination pools and zk withdrawals.
Tornado Cash is a non-custodial mixer on Ethereum built around separate fixed-denomination pools, which prevents linking deposits and withdrawals via the amount. A deposit publishes a commitment into a Merkle tree producing a secret note, and a later withdrawal uses a zk-SNARK proof and the note to send the same denomination to a different address, breaking the deposit-withdrawal link. The note represents ownership of tokens in a Tornado cash pool, and losing it will effectively mean losing the tokens.
The core mixer contracts are immutable and have no admin, pause, or upgrade path, so funds can only move out with a valid proof. However Tornado cash features TORN token governance, which controls peripheral smart contracts: official pool registry, relayer registration requirement and TORN tokenomics.
Privacy considerations
Tornado cash introduces a permissionless relayer network, which is essential for practical privacy. Relayers process withdrawals from Tornado cash pools on user’s behalf for a fee, which enables withdrawals to fresh addresses without funding them before the withdrawal. Without an active relayer network, practical privacy of Tornado cash deteriorates significantly.
Practical privacy also depends on the timing of deposits and withdrawals, underlying network and browser used to interact with Tornado cash frontend (if used), RPC providers used to send transactions and query public blockchain state. Users are advised to research OPSEC best practices.
Fees
The immutable Tornado Cash pools do not charge a protocol-level deposit or withdrawal fee. Withdrawals can include a relayer fee chosen offchain between the user and the relayer and passed to the pool withdrawal call.
Compliance
Tornado cash does not have any protocol-level compliance features. However, it provides an optional Compliance Tool, which allows users to generate a proof linking a withdrawal to a specific deposit without revealing this information publicly onchain. This enables users to selectively disclose the origin of funds to third parties, such as exchanges or regulators.
Protocol pools were sanctioned by OFAC in August 2022, flagging funds moved through these smart contracts as illicit and resulting in broad censorship (mainly by block builders) of transactions touching the contracts. Sanctions were lifted on March 21, 2025.
Anonymity set
A user’s anonymity set consists of all previous deposits into the same bucket (i.e. deposits of the same token and amount). Deposits can be mixed only with other deposits of the same token and denomination. To maximize the anonymity set, users are advised to deposit into the buckets with the most usage.
Secure frontend
For average users, the Tornado Cash frontend must be recognized as a critical part of the privacy protocol. If compromised, it can steal user assets and violate user privacy, which was exploited in 2024.
The frontend’s root of trust is the IPFS content hash registered for tornadocash.eth in the ENS smart contract on Ethereum. The latest hash can be fetched from a trusted ethereum node (e.g. your own or trusted light node rpc). There were incidents of malicious frontend hash updates passing onchain governance proposals before, so using a publicly audited or self-audited IPFS hash is advised. An example of an audit process with useful links can be found here or here. The frontend can then be accessed by running a local IPFS node that automatically fetches the verified frontend hash (e.g. in style of dapp3.eth or kubo + ipfs-companion and serves it in the browser locally.
2025 May 26 — 2026 May 26
2025 May 25 — 2026 May 26
Asset | Buckets | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
|---|---|---|---|---|---|
| 4 | 1.43 K $28.26 M | 4.92 K $138.53 M | 257.22 K $12.75 B | $449.44 M | |
| 4 | 7 $130.24 K | 50 $2.00 M | 9.13 K $438.32 M | $7.55 M | |
| 3 | 0 $0.00 | 0 $0.00 | 2.39 K $535.41 M | $6.30 M | |
| 2 | 7 $6.99 K | 59 $39.18 K | 2.64 K $1.90 M | $39.95 K | |
| 2 | 2 $199.95 | 12 $1.19 K | 1.20 K $889.13 K | $29.89 K | |
| 4 | 0 $0.00 | 0 $0.00 | 324 $13.31 M | $25.30 K | |
| Total | 1.44 K $28.39 M | 5.04 K $140.57 M | 272.92 K $13.74 B | $463.40 M |
Funds can be stolen if
- the zk proof system is broken, allowing invalid withdrawals.
- the trusted setup is compromised or all ceremony participants collude, allowing invalid withdrawals.
Funds can be lost if
- a user loses the note secrets required to withdraw.
Privacy can be lost if
- no relayer is available and the withdrawal must be submitted from an address that can be linked to the user (see best practices page for more info).
Tornado cash has a TORN DAO, which does not have the authority to upgrade or modify existing pools in any way. However it controls a significant portion of the Tornado cash protocol and periphery, including:
- Default router for deposits and withdrawals and the official registry of supported pools. Malicious upgrades of these components could lead to users losing deposited tokens.
