Ethereum User Loses Over $2.3 Million in Suspected Tornado Cash Phishing Attack

An Ethereum user reportedly lost 1,010 ETH, worth approximately $2.32 million at current prices, after interacting with what community reports describe as a phishing frontend disguised as the Tornado Cash privacy tool. The incident, first flagged by crypto journalist Wu Blockchain on X, remains partially unverified, with on-chain records confirming only 810 ETH of the claimed loss.

The alleged theft unfolded over approximately 12 hours on August 18, according to community accounts. Attackers reportedly obtained the victim's Tornado Cash deposit credentials through a malicious interface and withdrew funds before dispersing them across multiple addresses. The cited wallet received 810 ETH through nine transactions between 5:56 a.m. and 6:05 a.m. UTC, with eight transfers carrying 100 ETH each and a final transfer of 10 ETH. Etherscan valued the retained balance at roughly $1.86 million when checked on August 20.

The 200 ETH gap between the community-reported 1,010 ETH loss and the confirmed 810 ETH on-chain remains unexplained. The remaining funds may have been routed to another address, though no additional destination appeared in the supplied evidence. No public statement from Tornado Cash, an established blockchain security firm, or the reported victim had independently confirmed the full amount when this article was prepared.

Community reports blamed the theft on the tornado.cash domain, claiming it expired after the project's team failed to renew it during disruption caused by U.S. sanctions. According to these accounts, an attacker subsequently registered the address and installed a fake user interface designed to capture deposit credentials.

That account could not be fully verified. The domain was accessible and displayed a Tornado Cash interface when checked. No authoritative domain record, official Tornado Cash warning, or named security researcher was found confirming that the address had expired and changed ownership. A website loading correctly at the time of checking does not prove it was safe at an earlier time, however. Attackers can remove malicious code, redirect only selected visitors, or restore a legitimate interface after collecting credentials.

The attack vector differs from approval phishing, where a victim signs a malicious transaction authorizing a drainer contract. Tornado Cash uses private deposit notes to let users withdraw assets from its pools. Anyone who obtains a valid note can generally initiate the corresponding withdrawal, making the note comparable to a private credential. A fake frontend can capture this information when a user attempts to make a deposit or withdrawal, allowing the attacker to use the stolen note before the legitimate owner does.

Tornado Cash has faced frontend security problems. In 2024, researcher Gas404 found that malicious JavaScript had been inserted into an open source interface and could expose private deposit notes. Checkmarx later documented the supply chain compromise, although no evidence currently connects that episode with the latest transactions.

Abandoned or lapsed application domains are a known danger in the crypto ecosystem. Security firm Coinspect has documented how "zombie" dApps with expired infrastructure can be re-registered or spoofed, turning a once-trusted address into a trap that harvests approvals from returning users. Old bookmarks present a particular risk because users often assume previously trusted links remain safe. Expired or transferred domains preserve their familiar names, rankings, and backlinks, making malicious replacements harder to identify.

Community reports also alleged that the same attackers stole nearly 4,000 ETH through similar methods over the 12 months. No list of related addresses or attribution analysis accompanied that figure. Without linked wallets, transaction hashes, or a report from a security firm, the 4,000 ETH estimate cannot be independently verified. Blockchain transfers show where funds moved, but they do not automatically establish who controlled each address or which phishing campaign generated them.

Note: The confirmed balance reflects the cited wallet's holdings when reviewed on Aug. 20. The discrepancy between reported and confirmed figures remains unexplained.

A four-figure ETH loss underscores why front-end verification remains a persistent weak point, even for users comfortable with self-custody. Recognizable brand names offer no guarantee that the page loading in a browser is the legitimate one. Practical defenses center on scrutiny before signing: verifying the exact URL, reading each transaction's contents rather than blindly approving, and periodically reviewing and revoking token permissions granted to old applications.

The immediate priority is monitoring the confirmed 810 ETH. Transfers to exchanges could create an opportunity for platforms to identify or freeze assets, subject to their procedures and applicable law. The victim should preserve browser history, bookmarked URLs, wallet logs, and transaction records before reporting the incident to wallet providers, exchanges, and law enforcement. Users who interacted with the same frontend should stop using it, move unaffected assets, and revoke suspicious token approvals.

Until the report is corroborated, the safest reading is a cautionary one: treat any privacy-tool interface, especially one that may have lapsed, as unverified until its domain and contract interactions are checked directly through multiple current project channels.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.