Ethereum User Loses $1.86 Million in Apparent Phishing Attack

The incident unfolded over a 12-hour window on August 18, when an address received 810 ETH through nine rapid transactions. Eight of these transfers involved 100 ETH each, followed by a final 10 ETH transaction. These movements, recorded between 5:56 a.m. and 6:05 a.m. UTC, remain the only independently verifiable portion of the alleged theft. The discrepancy between the reported 1,010 ETH loss and the confirmed 810 ETH balance has yet to be reconciled, and no further destination addresses have surfaced.

Reports circulating within the crypto community allege that the theft stemmed from a compromised Tornado Cash domain. Speculation suggests the domain expired following U.S. sanctions, allowing an attacker to register the address and deploy a malicious frontend designed to harvest deposit notes. These notes function as private credentials; once obtained, an attacker can initiate unauthorized withdrawals from privacy pools. However, the domain remained operational during subsequent checks, and no authoritative security firm or official project channel has confirmed a domain takeover or the specific mechanism of the breach.

This incident highlights the persistent danger of relying on outdated browser bookmarks. Because malicious actors can easily mimic legitimate interfaces, security experts advise users to cross-verify domain authenticity through multiple official channels before connecting wallets. While some community accounts claim the perpetrators have stolen nearly 4,000 ETH over the past year, this figure lacks supporting transaction hashes or forensic evidence. For now, the focus remains on the 810 ETH currently held in the target wallet, as any future movement to centralized exchanges could provide a path for asset tracking or potential intervention by platform security teams.