Ethereum user losses 1,010 USD in Tornado cash phishing attacks

Unknown to the user, he lost 1,010 Ethereum after following a Tornado cash bookmark which was reportedly redirected by malicious attackers.

The incident was reported to have lasted 12 hours. The attackers allegedly obtained the Tornado Cash account credentials of the victim and withdrawn the money before sending it to multiple addresses.

Records on Onchain provide partial confirmation. The referenced wallet Nine transactions totaled 810 ETH on August 18. The nine transactions received 810 ETH on Aug. 18.

Transactions took place between 6 a.m. to 7 a.m. Etherscan estimated that the remaining 810 ETH was worth approximately $1.86 million on Aug. 20, when this address was checked.

Ethereum records show 810 ETH but not the total claim

Verified transactions show a difference of approximately 200 ETH in between the reported 1,010ETH loss and the actual 810ETH that is held by wallet. Although the rest of the amount could have gone to another location, no evidence was provided.

When this article was written, neither Tornado Cash nor any other blockchain-based security company or victim reported had confirmed independently the total amount.

The victim was reported by community accounts to have tracked 1,010 Ethereum in total, however the address provided independently confirms that only 810 Ethereum were lost.

At the time that this wallet was reviewed, it had nine transactions but no outgoing transfers. This wallet balance confirms that the vast majority of funds reported remained in the hands of the suspected attacker.

The confirmed loss of 810 Ethereum would be worth approximately $1.86million at Ether’s current price. At Ether’s current price of approximately $2,295, the confirmed 810 Ethereum losses would have a value of roughly $1.86 million.

Tornado Cash domain takeover remains unconfirmed

The tornado.cash website was blamed for the theft, with reports stating that the team of the project failed to renew the domain during the U.S. sanction disruption. According to reports, the attacker then registered the address and set up a fake user-interface.

The account’s validity could not be verified in full. Checking the domain revealed a Tornado cash interface. There was no authoritative domain record or official Tornado cash warning, nor any named security researcher that confirmed the expired address and new owner.

The claim that an attacker has captured the domain of an official organization is therefore unconfirmed, and it should not be presented to the public as a cause.

The fact that a website loads correctly when checked does not mean it was secure at an earlier date. After collecting credentials, attackers can delete malicious code or redirect selected users.

Previous frontend security issues have plagued Tornado Cash. Gas404 discovered in 2024 that malicious JavaScript was inserted into a open-source interface, which could reveal private deposit note information. Checkmarx subsequently documented the supply chain compromiseThere is no direct evidence that this episode was connected to the most recent transactions.

The deposit notes that can be used to control funds

Tornado Cash lets users access assets in its pool by using private deposit note. The note is similar to a private credential, as anyone who has a valid one can initiate the withdrawal.

When a user tries to deposit or withdraw money, a fake frontend will capture the information. The attacker will then have the note stolen before its legitimate owner.

This attack is different from approval phishing where the victim authorizes an illegal drainer contract by signing a fraudulent transaction. As part of a similar story, Crypto.news described how wallet drainers exploit deceptive signatures Gain access to non-fungible assets and tokens.

Users often trust links they previously used, so old bookmarks can also pose a risk. Expired or transferred domains retain their familiar names, rankings in search engines and backlinks. This makes malicious replacements more difficult to identify.

Recently, crypto.news published a report. fake websites continue draining Ethereum wallets After users have approved transactions or entered sensitive information. Verifying domains using several existing project channels is the safest way to connect a wallet.

Evidence needed for a claim of nearly 4,000 ETH

In community reports, it was also claimed that these same attackers had stolen almost 4,000 ETH using similar methods in the past 12 months. This figure was not accompanied by a list of addresses, or an attribution study.

The 4,000 ETH estimation cannot be independently confirmed without linked wallets, hashed transactions or a report by a security company. Transfers on the blockchain show how funds were moved but do not reveal who was behind each transaction or phishing scam.

Priority is given to monitoring 810 ETH. Exchanges may be able to freeze or identify assets if they receive transfers from platforms.

It is essential that the victim preserves all browser histories, saved URLs in their wallet, logs of transactions and other records, before reporting any incident to law enforcement, exchanges or wallet providers. Users that interacted with the frontend in question should cease using it and move assets unaffected. They can also revoke token approvals.

Evidence suggests a significant Ethereum transfer to a newly activated wallet. The evidence does not prove that the entire 1,010 ETH was lost, or the alleged taking over of the domain official.