# Timelock Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Timelock", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

On June 25, 2026, a deceptive governance proposal (#67) appeared in the Tornado Cash DAO, masquerading as an upgrade to implement fee adjustments and token burns. Security researchers, including Sergey Shemyakov and Pascal Caversaccio, quickly identified it as malicious. The proposal's unverified code contained a hidden function designed to stealthily replace the protocol's legitimate governance address (0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) with an attacker-controlled address (0x5efda50f22d34f272c7077689d6abc42f15e285f). If passed, this would have granted the attacker control over the DAO's treasury, containing approximately $23 million in TORN tokens, and the ability to drain all relayers. The attacker's wallet (0xd4eca8c9242b9f9faa3cf19a78defc21dc97a925) was funded via the privacy protocol Railgun four days prior, obscuring the source. The community response was swift, with the proposal receiving 27,163 TORN votes against (100%) and 0 for, far below the 100,000 TORN quorum required for validity. It is set to expire on June 30. This incident marks the second major governance attack on Tornado Cash, following a May 2023 exploit that stole $2.17 million. It highlights persistent vulnerabilities in DAO structures where power derives from token ownership. The article advises users to follow security researchers, vote against unverified proposals, and delegate voting power. For developers, implementing timelocks—a delay between proposal approval and execution—is presented as a critical security measure to allow for community review and intervention.

Foresight News06/26 06:01

Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

Foresight News06/26 06:01

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says

Blockchain intelligence firm TRM Labs reports a governance exploit against the Token of Power protocol, resulting in a loss of approximately $1.58 million in WETH. The attacker exploited a missing timelock in the protocol's Aragon DAO setup, allowing them to propose, vote on, and execute a malicious action within a single block. The attacker funded the operation with 662 ETH from Tornado Cash, purchased enough TOP tokens to gain majority voting power, minted 10 billion new TOP tokens, and swapped them for WETH via a Balancer pool before moving funds back through Tornado Cash. The incident underscores that governance design is a critical security risk in DeFi, where parameters like timelocks provide essential reaction time. It also highlights how mixers and liquidity pools can be utilized in exploits without being directly compromised. Observers are now watching for any movement of the stolen funds and further remediation details from involved parties. This event is part of a broader shift in crypto, emphasizing the importance of underlying infrastructure, security, and governance alongside market movements.

bitcoinist06/14 21:32

Token Of Power Governance Exploit Drains $1.58 Million In WETH, TRM Says

bitcoinist06/14 21:32

Understanding Bound in One Article: The "Multi-signature + Timelock" Escape Mechanism and the Off-Chain Matching Black Box

**Title**: Understanding Bound: The Escape Mechanism of "Multi-Sig + Time Lock" and the Off-Chain Matching Black Box **Summary**: Bound Exchange, evolved from the earlier radFi platform, introduces a novel approach to Bitcoin trading by combining self-custody security with exchange-like speed. Its core mechanism relies on a 2-of-2 multi-signature (multi-sig) address for user deposits. One private key is held by the user via a passkey, and the other is held by Bound. This setup requires both keys to sign any transaction, preventing Bound from unilaterally accessing user funds (non-custodial). To address the risk of Bound becoming unavailable, a 3-month timelock is integrated into the Bitcoin script. After this period, users can withdraw their assets with just their single signature, ensuring an escape hatch. For trading, Bound operates a concentrated liquidity AMM. However, as Bitcoin L1 lacks smart contracts, the AMM curve, liquidity management, and trade price calculations occur off-chain in Bound's backend database. On-chain Bitcoin transactions serve only as final settlement receipts for pre-determined amounts. This creates a centralization point: the critical sequence of trade execution—which determines the exact price along the curve for each order—is managed off-chain by Bound in a non-transparent "black box." While the 2-of-2 setup protects user本金 (principal), the pricing and ordering of trades introduce potential operational MEV risks, as the order processing is invisible and unverifiable on-chain. In practice, users can also connect external wallets (like Unisat) for fully self-custodied trading, but this requires manually signing every transaction. The platform currently supports deposits of BTC and Runes only.

marsbit05/25 09:11

Understanding Bound in One Article: The "Multi-signature + Timelock" Escape Mechanism and the Off-Chain Matching Black Box

marsbit05/25 09:11

活动图片

Othersright-arrow

Regulatory Policyright-arrow