Wu Blockchain flagged the loss on August 18. One wallet, roughly 1,010 ETH, drained in under twelve hours through a fake Tornado Cash front end. Most outlets ran the 1,010 figure straight. On-chain, the confirmed number is lower. Eight transfers of 100 ETH and a ninth of 10 add up to 810 ETH, close to 1.86 million dollars at that morning's price near 2,295 dollars. The other 200 ETH, another 460,000 dollars, has not been tied to the same theft. It is the same split that showed up when Maya Protocol reported an 11 million dollar loss against a far smaller on-chain take, and it is worth pausing on before repeating the headline.
The domain expired years before anyone stole through it
The victim reportedly arrived through an old bookmark. That bookmark pointed at tornado.cash, a domain the project stopped controlling long ago. Someone registered it after it lapsed, rebuilt a convincing copy of the withdrawal interface, and waited. When a user pasted in a deposit note, the private string that proves ownership of mixed funds, the operator behind the clone emptied the deposit before the real owner could move.
A deposit note works like a bearer credential. Whoever holds it controls the coins. The clone did not touch a smart contract or forge a wallet signature, because for this kind of theft the weak point stopped being the code. It needed one string, typed willingly into a box that looked right.
Why a sanctioned protocol left its front door open
The registration lapsed during the years Tornado Cash could not be safely run. OFAC sanctioned the mixer in August 2022, and its developers were indicted not long after. Roman Storm went to trial in 2025 and was convicted on a single count, with prosecutors still pressing the charges the jury deadlocked on. Treasury delisted the protocol in March 2025 after a Fifth Circuit ruling. By then the domain was already gone. A tool built to run without an owner had no one left to pay a renewal invoice.
This was not the first drain through a dead domain
The 1,010 ETH hit is the loud one. The number underneath it is the story. The same group is estimated to have taken around 4,000 ETH over the past year by squatting expired crypto domains and standing up lookalike pages, according to the on-chain accounts that surfaced this case. Tornado Cash is one entry on a longer list of abandoned front ends that still carry trust earned in their working days.
| Figure | Amount | Approx. USD |
|---|---|---|
| Reported loss (Wu Blockchain) | 1,010 ETH | 2.3 million |
| Confirmed on-chain | 810 ETH | 1.86 million |
| Untraced gap | 200 ETH | 460,000 |
| Same tactic, past 12 months | around 4,000 ETH | price varied |
For anyone who used the mixer in its active years, the lesson is small and specific. Delete the old bookmarks, and treat any page asking for a deposit note as hostile until it proves otherwise. Treasury closed the sanctions file on Tornado Cash more than a year ago. The domain it never renewed has been earning for someone else ever since.
