A cryptocurrency user has lost 1,010 ETH after falling victim to a phishing attack that exploited the expired official domain of Tornado Cash, the privacy protocol sanctioned by U.S. authorities.
As first reported by Wu Blockchain, citing disclosures from community users and on-chain tracking by the victim, the individual clicked an outdated bookmark linking to tornado[.]cash. The domain had been taken over by attackers who set up a fake frontend designed to steal deposit credentials. The funds were drained within 12 hours of the interaction.
Tornado Cash’s original domain expired after the project team failed to renew it in the wake of Office of Foreign Assets Control (OFAC) sanctions imposed in 2022. Attackers subsequently registered the domain and deployed a convincing replica of the legitimate interface.
In a typical Tornado Cash phishing scenario of this type, users deposit assets into the real smart contracts while the malicious site captures the cryptographic notes required for later withdrawal, allowing the attackers to claim the funds.
Onchain data from Etherscan shows that the stolen ETH is currently held mainly in addresses controlled by the perpetrators. One address referenced in connection with the tracking, 0xd8B…3b745, shows a balance of approximately 810 ETH at the time of reporting. These funds arrived primarily through withdrawals from Tornado Cash’s 100 ETH and 10 ETH pools in the days preceding the public disclosure. The remaining portion of the 1,010 ETH appears to reside in other wallets associated with the same group.
Domain Expiration and Attack Mechanics
The incident highlights ongoing risks tied to the aftermath of OFAC’s designation of Tornado Cash. After sanctions, maintenance of official infrastructure, including domain renewals, became complicated. The legitimate protocol continues to operate through decentralized channels such as IPFS and ENS gateways, but many users retain old bookmarks pointing to the former primary domain. Attackers capitalized on this by registering the expired name and presenting a near-identical interface that funneled deposit notes to their control.
Community reports relayed by Wu Blockchain indicate the same operators have used comparable tactics over the past 12 months, allegedly accumulating nearly 4,000 ETH in total. While independent confirmation from major blockchain security firms has not yet been published for this specific case, the pattern aligns with previously documented phishing campaigns targeting privacy tools, in which fake frontends intercept user secrets without altering the underlying smart contracts.
Victims and observers have pointed to the importance of verifying every interaction. Legitimate access to Tornado Cash should occur exclusively through officially validated IPFS or ENS endpoints, with careful inspection of contract addresses and transaction details before signing.
Tracking, Scale, and Ongoing Risks
Onchain evidence linked to the reported victim tracking shows the bulk of visible proceeds concentrated in a limited set of addresses. The single publicly highlighted wallet accounts for roughly 810 of the 1,010 ETH, underscoring that the full sum is distributed rather than consolidated in one location. No further movement of the funds beyond the initial withdrawals had been widely reported at the time of the initial disclosure.
Security experts quoted in the Wu Blockchain coverage reiterated standard precautions for users of decentralized privacy protocols: avoid relying on historical domain names, cross-check all interfaces against known official sources, and scrutinize every contract interaction. The episode serves as a reminder that even after sanctions and infrastructure shifts, residual user habits—such as bookmarked links—can create exploitable vectors.
As of the latest available reporting on August 20, 2026 (12:30 AM UTC), the stolen assets remain under the control of the attackers according to the victim’s tracking shared with community channels.
The case adds to a broader pattern of social-engineering and phishing losses in the Ethereum ecosystem, where domain and interface impersonation continue to extract significant value despite improved awareness tools.
Also read: HTX Denies Address Poisoning as Kraken Freezes $4.2M in Funds
