According to Paradigm Researcher @samczsun, Tornado Cash governance effectively ceased to exist. Through a malicious proposal, an attacker granted themselves 1.2 million votes. As this is more than 700,000 legitimate votes, they now have full control over the protocol.
Through governance control, the attacker can withdraw all of the locked votes, drain all of the tokens in the governance contract, and brick the router. However, the attacker still can't drain individual pools.