Ethereum user loses 1,010 ETH in Tornado Cash phishing attack

cryptonews08-20 20:18

An Ethereum user reportedly lost 1,010 ETH after following an old Tornado Cash bookmark that allegedly redirected to a malicious frontend controlled by phishing attackers. Summary An Ethereum ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2660284591?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-20 20:18","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2660284591","market":"sh","top_or_hot":-1,"title":"Ethereum user loses 1,010 ETH in Tornado Cash phishing attack","media":"cryptonews","content":"<div>\n<p>An Ethereum user reportedly lost 1,010 ETH after following an old Tornado Cash bookmark that allegedly redirected to a malicious frontend controlled by phishing attackers.\n\n\nSummary\n\n\n\nAn Ethereum ...</p>\n\n<a href=\"https://crypto.news/ethereum-user-loses-1010-eth-to-phishing/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Ethereum user loses 1,010 ETH in Tornado Cash phishing attack</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nEthereum user loses 1,010 ETH in Tornado Cash phishing attack\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-20 20:18 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/ethereum-user-loses-1010-eth-to-phishing/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>An Ethereum user reportedly lost 1,010 ETH after following an old Tornado Cash bookmark that allegedly redirected to a malicious frontend controlled by phishing attackers.\n\n\nSummary\n\n\n\nAn Ethereum ...</p>\n\n<a href=\"https://crypto.news/ethereum-user-loses-1010-eth-to-phishing/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"EETH","symbol_name":"以太币期货ETF-ProShares","start_time":0,"source_url":"https://crypto.news/ethereum-user-loses-1010-eth-to-phishing/","article_id":"2660284591","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/ethereum-user-loses-1010-eth-to-phishing/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2660284591","pubTimestamp":1787228295,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"An Ethereum user reportedly lost 1,010 ETH after following an old Tornado Cash bookmark that allegedly redirected to a malicious frontend controlled by phishing attackers.An Ethereum address received 810 ETH through nine transfers on August 18, onchain records confirm.Community reports claimed 1,010 ETH was stolen after a user visited a suspected phishing frontend.The cited wallet retained approximately 810 ETH, worth about $1.86 million when records were checked.Claims that attackers stole nearly 4,000 ETH over twelve months remain independently unverified by researchers.Community accounts said the incident unfolded over approximately 12 hours. They alleged that attackers obtained the victim’s Tornado Cash deposit credentials and withdrew the funds before transferring them to several addresses.Ethereum records confirm 810 ETH, not the full claim. Reports blamed the theft on the tornado.cash domain, claiming it expired after the project’s team failed to renew it during the disruption c","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"EETH":"以太币期货ETF-ProShares","ETHA":"以太坊ETF-iShares","QETH":"以太坊ETF-Invesco Galaxy","GDLC":"Grayscale CoinDesk Crypto 5 ETF","FBTC":"比特币ETF-Fidelity","CETH":"以太坊ETF-21Shares","YETH":"Roundhill Ether Covered Call Strategy ETF","BETE":"等权重比特币&以太币期货ETF-ProShares","09179":"嘉实以太币-U","ETHD":"ProShares UltraShort Ether ETF","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","EZET":"以太坊ETF-Franklin","BETH":"比特币&以太币期货ETF-ProShares","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","ETHE":"最大以太坊ETF-Grayscale","BITO":"比特币期货ETF-ProShares","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","FETH":"以太币ETF-Fidelity","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","BTF":"比特币&以太币期货ETF-CoinShares","ETHI":"Defiance Leveraged Long Income Ethereum ETF","BITQ":"Bitwise Crypto Industry Innovators ETF","09046":"华夏以太币-U","03046":"华夏以太币","SETH":"1倍做空以太币期货ETF-Proshares","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","ETCO":"Grayscale Ethereum Covered Call ETF","03009":"博时以太币","ETHT":"ProShares Ultra Ether ETF","STCE":"Schwab Crypto Thematic ETF","BKCH":"AdvisorShares Sabretooth ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","BITW":"Bitwise 10 Crypto Index ETF","AETH":"以太坊策略ETF-Bitwise","ETHU":"2倍以太币期货ETF-Volatility Shares","ARKY":"ARK Active Autocallable Income ETF","ETH":"低成本以太坊ETF-Grayscale","ETHV":"以太坊ETF-VanEck","IBIT":"比特币ETF-iShares","09009":"博时以太币-U","ETHW":"以太坊ETF-Bitwise","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","03179":"嘉实以太币"},"translate_title":"以太币用户在龙卷风现金网络钓鱼攻击中损失 1,010 ETH","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"ETHV":1.5,"YETH":1.5,"ETHA":1.5,"FETH":1.5,"09009":1.5,"XBTY":0.6,"GDLC":1.5,"BITW":1.5,"CBXA":0.6,"LFGY":1.5,"03179":0.87,"METHmain":1.5,"STCE":1.5,"AETH":1.5,"EETH":1.5,"ETHI":0.6,"BETE":1.5,"ETHD":1.5,"ETQ":0.6,"ARKY":1.5,"BETH":1.5,"BKCH":1.5,"ETHW":1.5,"IBIT":0.6,"CBOA":0.6,"BEGS":1.5,"CRPT":1.5,"ETCO":0.6,"03046":0.87,"CETH":1.5,"ETH":1.5,"03009":0.87,"ETHE":1.5,"ETU":1.5,"QETH":1.5,"FBTC":0.6,"BITQ":1.5,"09046":1.5,"ETHU":1.5,"BITO":0.6,"ETHT":1.5,"09179":1.5,"ETTY":1.5,"EZET":1.5,"BITY":0.6,"NCIQ":1.5,"SETH":0.6,"BTF":1.5},"content_text":"An Ethereum user reportedly lost 1,010 ETH after following an old Tornado Cash bookmark that allegedly redirected to a malicious frontend controlled by phishing attackers.\n\n\nSummary\n\n\n\nAn Ethereum address received 810 ETH through nine transfers on August 18, onchain records confirm.\nCommunity reports claimed 1,010 ETH was stolen after a user visited a suspected phishing frontend.\nThe cited wallet retained approximately 810 ETH, worth about $1.86 million when records were checked.\nClaims that attackers stole nearly 4,000 ETH over twelve months remain independently unverified by researchers.\nTornado Cash’s website was accessible when checked, leaving the alleged domain takeover without official confirmation.