Tornado Cash security and exploitation incidents

The Tornado Cash mixing protocol has been central to several recent cryptocurrency security incidents involving the movement and theft of Ethereum.

Following an exploit of the Aztec Network private roll-up bridge in June 2026, a hacker has moved a cumulative 500 ETH into Tornado Cash. These transfers, totaling approximately $572,100 in the most recent batch, have been conducted in small, irregular increments to avoid the rapid laundering patterns typically seen in crypto thefts.

Separately, the protocol’s expired domain has been leveraged in phishing attacks. After the Tornado Cash team failed to renew the domain due to regulatory pressures and OFAC sanctions, attackers registered the abandoned domain to redirect users to fraudulent websites. One such incident resulted in the theft of 1,010 ETH, valued at roughly $2.4 million. Reports suggest this domain-based phishing scheme has been responsible for the theft of over 4,000 ETH within a 12-month period.