According to community users, a user clicked an old link left in a related bookmark and was redirected to a phishing site through the expired official domain tornado. cash, which had been taken over by an attacker, resulting in 1,010 ETH being drained by hackers within 12 hours. Tornado Cash’s original official domain tornado. cash expired after the team failed to renew it amid OFAC sanctions, after which phishing attackers registered the domain and set up a fake frontend to steal deposit credentials. Tracking by the victim showed that the stolen funds are currently held mainly in the hackers’ addresses, while the group has allegedly stolen nearly 4,000 ETH through similar methods over the past 12 months.