Woofun AI reports that a sophisticated phishing campaign successfully exploited the lapsed official domain of Tornado Cash, resulting in the theft of 1,010 ETH from an unsuspecting cryptocurrency user. This security breach, documented by Wu Blockchain, underscores the persistent vulnerabilities inherent in domain management within the crypto ecosystem, particularly when regulatory pressures intersect with technical infrastructure failures. The incident serves as a stark reminder of how legal enforcement actions can inadvertently create openings for malicious actors to compromise user assets.

The attack vector relied on the victim's reliance on an old bookmarked link to tornado.cash, which had expired after the Tornado Cash team was unable to renew it due to sanctions imposed by the U.S. Treasury's Office of Foreign Assets Control (OFAC). An attacker subsequently registered the domain and deployed a fake front-end interface that meticulously mimicked the original service. When the user interacted with this fraudulent site, they unknowingly authorized transactions that drained 1,010 ETH, valued at approximately $2.3 million, from their wallet within just 12 hours. The stolen funds remain largely in the attacker's address, indicating a rapid and efficient extraction of value.

Woofun AI data shows that this incident is part of a broader pattern, with the same group estimated to have stolen around 4,000 ETH over the past year using similar domain-expiry tactics. These operations specifically target defunct or lapsed crypto-related domains, exploiting the vacuum left when legitimate entities cease operations or lose access to their digital infrastructure. The consistency of these attacks suggests a systematic approach to identifying and monetizing expired assets, rather than isolated opportunistic breaches.

The regulatory impact on Tornado Cash has extended beyond operational restrictions, creating a cascading effect of security gaps that attackers are quick to exploit. The inability to renew the domain due to legal enforcement action has transformed a privacy-focused mixer into a liability for its former users. This situation highlights a critical vulnerability in the crypto ecosystem: the reliance on domain names that can lapse or be seized, leaving users exposed to sophisticated social engineering and technical deception.

Security experts emphasize that domain expiry is a common attack vector, not just for crypto services but for any online platform, and urge users to exercise extreme caution. They recommend that users use bookmarks carefully, double-checking URLs before entering sensitive information or authorizing transactions.

Additionally, the adoption of hardware wallets, multi-signature transactions, and domain monitoring services is cited as essential for mitigating such risks. The incident also raises questions about the responsibility of domain registrars and the need for better safeguards to prevent such takeovers.

The stolen funds have not been recovered, leaving the victim to bear the full financial loss. In the decentralized world, security ultimately depends on both technical measures and user awareness, as regulatory actions can have unintended consequences that compromise infrastructure integrity. This incident adds to a growing list of exploits targeting crypto users through compromised or lapsed infrastructure, serving as a cautionary tale about the intersection of regulatory pressure, domain security, and user vigilance.