Ethereum User Reports 1,010 ETH Loss in Suspected Tornado Cash Phishing Attack

Highlights:

• The Tornado Cash Phishing Attack reportedly started after the victim used an old bookmark.
• On-chain records confirm 810 ETH of the reported 1,010 ETH loss.
• Evidence does not yet support claims that the attackers stole nearly 4,000 ETH.

An Ethereum user reportedly lost 1,010 ETH after using an old Tornado Cash bookmark during a suspected phishing incident. Community accounts said attackers obtained the victim’s private deposit credentials during a roughly 12-hour period. They claimed the attackers used those credentials to withdraw ETH before moving the funds across several addresses. The reported Tornado Cash phishing attack has not received full independent confirmation from the available onchain evidence.

User Loses Over 1,000 ETH in Phishing Attack After Using Tornado Cash’s Expired Official Domain

According to community users, a user clicked an old link left in a related bookmark and was redirected to a phishing site through the expired official domain tornado. cash, which had… pic.twitter.com/8j7eQl3qX2

— Wu Blockchain (@WuBlockchain) August 20, 2026

Onchain records show that the cited wallet received 810 ETH through nine transactions on Aug. 18. Eight transactions moved 100 ETH each, while the final transaction transferred 10 ETH. The transfers reached the wallet between 5:56 a.m. and 6:05 a.m. UTC. The cited wallet still held all 810 ETH on Aug. 20 because the address had no recorded outgoing transactions.

Etherscan valued the wallet’s 810 ETH at about $1.86 million. At the same price, the reported 1,010 ETH loss would carry a value of roughly $2.32 million. Onchain records leave 200 ETH unaccounted for between the reported 1,010 ETH loss and the confirmed 810 ETH. The supplied evidence does not show whether the remaining 200 ETH reached another wallet or stayed elsewhere.

Community accounts reported the full 1,010 ETH figure, while the cited on-chain evidence confirms only 810 ETH. Tornado Cash had not publicly confirmed the reported 1,010 ETH loss when the evidence was reviewed. The reported victim had also not publicly confirmed the full amount. In addition, no established blockchain security firm had independently verified the entire reported loss by that date.

Tornado Cash Phishing Attack May Have Exposed Private Notes

The community accounts claimed the victim used an old Tornado Cash bookmark before the reported theft. They alleged that the bookmark opened a malicious frontend that attackers used to steal the victim’s private deposit credentials. The Tornado Cash phishing attack allegedly relied on those credentials rather than malicious wallet approvals. However, no independent security report has confirmed the exact attack method.

Tornado Cash uses private deposit notes to let users withdraw assets from its pools. A valid deposit note contains private information that allows its holder to withdraw assets from the corresponding deposit. An attacker who steals a valid note can attempt a withdrawal before the legitimate owner uses the same credentials. A malicious frontend can capture this information when a user enters sensitive details during a Tornado Cash interaction.

Community reports also alleged that attackers registered the tornado.cash domain after its previous registration expired. Tornado Cash had also issued no public warning confirming an attacker takeover when the evidence was reviewed.

The tornado.cash domain displayed a Tornado Cash interface when checked after the reported Aug. 18 transactions. However, that interface cannot establish what the victim saw during the alleged attack. A phishing operator can remove malicious code after collecting credentials, making later website checks insufficient to prove earlier conditions. Attackers can also redirect selected visitors while displaying a normal interface to other users.

Evidence Does Not Confirm 4,000 ETH Loss

Community accounts claimed the suspected attackers stole nearly 4,000 ETH through similar schemes during the 12 months before Aug. 18. The reports provided no complete wallet list linking those losses to one operation. They also provided no transaction hashes proving that the alleged losses came from one coordinated Tornado Cash phishing attack. No named blockchain analytics firm had publicly confirmed the nearly 4,000 ETH estimate when the evidence was reviewed on Aug. 20.

Meanwhile, ETH has gained today alongside Bitcoin, gaining 18.2% to $2,289 after Trump hosted crypto leaders at the White House. The trading volume of the coin is up 437.55% to $40.4 billion. In addition, the market cap stands at $276.34 billion.