A user lost 1,010 ETH after accessing a phishing site through Tornado Cash’s lapsed official domain, now controlled by attackers.
A phishing attack drained 1,010 ETH from a user who accessed Tornado Cash’s expired official domain, tornado.cash. The domain, unrenewed amid OFAC sanctions, was hijacked by attackers who set up a fake frontend to steal deposit credentials.
The victim clicked an old bookmarked link, redirecting to the malicious site. Tracking shows the stolen funds remain in hacker-controlled addresses. Similar attacks have reportedly stolen nearly 4,000 ETH over the past year.
Tornado Cash’s team failed to renew the domain following U.S. sanctions, enabling the takeover. The incident highlights risks of expired crypto-related domains.