Tornado Cash Frontend Phishing: 810 ETH Drained After the Domain Lapsed

TL;DR

On August 18, 2026, a wallet that had never sent a transaction before withdrew 810 ETH from Tornado Cash using deposit notes it did not create. Nine withdrawals, eight minutes and forty-eight seconds, every one carrying a valid zero-knowledge proof. Community reporting relayed by Wu Blockchain put the loss at 1,010 ETH, about $2.3 million, and that figure has been repeated everywhere since. The address everyone cited holds 810.0972 ETH and has not moved a wei of it. The notes were reportedly harvested by a cloned interface served from tornado.cash, the protocol's original domain, which lapsed while the project sat under US sanctions. No contract failed here. A domain expiry date is a security parameter, and this one was public for years.

What Actually Left the Pools?

810 ETH. Not 1,010.

The collection address is 0xd8B356356d7B143D7ece9F5876FE4b954E93b745, the same one the coverage cites. Its entire history is ten transactions. Nine of them are withdraw calls into the Tornado Cash Router at 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b, sent between 05:56:47 and 06:05:35 UTC on August 18. Eight of those nine name the 100 ETH pool as the target instance. The ninth names the 10 ETH pool. Eight hundred plus ten.

Decoding the calldata of the first withdrawal settles the rest. The recipient argument is the sending address itself. The relayer argument is the zero address, the fee and refund are zero, and the transaction nonce is 0. The attacker skipped Tornado's relayer network and paid their own gas, so every withdrawal was signed by the wallet that kept the money.

The ledger closes to the wei. The address received 0.09787695 ETH of gas money, then 810 ETH across nine internal transfers, then one inbound dust payment of 0.000001 ETH on August 20. Subtract the nine transaction fees and you land on the 810.097234799128926275 ETH balance the explorer showed on August 24, 2026, a little under $2 million at that day's ETH price. Nothing is missing from that account, and nothing has been laundered out of it in the six days since.

So where does 1,010 come from? The gap is 200 ETH, which is exactly two more notes from the 100 ETH pool. Either the victim's count includes two notes that were drained to a second address nobody has published, or the community figure is high by two notes. crypto.news flagged the same 810 ETH discrepancy on the day. We treat 810 ETH as the confirmed floor because it is the only figure with a public proof attached, and we would revise up the moment a second collection address surfaces.

Why Was tornado.cash Available to Register?

Because the United States government told everyone not to touch it.

The August 8, 2022 OFAC designation did not only add contract addresses to the SDN list. It added the string Website tornado.cash as an identifier of the sanctioned entity, right alongside the router and pool addresses the attacker used this month. For a US-exposed registrar, registrant, or DNS provider, renewing that name became a compliance problem rather than a maintenance task. The domain went unrenewed. Every outlet covering this incident says the team failed to renew under sanctions, and the registry record is consistent with that.

OFAC reversed the designation on March 21, 2025, removing Tornado Cash and more than a hundred addresses from the list, and Treasury published the delisting notice the same day. The reversal followed the Fifth Circuit's November 2024 opinion in Van Loon v. Department of the Treasury, which held that immutable smart contracts are not property that OFAC can block under IEEPA.

The current registry record for the domain is worth reading closely. An RDAP query run on August 24, 2026 returns a registration date of March 25, 2025, four days after the delisting. It shows a registrar transfer on January 9, 2026, a last-changed timestamp of August 12, 2026, an expiry of March 25, 2027, and five Hurricane Electric nameservers. That August 12 timestamp is six days before the theft, and it is thirteen hours before the attacker funded their gas wallet.

Read that carefully, because it is a correlation and not a proof. RDAP's last-changed field moves for any registrar-side edit, a nameserver swap or a contact update included, and the public record does not establish who controlled the name in each window. What it does establish is that the domain was picked up within a week of becoming legally safe to hold, and that somebody was editing its configuration in the run-up to the withdrawals.

One more observation, timestamped because it will not stay true. As of August 24, 2026, tornado.cash does not resolve at all. Queries through public resolvers come back with no reachable authority, the delegated Hurricane Electric nameservers refusing to answer for the zone. The site that took the notes appears to be off the air.

What Is a Deposit Note, and Why Does the Frontend Get to See It?

A Tornado Cash note is a bearer credential your browser invents.