- Standard UI IPFS hash registered on ENS (link). Malicious upgrades of these components could lead to users losing deposited tokens.
- TORN token itself. Malicious upgrades of the token could lead to token transfers being frozen.
- Registered relayers. Malicious upgrades of these components could remove all registered relayers, disrupting user-relayer coordination and complicating private withdrawals.
Governance flow
- Users lock TORN token in the Governance contract (0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce). After voting or proposing, staked tokens are locked for 5d 6h after proposal ends, preventing governance hopping. The stake can be delegated to another address.
- Anyone with at least 1.00 K TORN can create a proposal. The proposal spends 1m 15s in the Pending state, where voting is still disabled, followed by 5d of Active state, when votes are cast. If the vote outcome changes in the last 1h, the voting period is extended by another 6h.
- Proposal is accepted by the simple majority with a required quorum of 100 K TORN. Once accepted, 2d of Timelocked state allow exiting the protocol to everyone who disagrees with the proposal. Afterwards, the proposal can be permissionlessly executed within 3d.
Tornado Cash
Detailed description
Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony built on top of the 30th contribution to the Perpetual Powers of Tau ceremony, and completed in May 2020. It collected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash published the participant list, archive of contributions and artifacts, and the generated verifier contract.
- Ceremony completion announcement: https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa
- Ceremony page with participant list and archive download: https://ceremony.tornado.cash/
- Initial ceremony announcement: https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1
- Ceremony code repository: https://github.com/tornadocash/phase2-bn254
Ethereum
Actors:
Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior. Member of GnosisSafe.
- Can upgrade with no delay
- TornadoTreesV2
- RelayerRegistry
- TornadoStakingRewards
- GovernanceProposalStateUpgrade
- FeeManager
- InstanceRegistry
- Can interact with TornadoTreesV2
- replace the proxy allowed to enqueue deposit and withdrawal leaves
- replace the verifier used for batched tree updates
- Can interact with RelayerRegistry
- change the router address allowed to burn relayer stake during withdrawals
- nullify a registered relayer’s staked balance
- set the minimum TORN stake required to become a relayer
- Can interact with TornadoStakingRewards
- update user reward accounting when locked balances change
- withdraw TORN held by the staking rewards contract
- Can interact with FeeManager
- change how long cached per-instance fees remain valid before they must be recomputed
- change the TWAP lookback period used to price Tornado instances
- change the Uniswap fee tier used for the TORN price source
- Can interact with TornadoProxyV2
- add or update supported pool instances
- replace the connected Tornado Trees contract
- rescue tokens sent to the proxy
- Can interact with Miner
- change the reward-swap pool weight used when distributing TORN rewards
- replace the connected Tornado Trees contract
- replace the reward, withdrawal, and tree-update verifiers
- set mining reward rates
- Can interact with TORN
- manage the allowlist of addresses that can transfer while TORN is paused
- pause or unpause TORN transfers after the initial pause period expires
- rescue arbitrary tokens held by the TORN contract
- Can interact with TornadoProxyV1
- enable or disable supported pool instances
- rescue tokens sent to the proxy
- Can interact with InstanceRegistry
- add or update supported Tornado instances and their enabled/disabled state
- change the router contract allowed to interact with registered instances
- remove supported instances from the registry
- set per-instance protocol fees charged to relayers
- Can interact with TornadoRouter
- rescue tokens sent to the router
A Multisig with 1/1 threshold.
Participants (1):
GovernanceProposalStateUpgrade
Ethereum
Fixed-denomination Tornado Cash pool for 50K cDAI deposits.
Fixed-denomination Tornado Cash pool for 10K DAI deposits.
Fixed-denomination Tornado Cash pool for 1000 USDT deposits.
Fixed-denomination Tornado Cash pool for 0.1 ETH deposits.
Fixed-denomination Tornado Cash pool for 100 USDT deposits.
Fixed-denomination Tornado Cash pool for 0.1 WBTC deposits.
Fixed-denomination Tornado Cash pool for 5K cDAI deposits.
Fixed-denomination Tornado Cash pool for 100K DAI deposits.
Fixed-denomination Tornado Cash pool for 500K cDAI deposits.
Fixed-denomination Tornado Cash pool for 1000 USDC deposits.
Fixed-denomination Tornado Cash pool for 1 ETH deposits.