\n\n\n\nCommunity accounts said the incident unfolded over approximately 12 hours. They alleged that attackers obtained the victim’s Tornado Cash deposit credentials and withdrew the funds before transferring them to several addresses.\nOnchain records provide partial confirmation. The cited wallet received 810 ETH through nine transactions on Aug. 18. Eight transfers carried 100 ETH each, while the final transfer carried 10 ETH.\nThe transactions occurred between 5:56 a.m. and 6:05 a.m. UTC. The address retained approximately 810 ETH, valued by Etherscan at about $1.86 million when checked on Aug. 20.\nEthereum records confirm 810 ETH, not the full claim\nThe verified transactions leave a 200 ETH gap between the 1,010 ETH loss reported by community users and the 810 ETH held by the cited wallet. The remaining amount may have reached another address, but no additional destination was included in the supplied evidence.\n\nUser Loses Over 1,000 ETH in Phishing Attack After Using Tornado Cash’s Expired Official DomainAccording to community users, a user clicked an old link left in a related bookmark and was redirected to a phishing site through the expired official domain tornado. cash, which had… pic.twitter.com/8j7eQl3qX2— Wu Blockchain (@WuBlockchain) August 20, 2026\n\nNo public statement from Tornado Cash, an established blockchain security firm or the reported victim had independently confirmed the full amount when this article was prepared.\nCommunity accounts claimed the victim tracked a total loss of 1,010 Ethereum, but the provided address independently confirms only 810 Ethereum.\nThe cited wallet had recorded nine transactions and no outgoing transfer at the time of review. Its balance therefore supports the claim that most of the reported funds remained under the suspected attacker’s control.\nAt Ether’s price of approximately $2,295, the confirmed 810 Ethereum was worth about $1.86 million. The reported 1,010 Ethereum loss would be worth roughly $2.32 million at the same price.\nTornado Cash domain takeover remains unconfirmed\nReports blamed the theft on the tornado.cash domain, claiming it expired after the project’s team failed to renew it during the disruption caused by U.S. sanctions. According to the accounts, an attacker subsequently registered the address and installed a fake user interface.\nThat account could not be fully verified. The domain was accessible and displayed a Tornado Cash interface when checked. No authoritative domain record, official Tornado Cash warning or named security researcher was found confirming that the address had expired and changed ownership.\nClaims that the official domain was captured by an attacker therefore remain unconfirmed and should not be presented as an established cause.\nA website loading correctly at the time of checking does not prove it was safe at an earlier time. Attackers can remove malicious code, redirect only selected visitors or restore a legitimate interface after collecting credentials.\nTornado Cash has faced previous frontend security problems. In 2024, researcher Gas404 found that malicious JavaScript had been inserted into an open source interface and could expose private deposit notes. Checkmarx later documented the supply chain compromise, although no evidence currently connects that episode with the latest transactions.\nDeposit notes can give attackers control of funds\nTornado Cash uses private deposit notes to let users withdraw assets from its pools. Anyone who obtains a valid note can generally initiate the corresponding withdrawal, making the note comparable to a private credential.\nA fake frontend can capture this information when a user attempts to make a deposit or withdrawal. The attacker can then use the stolen note before the legitimate owner does.\nThe attack differs from approval phishing, where a victim signs a malicious transaction that authorizes a drainer contract. In related coverage, crypto.news explained how wallet drainers exploit deceptive signatures to gain access to tokens and nonfungible assets.\nOld bookmarks present another risk because users often assume previously trusted links remain safe. Expired or transferred domains preserve their familiar names, search rankings and backlinks, making malicious replacements harder to identify.\nAs crypto.news recently reported, fake websites continue draining Ethereum wallets after users approve transactions or enter sensitive information. The safest approach is to verify domains through several current project channels before connecting a wallet.\nNearly 4,000 ETH claim needs more evidence\nCommunity reports also alleged that the same attackers stole almost 4,000 ETH through similar methods over the previous 12 months. No list of related addresses or attribution analysis accompanied that figure.\nWithout linked wallets, transaction hashes or a report from a security firm, the 4,000 ETH estimate cannot be independently verified. Blockchain transfers show where funds moved, but they do not automatically establish who controlled each address or which phishing campaign generated them.\nThe immediate priority is monitoring the confirmed 810 ETH. Transfers to exchanges could create an opportunity for platforms to identify or freeze assets, subject to their procedures and applicable law.\nThe victim should preserve browser history, bookmarked URLs, wallet logs and transaction records before reporting the incident to wallet providers, exchanges and law enforcement. Users who interacted with the same frontend should stop using it, move unaffected assets and revoke suspicious token approvals.\nThe available evidence supports a large Ethereum transfer into a newly active wallet. It does not yet prove the full 1,010 ETH loss, the alleged takeover of the official domain or the claimed 4,000 ETH campaign.\n\n\n\n\n\n                Read more:\n            \n\n                Webull crypto revenue reaches $2.25M in record quarter","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2660284591","isCrawlerRequest":true}