Tornado Cash Phishing Attack Exposes Users Despite Legitimate Smart Contracts

A phishing attack on Tornado Cash has resulted in the loss of over $2.4 million in Ethereum, with attackers exploiting an expired domain to trick users into revealing their private withdrawal notes.

The victim accessed a malicious website through an old bookmarked link to the tornado.cash domain, which had been allowed to expire after US sanctions targeted the protocol in 2022.

Once on the fake Tornado Cash interface, the attacker was able to capture the user's private notes required for withdrawing funds, allowing them to drain over 1,010 ETH within 12 hours of the deposit.

This is not an isolated incident, with reports suggesting that nearly 4,000 ETH may have been stolen through similar expired-domain phishing operations in the past year.