Tornado

Tornado Cash

Cash

Polymarket

zkLend

A crypto user lost 1,010 ETH after following an old Tornado Cash bookmark into a phishing frontend that captured the private withdrawal credentials needed to access the deposited funds.
The victim <a href="https://x.com/WuBlockchain/status/2090396627257503764" rel="noopener noreferrer nofollow">deposited the ETH into legitimate Tornado Cash contracts</a>, but the malicious interface obtained the private note generated during the process. The attacker then used those credentials to withdraw the assets within roughly 12 hours without compromising the underlying Tornado Cash smart contracts.
<h2 id="phishing-frontend-targeted-private-withdrawal-notes">Phishing Frontend Targeted Private Withdrawal Notes</h2>
Tornado Cash separates deposits and withdrawals through <a href="https://cryptoadventure.com/community/articles/what-are-zero-knowledge-proofs-zkp/" rel="noopener noreferrer nofollow">zero-knowledge proofs</a>. A deposit generates a private note that controls the subsequent withdrawal, meaning possession of that note is enough to claim the corresponding assets.
The malicious frontend copied the protocol interface while capturing those credentials before the victim could complete the withdrawal. A stale bookmark reportedly directed the user to the compromised page after the former Tornado Cash domain had lapsed during the disruption surrounding U.S. sanctions.
The attack closely resembles an earlier case in which the <a href="https://cryptoadventure.com/zklend-hacker-claims-losing-stolen-eth-to-tornado-cash-phishing-site/" rel="noopener noreferrer nofollow">zkLend exploiter lost 2,930 ETH to a fake Tornado Cash frontend</a> while attempting to move funds stolen from the lending protocol.
Nearly 4,000 ETH in thefts over the past 12 months has now been attributed to the phishing operation tied to the latest frontend.
<h2 id="810-eth-appears-across-nine-visible-withdrawals">810 ETH Appears Across Nine Visible Withdrawals</h2>
The reported loss totals 1,010 ETH, while the publicly traced withdrawal sequence accounts for 810 ETH across nine transactions. The remaining 200 ETH has not been tied as cleanly to the same visible destination path.
Phishing losses have continued to hit Ethereum users through several attack methods. A user <a href="https://cryptoadventure.com/ethereum-user-loses-999999-usdt-in-phishing-approval/" rel="noopener noreferrer nofollow">lost $999,999 in USDT in July after signing a malicious token approval</a>, giving the attacker permission to drain the wallet without obtaining its private key.
Another campaign <a href="https://cryptoadventure.com/polymarket-users-hit-by-suspected-2-94m-pusd-phishing-drain/" rel="noopener noreferrer nofollow">drained an estimated $2.94 million from Polymarket users holding pUSD</a> after victims interacted with malicious links, signatures or approvals.
The Tornado Cash case took a different route: the ETH reached the intended privacy contracts, but control of the deposits was lost when the frontend captured the withdrawal notes.
<h2 id="victim-funds-trace-back-to-whirlpool">Victim Funds Trace Back To Whirlpool</h2>
The wallet behind the loss had received 73 BTC worth about $4.6 million from the Whirlpool Bitcoin mixer roughly two weeks earlier before part of the position moved into Ethereum and <a href="https://cryptoadventure.com/tornado-cash-explained/" rel="noopener noreferrer nofollow">Tornado Cash</a>.
The same user had claimed the Bitcoin was moved because of concerns around Coldcard wallet security, while <a href="https://x.com/SpecterAnalyst/status/2090440369175449965?s=20" rel="noopener noreferrer nofollow">wallet activity</a> also connected the account to Telegram groups focused on private-key searching and brute-force tools. The transaction history has raised the possibility that the victim was itself involved in high-risk crypto activity.
Tornado Cash was <a href="https://ofac.treasury.gov/recent-actions/20250321" rel="noopener noreferrer nofollow">removed from the U.S. Treasury sanctions list on March 21, 2025</a>. Its current web interface lists <code>app.tornado.cash</code> alongside ENS and IPFS-based mirrors for accessing the protocol.
The post <a href="https://cryptoadventure.com/tornado-cash-phishing-frontend-drains-1010-eth-from-user/" rel="noopener noreferrer nofollow">Tornado Cash Phishing Frontend Drains 1,010 ETH From User</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Tornado Cash Phishing Frontend Drains 1,010 ETH From User

Table of Contents

Crypto Adventure

Other articles published on Aug 21, 2026

Join our free newsletter for daily crypto updates!