When you deposit, JavaScript running on the page generates two random values, a secret and a nullifier, hashes them into a commitment, and sends only the commitment on-chain with your ETH. The note string is the secret and nullifier written down. Later you prove in zero knowledge that you know the preimage of some commitment in the pool's Merkle tree, publish the nullifier hash so the note cannot be spent twice, and name any recipient you like. The contract never learns who you are, which is the entire point.

The contract also never learns whether the person holding the note is you. Anyone with the string can generate the proof. It is a private key with no recovery path and no owner field, created inside code the pool cannot inspect.

That is the whole vulnerability. The deposit is real, the pool is real, the proof is real. The only compromised component is the page that made the note, and by the time it matters that page has already sent the string somewhere else. This is CWE-494, download of code without an integrity check, wearing a DeFi costume. Re-registering a lapsed domain to serve that code has its own catalogue entry too, ATT&CK T1583.001, which lists expired-domain acquisition as standard adversary tradecraft.

The Attack, Step by Step

The path is not a straight line, because the money and the credential travel separately. The victim's ETH goes to the real contract while the note goes to the attacker's server, and the two only meet again days later.

The Preparation Is the Interesting Part

Look at step 6 again. On August 12 at 17:08:59 UTC, the collection wallet received 0.09787695 ETH as an internal transfer out of the Tornado Cash 0.1 ETH pool. The shortfall from a round 0.1 is a relayer fee, so that first withdrawal was submitted by somebody else's relayer on the attacker's behalf.

Which means the wallet that took 810 ETH has no funding trail. It was born with mixed gas money, paid for by a note the attacker already held, delivered by a third party who never learned the destination. Six days later it went from nonce 0 to holding two million dollars without ever receiving an ordinary transfer. The mixer paid for its own robbery (which is neat, and also the reason a funding-source heuristic finds nothing here).

Then the discipline stops. All nine withdrawals were self-submitted rather than relayed, tying them to a single payer of gas, and they landed inside nine minutes. The funds have sat in one publicly labelled address ever since, while The Cryptonomist's account put the same domain at the centre of roughly 4,000 ETH in thefts over twelve months. That figure has no address list attached to it, so treat it as an unsupported claim rather than a total.

Was the Victim a Victim?

This is where the story gets uncomfortable, and skipping it would be dishonest.

On-chain researcher Specter examined the losing wallet's earlier history and questioned the account. Per Blockonomi's write-up and other coverage of the same thread, the wallet moved 73 BTC, around $4.6 million, out of a Whirlpool mixer roughly two weeks before the theft, and part of that value crossed into Ethereum before reaching the cloned Tornado interface. Specter also reported seeing the same actor in Telegram groups oriented around private-key discovery and brute-force work, and argued that somebody chaining two mixers is an odd fit for the naive-bookmark narrative.

None of that is established. It is one researcher's read of clustering and chat-room presence, the victim has not been publicly identified, and no security firm has published a forensic account. We repeat it because the provenance of the funds explains why no postmortem exists for a two-million-dollar loss. The mechanism stands regardless of who held the notes. A cloned frontend on a lapsed domain takes notes from anyone who types them.

Why This Keeps Happening at the Distribution Layer

Tornado Cash has now lost user funds twice through code nobody audited, because nobody thought of it as code.

In January 2024, a contributor operating as "Butterfly Effects" landed malicious JavaScript in the project's interface through governance proposal 47. The payload encoded deposit notes to look like ordinary transaction calldata and obfuscated its use of window.fetch to ship them to a private server, and it ran for roughly two months across IPFS deployments served through ipfs.io, cf-ipfs.com and eth.link before researcher Gas404 caught it. Checkmarx documented the exfiltration, and CoinDesk covered the disclosure. Different attacker, different delivery channel, identical target: the note, captured in the browser, before the chain ever sees anything.

The generalisation is not specific to mixers. Any protocol whose frontend touches a secret the contract cannot re-derive has the same shape. Seed phrases in a wallet import flow. Signing payloads in a bridge UI. The contract is audited, immutable and irrelevant to the failure, because the credential never reaches it in a form the contract can defend.

And the industry's default answer does not apply here. An audit certifies the code you showed it on the day you showed it. It has nothing to say about a domain your registrar stopped billing you for in 2022, or about a nameserver record edited on a Wednesday in 2026. We have written before about key compromise as its own discipline and about poisoned package distribution; this is the same lesson arriving through DNS. Runtime monitoring is the layer that watches a distribution surface, and it only helps the organisation that owns the surface. For the individual who typed a note into the attacker's page, nothing was catchable. The alert had to fire years earlier, on a renewal invoice.

