A sophisticated phishing operation targeting Tornado Cash users has allowed attackers to steal 1,010 ETH through a compromised web interface. The incident occurred when a user accessed the protocol using an old bookmarked link, which directed them to a malicious version of the official site.
Phishing operation exploits expired Tornado Cash domain
Tornado Cash is an Ethereum-based coin mixing protocol designed to enhance transaction privacy. Following recent US sanctions imposed in 2022, its original team failed to renew the tornado.cash domain, leading attackers to acquire it and recreate a convincing replica of the protocol’s frontend.
According to sources including Wu Blockchain, the affected user inadvertently deposited funds into Tornado Cash’s legitimate smart contracts but interacted with a fake interface. This phony frontend secretly captured the private withdrawal notes necessary to access the deposited ETH.
Within 12 hours, the attackers used these notes to drain the user’s 1,010 ETH from the system. The assets remain in wallets linked to the attackers, and on-chain analysis suggests that nearly 4,000 ETH may have been stolen via similar phishing tactics over the last year.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLThe event highlights the significant risk posed by expired domains and outdated bookmarks. Even if a project’s core code remains intact, web-based user interactions can expose sensitive information if malicious actors control the user interface.
Attackers took advantage of an expired Tornado Cash domain, luring users to a cloned interface that captured withdrawal credentials and enabled them to siphon more than 1,000 ETH in a single incident.
Loss of control over the tornado.cash domain occurred after the original team was sanctioned and was unable to maintain its web presence. This provided an opportunity for cybercriminals to purchase the domain and conduct imitative phishing operations.
Users relying on older or bookmarked links remain highly vulnerable, as they may unknowingly supply information to interfaces that are no longer operated by the original team.
Unlike typical smart contract attacks, this incident did not require compromising the protocol itself. The adversaries simply harvested the private withdrawal notes as users interacted with the fake site, granting them direct access to victims’ funds.
Mini dictionary: Withdrawal note, a unique piece of information provided to users by mixer protocols like Tornado Cash to permit fund recovery; disclosing it to a third party enables access to the related deposit.
Suspicious on-chain activity adds complexity
On-chain researcher Specter reviewed transactions tied to the victim and noted that the individual’s wallet moved 73 BTC—about $4.6 million—out of the privacy-focused Whirlpool mixer in the weeks leading up to the theft. Later, parts of these funds transferred to Ethereum and eventually reached the compromised Tornado Cash interface.
The user claimed previous exposure in a Coldcard-related hacking incident, allegedly prompting him to move funds from Bitcoin to Ethereum. However, Specter questioned the multiple transfers between privacy mixers before the phishing attack occurred.
Chain analysis revealed large movements of Bitcoin through Whirlpool and then into Ethereum, ultimately leading to the Tornado Cash phishing operation, raising questions about both the source and the intent behind the flows.
Specter also identified links between the wallet in question and Telegram communities dedicated to discovering or brute-forcing private keys. This raises further doubts around the funds’ original ownership, but no definitive link to other crimes has been established.
The case underscores the broader threat posed by inactive crypto domains, which may remain linked to obsolete bookmarks long after the original teams lose control.
| Incident | Method | Amount Stolen | Period |
|---|---|---|---|
| This attack | Malicious frontend, expired domain | 1,010 ETH | Single incident |
| All similar attacks (past year) | Domain phishing | 4,000 ETH | 12 months |
Ultimately, the attack stemmed entirely from weaknesses in user behavior and interface control rather than a flaw in Tornado Cash’s underlying smart contract infrastructure.
