Coinfomania and crypto.news disagree on both the size of a Tornado Cash-related ETH phishing loss and whether the project's domain was actually hijacked.
Coinfomania and crypto.news disagree on both the size of a Tornado Cash-related ETH phishing loss and whether the project's domain was actually hijacked.
What all sources agree on
- An Ethereum user reported losing funds after an incident tied to Tornado Cash's website/domain.
- The incident was first raised through community reports, with Coinfomania citing a WuBlockchain report and crypto.news citing 'community accounts'.
- The reported events occurred around August 18, 2026.
Where the reports disagree
1Total amount lost
A user lost over 1,010 ETH following a phishing attack through Tornado Cash’s expired official domain.
An Ethereum address received 810 ETH through nine transfers on August 18, onchain records confirm.
What would settle it: A full onchain trace of all wallets connected to the reported phishing incident, or a statement from the victim/Tornado Cash confirming total funds lost.
2Whether the Tornado Cash domain was hijacked
The attack occurred after the official domain, tornado.cash, expired and was subsequently hijacked by scammers.
Tornado Cash’s website was accessible when checked, leaving the alleged domain takeover without official confirmation.
What would settle it: Domain registration records (WHOIS history) showing whether tornado.cash lapsed and changed ownership, or an official statement from Tornado Cash's team.
What to make of it
Treat only the core report — that an Ethereum user lost funds in a phishing incident linked to Tornado Cash around Aug. 18, 2026 — as established; the exact ETH total and the claim that the domain itself was hijacked remain unresolved and shouldn't be repeated as fact until onchain tracing or domain records confirm them.
Treat only the core report — that an Ethereum user lost funds in a phishing incident linked to Tornado Cash around Aug. 18, 2026 — as established; the exact ETH total and the claim that the domain itself was hijacked remain unresolved and shouldn't be repeated as fact until onchain tracing or domain records confirm them.
