Crypto user loses 1,010 Ethereum to expired Tornado Cash domain

A crypto user has lost 1,010 ETH after an old bookmark to Tornado Cash led them to a phishing site. What makes the attack notable is that the victim did not visit a randomly misspelled domain. Instead, the attackers are said to have taken over the former official domain, tornado(.)cash, after its registration lapsed.

Old bookmark leads to phishing site

According to reports from the crypto community, the team behind Tornado Cash did not renew its original domain name after the project was hit by US OFAC sanctions.

Once the domain expired, another party registered the address and reportedly placed a fake Tornado Cash interface on it. That meant old bookmarks and links that once pointed to the real service could suddenly lead users straight to the attackers.

That now appears to have proved costly for one user. The victim used an old saved link and is said to have disclosed information that gave the attackers access to their crypto.

Within around 12 hours, 1,010 ETH disappeared from the wallet. With Ethereum trading at several thousand dollars, that represents a loss of several million dollars.

Hackers have reportedly already made off with nearly 4,000 ETH

According to the victim’s tracking, a large part of the stolen Ethereum is still sitting at addresses linked to the attackers.

The same group is also said to have been using this method for some time. Over the past 12 months, nearly 4,000 ETH is said to have been stolen through similar phishing attacks. That claim has not been independently confirmed on the basis of the information provided.

The attack highlights a tricky risk with old crypto links. A bookmark to a once legitimate website is not automatically safe. When a domain name expires and someone else registers it, exactly the same web address remains visible to the user.

That can have serious consequences, particularly with crypto services. In such a situation, checking the URL alone is not enough. Users should therefore also check whether a service still actually uses the domain in question as its official channel before connecting a wallet or approving transactions.