Attacker registered expired Tornado Cash domain and drained 1,010 ETH from a user via phishing; group has stolen ~4,000 ETH over 12 months using similar tactics.
Security & Exploits ·
A user lost 1,010 ETH after clicking a bookmarked link that redirected to a phishing site operating on Tornado Cash's expired official domain tornado.cash. The attacker had registered the lapsed domain after Tornado Cash's team failed to renew it during OFAC sanctions, then deployed a fraudulent frontend designed to harvest deposit credentials. The stolen funds were traced to addresses controlled by the attackers within 12 hours of the breach.
The incident highlights a broader pattern of exploitation targeting users who retain old links or bookmarks to sanctioned services. According to tracking by the victim, the same group has allegedly stolen approximately 4,000 ETH over the past 12 months using comparable phishing methods, suggesting a sustained campaign rather than an isolated attack.
What remains unclear is whether Tornado Cash intends to reclaim or secure the expired domain going forward, and how many other users may retain outdated bookmarks that could expose them to the same vector. The mechanics of credential theft from the fake frontend and the full address chain of the stolen funds have not been fully detailed.