Ethereum users lose 1010 ETH in Tornado Cash phishing attack

Ethereum users lost 1010 ETH due to using old bookmarks to access phishing websites.

According to online records, an Ethereum user received 810 ETH through nine transfers on August 18. Community reports said that the user had stolen 1010 ETH pieces due to accessing a suspected phishing front end. The relevant wallet held approximately 810 ETH pieces, valued at approximately US$1.86 million at the time.

There is news that attackers have stolen nearly 4000 ETH in the past 12 months, but this claim has not been independently verified. The Tornado Cash website is still accessible, and claims that the domain name was hijacked have not been officially confirmed.

Incident history and on-chain data

Community news stated that the incident lasted about 12 hours. The attacker obtained the victim's Tornado Cash deposit certificate, withdrew the funds and moved them to multiple addresses. On-chain records partially confirm this statement: the relevant wallet received 810 ETH pieces on August 18, including 100 pieces each for eight pieces, and the last piece was 10 pieces. Trading hours are from 5:56 to 6:05 UTC time. As of August 20, the address still held approximately 810 ETH pieces worth approximately US$1.86 million.

Data Differences and Unconfirmed Parts

There is a difference of 200 ETH between the confirmed transaction and the community's claim of 1010 ETH losses. The remaining funds may have flowed to other addresses, but the evidence provided did not include additional destinations. As of the time of writing, Tornado Cash, well-known blockchain security companies or the victims themselves have not independently confirmed the full amount of the loss. The community claimed that the victims lost a total of 1010 ETH, but only 810 ETH were independently confirmed at the relevant address. The wallet recorded nine transactions, no transfers were recorded at the time of review, and the balance showed that most of the funds were still under the control of the suspected attacker. Based on Ethereum's price of approximately US$2295, the 810 confirmed ETH are worth approximately US$1.86 million, while the claimed loss of 1010 ETH is worth approximately US$2.32 million.

The domain name hijacking claim has not been confirmed

The report blamed the theft on the tornado.cash domain name, claiming that the domain name expired because the project team failed to renew it under the influence of U.S. sanctions. The attacker allegedly then registered the address and installed a fake interface. However, this statement cannot be fully verified: the domain name can be accessed and displays the Tornado Cash interface, but no authoritative domain name records, official warnings, or well-known security researchers confirming that the domain name has expired and changed ownership have been found. Therefore, the claim that official domain names are controlled by attackers has not yet been confirmed and should not be presented as an established reason. The proper loading of a website does not prove that it was previously safe, and an attacker may have removed malicious code, redirected only specific visitors, or restored a legitimate interface after collecting credentials.

Risk and Security Recommendations for Deposit Certificates

Tornado Cash uses private deposit certificates to allow users to withdraw assets from the pool. Anyone who obtains a valid certificate can initiate the corresponding withdrawal, so the certificate is equivalent to a private key. A fake front-end can capture this information when a user attempts to deposit or withdraw money, and an attacker can then use the stolen credentials first. This attack is different from authorized phishing, in which victims sign contracts authorized to steal money for malicious transactions. Old bookmarks are also risky, and users often believe that previously trusted links are still safe. Expired or transferred domain names retain familiar names, search rankings, and backlinks, making malicious substitutions more difficult to identify. The safest way to do this is to verify the domain name through multiple current project channels before connecting to your wallet.

More evidence is needed for claims of nearly 4000 ETH

Community reports also claimed that the same attacker stole nearly 4000 ETH pieces through similar methods in the past 12 months, but did not attach a list of relevant addresses or attribution analysis. Without associated wallets, transaction hashes, or security company reports, the estimate of 4000 ETH cannot be independently verified. Blockchain transfers show where the funds go, but cannot automatically determine the controller of each address or the phishing activity it belongs to. The current priority is to monitor the 810 confirmed ETH. Transfers to exchanges may provide opportunities for platforms to identify or freeze assets, depending on their procedures and applicable laws. Victims should keep browser history, bookmark URLs, wallet logs and transaction records, and then report them to wallet providers, exchanges and law enforcement. Users who have used the same front-end should immediately stop using it, transfer unaffected assets, and revoke suspicious token authorizations. Existing evidence supports the transfer of large amounts of Ethereum into new active wallets, but has not yet proved the complete loss of 1010 ETH, the claim that the official domain name was hijacked, or the alleged 4000 ETH activity.