According to CoinMeta, as disclosed by community users, a user clicked on an old link remaining in a related bookmark (an old official domain name that had been pre-registered, tornado.cash) and ended up on a phishing website. As a result, the 1010 ETH tokens stored by that user were completely stolen by hackers within 12 hours. Affected by sanctions related to OFAC, the team responsible for tornado.cash failed to renew its original official domain name after it expired. Subsequently, that domain name was pre-registered by phishing attackers, who used it to set up a fake interface to steal deposit credentials. Tracing by the victims showed that the stolen funds are currently mainly held at the hackers' addresses, and it is suspected that this group has stolen nearly 4000 ETH tokens using similar methods over the past 12 months. Security experts remind users that when using decentralized privacy tools such as tornado.cash, they should not trust historical expired domain names. It is essential to use officially verified IPFS / ENS gateways and carefully check the contract interaction information.