Tornado Cash expired domain exploited in $2.4 million phishing theft

A cryptocurrency user has lost 1,010 ETH, valued at approximately $2.4 million, following a phishing attack that exploited the expired official domain of the sanctioned mixing protocol Tornado Cash.

The theft occurred after the victim used an old bookmarked link that redirected to a fraudulent website hosted on the abandoned tornado.cash domain. Attackers registered the domain after the Tornado Cash team failed to renew it due to regulatory pressures and OFAC sanctions. Once the victim interacted with the fake frontend and submitted deposit credentials, hackers drained the funds within 12 hours.

Reports indicate this is part of a larger trend, with similar phishing schemes tied to the expired domain reportedly resulting in the theft of over 4,000 ETH in the past 12 months.