Wu citing community users: 1,010 ETH drained in 12 hours after an old bookmark hit expired tornado.cash. Not a protocol hack. June 2026 filings already flagged the domain. Nearly 4,000 ETH alleged over 12 months is Wu only.
A user lost 1,010 ETH after clicking an old bookmark and being sent through the expired official domain tornado.cash, which Wu says had been taken over by an attacker. That is WuBlockchain, citing community users. The drain ran inside 12 hours. This is a phishing hit on a lapsed domain. It is not a Tornado Cash protocol hack.
A separate user-target method is already live: address-poisoning transfers that HTX said did not involve official accounts.
A protocol exploit is a different tape: Maya Protocol halted after a $1.7 million drain.
Wu writes that tornado.cash expired after the team failed to renew it amid OFAC sanctions, and that phishing attackers then registered the domain and set up a fake frontend to steal deposit credentials. Tracking by the victim, Wu says, shows the stolen funds are currently held mainly in the hackers’ addresses. The same item says the group has allegedly stolen nearly 4,000 ETH through similar methods over the past 12 months.
A June 2026 phishing-database filing listed tornado.cash and app.tornado.cash as impersonating tornadocash.eth.limo. It said public reporting put Tornado Cash’s removal from the OFAC list on 21 March 2025, and that RDAP showed tornado.cash registered 25 March 2025 by a privacy-protected registrant, not attributed to the original team. The same filing said MetaMask had blocked the domain. A hagezi blocklist issue the next day said the Tornado Cash Telegram group had declared tornado.cash a phishing site.
Those filings lock the domain story. They do not print today’s 1,010 ETH.
| Claim | Who said it | What it is not |
|---|---|---|
| 1,010 ETH drained in 12 hours after an old bookmark hit tornado.cash | Wu, citing community users | A protocol hack |
| Domain expired, then a fake frontend | Wu | An official team site |
| tornado.cash registered 25 March 2025, not attributed to the original team | Phishing-database filing, 21 June 2026 | Today’s drain figure |
| Nearly 4,000 ETH over 12 months | Wu, alleged | A confirmed on-chain total |
No second desk has published the 1,010 ETH print.
The next step is on-chain confirmation of that drain. Live ether is on prices.
Informational only. Not trading advice, signals, or a guarantee of any market outcome.
Written and fact-checked with AI assistance, reviewed by a human editor before publication.
No comments yet. Be the first to share your view.
HTX said an internal review found no official accounts in reported address-poisoning transfers. WuBlockchain cites known cases of up to about $4.2 million after Kraken freezes. That figure is not a Kraken statement.
Ethereum held around $2,256 Thursday after a close through the 200-day at $2,126. ETHA took $122.12 million of Wednesday's $189.15 million ETF bid. 1.618 extension $2,271 still overhead.
Bitcoin trades around $69,576 Thursday after a $517 million Wednesday ETF bid and a close through $67,292. Treasury lifted long-end buybacks to $4 billion. 200-day $71,515 still overhead.