Ethereum User Loses 1,010 ETH in Phishing Attack Linked to Tornado Cash

Ethereum User Loses 1,010 ETH in Phishing Attack Linked to Tornado Cash

In a recent incident, an Ethereum user reportedly lost 1,010 ETH due to a phishing attack associated with Tornado Cash. This event has raised significant concerns in the cryptocurrency community regarding domain security and phishing tactics.

Details of the Incident

The attack became evident after a user followed an outdated bookmark for Tornado Cash, which directed them to a fraudulent frontend controlled by phishing attackers. Onchain records indicate that 810 ETH was received by the attacker through nine transactions on August 18. Community reports claim that a total of 1,010 ETH was stolen after the user mistakenly accessed the phishing site.

Onchain Activity

Tracking of the transactions shows that 810 ETH was transferred via nine transactions, occurring rapidly between 5:56 a.m. and 6:05 a.m. UTC on the date mentioned. Eight of those transactions involved transfers of 100 ETH each, while the last transaction involved 10 ETH. However, there was no outgoing transfer from the cited wallet, suggesting it retains most of the reported funds.

Phishing Exploitation

The phishing attack allegedly stemmed from the tornado.cash domain, which some reports claim had expired due to a failure by the original owners to renew it amidst disruptions linked to U.S. sanctions. An attacker is believed to have registered the expired domain and created a fake user interface. Nevertheless, when checked, the official Tornado Cash website remained accessible, and no official confirmation regarding the domain’s alleged takeover was provided.

Evidence and Verification Issues

Verification of the claims surrounding the phishing incident remains complex. The 810 ETH loss is supported by transactional evidence; however, it leaves a discrepancy of 200 ETH unaccounted for, leading to uncertainty about the total amount stolen. Community reports have also accused the same attackers of stealing nearly 4,000 ETH using similar tactics over the past year, although this figure lacks independent verification or supporting evidence.

Safety Measures for Users

The incident highlights the potential risks associated with using expired bookmarks. It’s essential for users to verify URLs through current project channels before interacting with them. The safest practice is to refrain from connecting wallets to unfamiliar sites and to revoke any suspicious token approvals. Users who have encountered similar phishing attempts are urged to review their crypto holdings and take necessary precautions swiftly.

As the investigation into this incident continues, the immediate priority remains on monitoring the 810 ETH that is currently in a newly active wallet, particularly as transfers to exchanges may prompt intervention from the platforms involved.