Old Bookmark Becomes a Trap: 1,010 ETH Lost via Tornado Cash’s Expired Domain

The takeover of the expired tornado.cash domain by attackers led to a user losing 1,010 ETH within 12 hours after using a link from an old bookmark.

According to reports from Wu Blockchain citing community members, the user was redirected to the expired tornado.cash domain after clicking a previously saved link. Through the domain seized by attackers, the user encountered a fake interface designed to look like Tornado Cash and lost their assets through this site.

Tornado Cash’s official domain went out of service because the team did not renew it during the OFAC sanctions process. It was reported that after the domain expired, it was re-registered by attackers who set up a fake interface, leading users to believe they were accessing the legitimate site.

Old bookmarks put crypto investors at risk

The incident in question did not stem from a vulnerability in the protocol’s code. According to information from the source, this was a phishing attack, not a smart contract exploit. Relying on the link in their old bookmark, the user was redirected to a fake site prepared by attackers and used their transaction details there.

Wu Blockchain stated that the majority of the stolen funds are still being held in the attackers’ addresses. According to monitoring by community users, it is alleged that approximately 4,000 ETH has been harvested using similar methods over the last 12 months. It was emphasized that users must verify the domain before using old official links and bookmarks.