Tornado Cash Phishing Attack via Expired Domain Drains 1,010 ETH

A user lost 1,010 ETH (≈$2.3M) after clicking an old tornado.cash bookmark: the domain had expired amid OFAC sanctions, was re-registered by attackers who launched a fake frontend and drained the wallet within 12 hours. Researchers say the same group has stolen ~4,000 ETH over the past year using domain-expiry phishing, leaving funds largely unrecovered and highlighting crypto security risks to DeFi/mixer users and the need for domain monitoring, hardware wallets and multi-signature protections.

See what traders are focused on

BitcoinWorld Tornado Cash Phishing Attack via Expired Domain Drains 1,010 ETH

A cryptocurrency user lost 1,010 ETH (worth approximately $2.3 million at current prices) in a phishing attack that exploited the expired official domain of Tornado Cash, a privacy-focused crypto mixer. The attack, reported by Wu Blockchain, highlights the ongoing security risks associated with domain mismanagement and the persistent threat of phishing in the crypto space.

The victim reportedly clicked on an old bookmarked link to tornado.cash, which had expired after the Tornado Cash team was unable to renew it due to sanctions imposed by the U.S. Treasury’s Office of Foreign Assets Control (OFAC). The domain was then registered by an attacker, who set up a fake front-end interface that mimicked the original service. When the user interacted with this fraudulent site, they unknowingly authorized transactions that drained 1,010 ETH from their wallet within 12 hours.

According to the report, the stolen funds remain largely in the attacker’s address. The same group is estimated to have stolen around 4,000 ETH over the past year using similar domain-expiry tactics, indicating a broader pattern of targeting defunct or lapsed crypto-related domains.

This incident underscores a critical vulnerability in the crypto ecosystem: the reliance on domain names that can lapse or be seized. For Tornado Cash, the OFAC sanctions have not only restricted its operations but also created an opening for malicious actors to exploit its infrastructure. The attack also serves as a stark reminder for users to verify the authenticity of the websites they interact with, especially when using services that have faced regulatory action.

Security experts point out that domain expiry is a common attack vector, not just for crypto services but for any online platform. In this case, the attacker capitalized on the Tornado Cash team’s inability to maintain the domain, turning a legal enforcement action into a phishing opportunity. The incident also raises questions the responsibility of domain registrars and the need for better safeguards to prevent such takeovers.

For everyday users, this event highlights the importance of using bookmarks carefully and double-checking URLs before entering sensitive information or authorizing transactions. It also illustrates the cascading effects of regulatory actions, which can inadvertently create security gaps. As the crypto industry matures, both users and service providers must adopt more robust security practices, including the use of hardware wallets, multi-signature transactions, and domain monitoring services.

The Tornado Cash phishing attack via its expired domain is a cautionary tale the intersection of regulatory pressure, domain security, and user vigilance. While the stolen funds have not been recovered, the incident adds to a growing list of exploits targeting crypto users through compromised or lapsed infrastructure. It serves as a reminder that in the decentralized world, security ultimately depends on both technical measures and user awareness.

Q1: How did the attacker take over the Tornado Cash domain? The domain tornado.cash expired because the Tornado Cash team could not renew it due to OFAC sanctions. The attacker registered the expired domain and set up a fake interface to trick users.

Q2: What can users do to protect themselves from such phishing attacks? Users should always verify the exact URL of a website, use browser extensions that block known phishing sites, enable two-factor authentication, and consider using hardware wallets for large holdings. Additionally, avoid clicking on bookmarked links that may be outdated; instead, manually type the known correct URL.

Q3: Are there any broader implications for the crypto industry? Yes, this incident highlights the need for better domain security practices and the unintended consequences of regulatory actions. It also emphasizes the importance of user education and the adoption of more secure transaction methods to mitigate phishing risks.

This post Tornado Cash Phishing Attack via Expired Domain Drains 1,010 ETH first appeared on BitcoinWorld .