What Operators Should Do

1. Put every domain you have ever published in an asset register, and monitor its registry state the way you monitor uptime. Expiry date, registrar, nameserver set, and RDAP status. A change to any of those on a domain your users bookmarked is a security event with the same weight as a new admin key.
2. Never let a domain you controlled reach the drop pool. If you are sunsetting a product, keep renewing the name or transfer it to a party who will. Renewal costs about ten dollars a year. Reacquiring the name after somebody else has served malware from it costs your users everything they deposit.
3. Ship a frontend integrity check users can actually perform. Publish the build hash or IPFS CID for each release, sign it with a verifiable key, and make the ENS or IPFS path the canonical entry point rather than a DNS name. CWE-494 is only exploitable when the client cannot tell good code from bad.
4. Treat any browser-generated bearer secret as a key ceremony. Notes, seed phrases and signing payloads generated in a page inherit the trust of whoever served that page. Generate them offline where the value justifies it, and design flows so a compromised frontend cannot see the secret in the clear.
5. Monitor your own name in the phishing feeds, not only your contracts. Certificate transparency logs, registry alerts and lookalike-domain feeds catch a hostile clone while it is still collecting its first victim. Point your runtime monitoring at the infrastructure layer as well as the contracts, because the contract layer will look healthy throughout.
6. Kill the bookmark, publicly and repeatedly. If a legacy URL is no longer yours, say so on every channel you still control, and keep saying it. The victim here opened a link that used to work.

Frequently Asked Questions

How much was actually stolen in the Tornado Cash phishing attack? 810 ETH is confirmed on-chain, a little under $2 million at the ETH price on August 24, 2026. Community reporting says 1,010 ETH, about $2.3 million. The 200 ETH gap is exactly two more notes from the 100 ETH pool, and no second collection address has been published to account for them.

Was Tornado Cash hacked? No. The pool contracts behaved correctly and every withdrawal carried a valid zero-knowledge proof. The compromise was in the web interface served from the lapsed tornado.cash domain, which reportedly captured deposit notes in the browser before the funds ever moved.

Why did the official domain expire? OFAC named tornado.cash as sanctioned property in the August 2022 designation, which made renewing it a compliance problem rather than routine maintenance. It went unrenewed, and the registry record shows the name registered again on March 25, 2025, four days after OFAC lifted the sanctions.

Is tornado.cash safe to visit now? Treat it as hostile. As of August 24, 2026 the domain does not resolve and its delegated nameservers refuse queries for the zone, so the site that reportedly took the notes is off the air. That can be reversed by whoever holds the registration, so the safe assumption is that any tornado.cash page is untrusted until a verifiable build hash says otherwise.

Would an audit have prevented this? No. Nothing in the contracts was wrong. A domain-lifecycle control, a signed frontend build, and monitoring on the registry record would each have broken this chain, and all three sit outside the scope of a smart contract review.

Sources / References

• The Crypto Times, "User Loses 1,010 ETH in Phishing Attack via Hijacked Tornado Cash Domain", August 20, 2026
• crypto.news, "Ethereum user loses 1,010 ETH in Tornado Cash phishing attack", August 20, 2026
• Blockonomi, "Tornado Cash Phishing Attack Drains 1,010 ETH Through Expired Domain", August 21, 2026
• The Cryptonomist, "Tornado Cash phishing attack exploits expired domain for ETH theft", August 20, 2026
• Etherscan: collection address, router, 100 ETH pool, first withdrawal, August 12 funding transaction
• OFAC recent actions, August 8, 2022 designation and March 21, 2025 removal
• US Department of the Treasury, "Tornado Cash Delisting", March 21, 2025
• DeFi Education Fund on the Van Loon Fifth Circuit opinion and the delisting
• RDAP registry record for tornado.cash, queried August 24, 2026
• Checkmarx, "Tornado Cash Theft Uncovered", 2024
• BleepingComputer, "Malicious code in Tornado Cash governance proposal puts user funds at risk", February 2024
• CoinDesk, "Tornado Cash Reportedly Suffers Backend Exploit, User Deposits at Risk", February 26, 2024
• MITRE, CWE-494 and ATT&CK T1583.001

On-chain figures were read from Ethereum mainnet and Etherscan on August 24, 2026. The domain's registrant, the 1,010 ETH total, the 4,000 ETH twelve-month figure, and the claims about the victim's other activity are reported, not confirmed.