1,010 ETH Stolen in Tornado Cash Phishing Attack

A cryptocurrency user reportedly lost more than 1,000 ETH after clicking an old bookmark that redirected them to a phishing website impersonating a former cryptocurrency service.

Approximately 1,010 ETH was reportedly drained within 12 hours, according to information confirmed by blockchain-focused account @WuBlockchain on X. The incident highlights the growing risks surrounding expired domains, old bookmarks and fraudulent websites designed to imitate trusted cryptocurrency platforms.

According to community reports, the victim had saved an old link associated with Tornado Cash in a browser bookmark. When the link was accessed, the user was reportedly redirected to a malicious website operating through the expired domain associated with the service.

The attackers allegedly created a fake frontend that closely resembled the original website. Because the page appeared familiar, the victim reportedly interacted with the interface before discovering that the website was no longer controlled by the original operators.

1,010 ETH Drained Within 12 Hours

The reported theft involved approximately 1,010 ETH, making it one of the more significant phishing-related cryptocurrency losses highlighted by the community.

Blockchain tracking reportedly showed that the stolen funds were transferred to wallet addresses believed to be controlled by the attackers. Much of the stolen Ethereum was still reportedly held in those addresses as investigators and community members followed the movement of the funds.

Ethereum transactions are publicly visible, allowing researchers to monitor transfers between wallet addresses. However, being able to trace stolen cryptocurrency does not necessarily mean that the assets can be recovered.

Once funds are moved between multiple wallets or through other services, identifying the individuals behind the addresses and recovering the assets can become considerably more difficult.

Expired Domain Becomes Phishing Risk

The reported incident highlights a serious but sometimes overlooked security problem in the crypto industry: expired domains.

When a cryptocurrency project stops maintaining a website or fails to renew its domain, the address can eventually become available to another party. An attacker who acquires such a domain may then attempt to exploit the reputation associated with the previous website.

This creates a dangerous situation for users who continue to rely on old bookmarks, search results or previously shared links.

A domain that was legitimate in the past is not necessarily safe today. If ownership changes, users may unknowingly enter a website operated by criminals while believing they are returning to a familiar service.

The reported Tornado Cash incident demonstrates how attackers can potentially use that trust against cryptocurrency users.

Fake Crypto Frontends Can Be Dangerous

Phishing websites are particularly effective when they closely reproduce the appearance of legitimate cryptocurrency platforms.

A fake frontend can copy logos, layouts, buttons and other elements of the original website. To an unsuspecting visitor, the difference may be difficult to identify.

The danger becomes even greater when a website asks users to connect their cryptocurrency wallets or approve transactions.

Unlike traditional banking systems, cryptocurrency transactions are generally irreversible once confirmed on the blockchain. If a user authorizes a malicious transaction, there may be no simple way to cancel it afterward.

This means users must pay close attention to wallet prompts and transaction requests, even when they believe they are using a familiar website.

Larger Campaign May Have Stolen Nearly 4,000 ETH

The reported 1,010 ETH loss may not be an isolated incident.

According to information circulating among blockchain researchers and cryptocurrency community members, the attackers have allegedly stolen nearly 4,000 ETH through similar methods over the past 12 months.

If confirmed through further blockchain analysis, the figure would suggest that the operation has been targeting cryptocurrency users through a broader phishing campaign.

Rather than attempting to directly compromise Ethereum or another major blockchain, attackers can sometimes achieve significant financial gains by targeting users through social engineering.

This approach can be highly effective because victims may unknowingly authorize transactions themselves after being convinced that they are interacting with a legitimate platform.

Tornado Cash's Regulatory History

Tornado Cash has been one of the most controversial privacy-focused projects in the cryptocurrency industry.

The protocol was designed to increase transaction privacy by making it more difficult to connect cryptocurrency deposits with withdrawals. Its activities have faced significant regulatory scrutiny, particularly following sanctions imposed by the U.S. Treasury Department's Office of Foreign Assets Control.

The regulatory environment surrounding Tornado Cash contributed to uncertainty around its infrastructure and online presence.

The reported expiration of the former domain subsequently created an opportunity for malicious actors to take advantage of the established reputation of the website.

The reported attack should therefore be understood primarily as a phishing and website security incident rather than evidence of a direct vulnerability in the Ethereum blockchain.

How Crypto Users Can Avoid Similar Attacks

The incident offers several important security lessons for cryptocurrency users.

First, users should avoid relying exclusively on old bookmarks when accessing crypto services. Websites can change ownership, expire or become compromised.

Users should independently verify the current official website before connecting a wallet or signing a transaction. Search results, social media posts and advertisements should also be treated carefully because malicious links can appear legitimate.

Wallet notifications should be reviewed before every transaction. Users should pay attention to the amount, destination address, token approvals and permissions being requested.

For people holding significant amounts of cryptocurrency, keeping long-term assets in a separate wallet from one used for regular DeFi and Web3 activity can also reduce potential losses.

The reported theft of 1,010 ETH is a powerful reminder that cryptocurrency security is not limited to protecting private keys. Users must also protect themselves against deceptive websites, expired domains and social engineering.

As the crypto industry continues to expand, attackers are increasingly finding ways to exploit user trust rather than blockchain technology itself. The incident reinforces a simple rule for every crypto user: always verify the website before connecting a wallet or approving a transaction.