Upgradeable registry that tracks registered relayers, their worker addresses, and their staked TORN balances used to service withdrawals. Relayers registered here could be queried by a tornadocash frontend to facilitate discovery for users, but users are free to use any (unregistered) relayer at withdrawal time.
- Roles:
- admin: GovernanceProposalStateUpgrade
- governance: GovernanceProposalStateUpgrade
Upgradeable fee manager that derives relayer burn fees for each Tornado instance from registry settings and Uniswap TWAP data.
- Roles:
- admin: GovernanceProposalStateUpgrade
- governance: GovernanceProposalStateUpgrade
Fixed-denomination Tornado Cash pool for 1 WBTC deposits.
Unverified MiMC hasher used by newer Tornado pool generations for commitment-tree operations. If this contract were malicious or had a backdoor, all pools using it would be compromised. The source code of this contract is not verified on Etherscan.
Fixed-denomination Tornado Cash pool for 10 ETH deposits.
Fixed-denomination Tornado Cash pool for 100 ETH deposits.
Upgradeable registry of supported Tornado Cash pool instances and their mutable per-instance fee and routing configuration.
- Roles:
- admin: GovernanceProposalStateUpgrade
- governance: GovernanceProposalStateUpgrade
Fixed-denomination Tornado Cash pool for 10 WBTC deposits.
Fixed-denomination Tornado Cash pool for 5M cDAI deposits.
Fixed-denomination Tornado Cash pool for 100 DAI deposits.
Router contract that validates supported instances, forwards deposits and withdrawals, and subtracts from relayer stake through the relayer registry during withdrawals.
- Roles:
- governance: GovernanceProposalStateUpgrade
Fixed-denomination Tornado Cash pool for 100 USDC deposits.
Fixed-denomination Tornado Cash pool for 1000 DAI deposits.
Staking contract that escrows TORN staked by relayers. With time, their stake is subtracted from for being officially registered as relayers and receiving fees from each withdrawal, and is redirected as TORN rewards for governance participants who are locking their TORN for voting/staking.
- Roles:
- admin: GovernanceProposalStateUpgrade
- governance: GovernanceProposalStateUpgrade
TORN governance token contract. Transfers start paused and can later be toggled by governance, which also controls the paused-transfer allowlist and token rescue functions.
- Roles:
- governance: GovernanceProposalStateUpgrade
Anonymity Mining - Verifier contract for Tornado anonymity-mining withdrawal proofs.
Anonymity Mining - Legacy Tornado Trees contract that records deposit and withdrawal leaves from TornadoProxyV1 and maintains the roots later consumed by migration and mining logic.
Anonymity Mining - Upgradeable batch-based Tornado Trees contract that reuses legacy tree state, queues new leaves from the newer proxy, and accepts batched root updates proven by a verifier.
- Roles:
- admin: GovernanceProposalStateUpgrade
- governance: GovernanceProposalStateUpgrade
Anonymity Mining - Liquidity schedule that pays out TORN rewards for anonymity mining. Only the Miner contract can draw from it or adjust the reward weight.
Anonymity Mining - Verifier contract for Tornado mining account-tree update proofs.
Anonymity Mining - Newer immutable Tornado proxy that routes deposits and withdrawals to supported pool instances and records them in the upgraded Tornado Trees contract.
- Roles:
- governance: GovernanceProposalStateUpgrade
Anonymity Mining - Mining and reward-distribution contract for Tornado anonymity mining. It verifies reward and withdrawal proofs, maintains account roots, and routes TORN rewards through the swap contract.
- Roles:
- governance: GovernanceProposalStateUpgrade
Anonymity Mining - Verifier contract for Tornado anonymity-mining reward proofs.
Anonymity Mining - Legacy immutable Tornado proxy that routes deposits and withdrawals to pool instances and records them in the legacy Tornado Trees contract.
- Roles:
- governance: GovernanceProposalStateUpgrade
Anonymity Mining - Unverified Poseidon hasher used by the legacy Tornado Trees merkle trees. The source code of this contract is not verified on Etherscan.
Anonymity Mining - Verifier contract for batched Tornado Trees root updates.
Vault that escrows locked TORN of governance participants who wish to receive voting rights.
Unverified merkle tree instance that stores legacy Tornado deposit leaves for TornadoTreesV1. The source code of this contract is not verified on Etherscan.
Unverified merkle tree instance that stores legacy Tornado withdrawal leaves for TornadoTreesV1. The source code of this contract is not verified on Etherscan.
Vault that escrows ETH for governance gas-compensation payouts and can return unused funds to governance.
The current deployment carries some associated risks:
Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).