# Tornado Cash Markdown version of https://l2beat.com/zk-catalog/tornado-cash ## Summary - Creator: Tornado Cash - Total Value Secured: $622.59 M (-5.25% compared to seven days ago) - Trusted setups for websnark (Groth16): - Tornado Cash, risk yellow (medium risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was built on top of 30 phase 1 contributions, and reached 1114 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised. - Used in: [Tornado Cash](https://l2beat.com/privacy/projects/tornado-cash) - Verifiers: 1 successful (verified by [L2BEAT](https://l2beat.com)) - zkVM: BN254 (curve), websnark (Groth16) ### About An unconditional privacy pool of fixed amounts with immutable contracts, and an app pinned on ENS by token governance. ### Links - Website: https://app.ens.domains/tornadocash.eth?tab=records - Repository: https://github.com/tornadocash/tornado-core, https://github.com/tornado-dao/classic-ui - Social: https://t.me/TornadoCashOfficialDAO ## Value Secured The interactive TVS chart is shown on [the HTML page](https://l2beat.com/zk-catalog/tornado-cash#tvs). ## Milestones & Incidents - 2025-03-21: [Removed from the OFAC sanctions list](https://home.treasury.gov/news/press-releases/sb0057). OFAC removes Tornado Cash and the pools' addresses from its sanctions list. - 2024-01-02 (incident): [Pinned app leaks deposit notes](https://forklog.com/en/backdoor-discovered-in-ipfs-version-of-tornado-cash/). The app pinned by proposal 44 sends deposit notes to an outside server until proposal 52. - 2023-05-20 (incident): [Governance taken over by a malicious proposal](https://www.theblock.co/post/231637/attacker-uses-malicious-proposal-to-take-over-tornado-cash-governance). Proposal 20 hands the attacker control of governance until proposal 21 reverts it. - 2022-08-08 (incident): [Added to the OFAC sanctions list](https://home.treasury.gov/news/press-releases/jy0916). OFAC adds Tornado Cash and the pools' addresses to its sanctions list. - 2020-05-18: [Pools become immutable](https://www.coindesk.com/tech/2020/05/18/developers-of-ethereum-privacy-tool-tornado-cash-smash-their-keys). The developers set the operator of every pool to zero, so no one can change the pools. ## Trusted Setups Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Tornado Cash - Risk: yellow (medium risk) - Proof systems: websnark (Groth16) Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony built on top of the [30th contribution to the Perpetual Powers of Tau ceremony](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1), and completed in May 2020. It collected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash published the participant list, archive of contributions and artifacts, and the generated verifier contract. - Phase 1 ceremony (first 30 contributions are used): . - Ceremony completion announcement: [https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa) - Ceremony page with participant list and archive download: [https://ceremony.tornado.cash/](https://ceremony.tornado.cash/) - Initial ceremony announcement: [https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1) - Ceremony code repository: [https://github.com/tornadocash/phase2-bn254](https://github.com/tornadocash/phase2-bn254) ## Verifier IDs List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions). ### Groth16: websnark Fast browser-native ZK SNARK prover written in WASM by Tornado Cash team. #### Tornado Cash verifier v2.1 - Verifier ID: `Tornado Cash verifier 03.07.2026` - Source: https://github.com/tornadocash/tornado-core/tree/v2.1/circuits - Verification: successful (verified by [L2BEAT](https://l2beat.com)) - Used in: [Tornado Cash](https://l2beat.com/privacy/projects/tornado-cash) **Known deployments** - [0xce172ce1F20EC0B3728c9965470eaf994A03557A](https://etherscan.io/address/0xce172ce1F20EC0B3728c9965470eaf994A03557A#code) on Ethereum, used in: [Tornado Cash](https://l2beat.com/privacy/projects/tornado-cash) ##### Verification steps This regeneration attests that the verifier smart contract verification keys correspond to circuits published in Tornado Cash release. Generally, to regenerate Tornado Cash verifier, the following has to be done: 1. Checkout the correct branch of the sources: `https://github.com/tornadocash/tornado-core/tree/v2.1`. 2. Compile the `.circom` circuit sources into `.json`. 3. Fetch published prover keys for `tornado.params`. This file contains the circuit information and Groth16 phase 2 trusted setup information (final evaluation keys for all 1114 contributions). It does not contain phase 1 trusted setup data, which must be fetched separately. 4. Check that `tornado.params` was generated with the same compiled circuit as was obtained in step 2. This step will implicitly check the integrity of phase 2 trusted setup, and it will rely on the separately fetched phase 1 trusted setup files. 5. Generate verification keys from the prover key and make sure that it is identical to the one in the solidity smart contract. Helper scripts that implement the flow above and more detailed explanations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/tornado-cash/verification_tornado_cash.zip). This .zip must be extracted in `tornado-core` dir checked out on tag `v2.1` (commit hash `a533ad9ffb62163a42d4fa9a09984c5dd4e5c41d`) before the execution.