An Ethereum user reportedly lost more than 1,000 ETH after using a phishing link tied to Tornado Cash’s expired official domain, according to a Wu Blockchain report. The incident appears to involve an old bookmark that redirected the user to a malicious site, exposing the danger of stale crypto infrastructure endpoints.
How an expired official domain became a phishing vector
The attack illustrates a growing pattern in Ethereum security incidents where legitimate services lose control of a domain and criminals repurpose it. Tornado Cash’s official domain reportedly expired, and a user’s saved bookmark continued pointing to the now-compromised address. Because the link once belonged to a known privacy protocol, the victim may have trusted the page enough to sign a transaction or connect a wallet. The broader Ethereum ecosystem has been navigating similar cleanup periods, as covered in Crypto’s Dot-Com Shakeout: Over 100 Projects Fold in 2026, Only Fee-Generating Protocols Survive.
The transaction outcome and immediate security signal
Although the full on-chain path has not been independently traced in the source report, the claimed loss of more than 1,000 ETH represents a severe wallet-level compromise. The event reinforces why treasury-scale Ethereum holders are increasingly scrutinizing custody and domain management. Institutional treasury disclosures, such as Eightco Holdings Discloses $378M Treasury with Over 16,000 ETH, OpenAI Stake, and WLD Tokens, show how large ETH positions demand robust operational controls beyond simply holding keys safely.
What Ethereum users should watch next
This phishing case is a reminder that bookmarks, old domains, and cached links are part of the attack surface, not just wallet approvals. Major Ethereum holders continue to attract attention from sophisticated social-engineering campaigns, as seen with entities like Tom Lee’s Bitmine Now Holds 4.8% of Ethereum Supply After Latest ETH Purchase. Users should verify the exact domain before any transaction and treat expired infrastructure as a live risk.
