Expired Domain Phishing Attack Drains 1,010 ETH from Tornado Cash User

A phishing attack on Tornado Cash has drained 1,010 ETH from one user after they accessed an expired domain through an old bookmark. The attackers allegedly controlled the expired tornado.cash domain and used it to imitate the protocol's interface.

The victim deposited funds into legitimate smart contracts but exposed private withdrawal information through the malicious frontend. Reports also linked the stolen funds to suspicious Bitcoin activity, raising questions about the source of the funds.

According to on-chain data, 73 BTC was moved through Whirlpool before part of the funds were transferred to Ethereum and Tornado Cash. The incident highlights how expired domains can create risks even when underlying smart contracts remain legitimate.