tornadocash[.]network

The domain tornadocash.network is a phishing site engaged in brand impersonation targeting MetaMask users. It presents itself as a legitimate Tornado Cash service but is designed to deceive victims into disclosing wallet credentials or private keys, posing an elevated risk of financial theft. No crypto drainer kit was detected, and the site is currently taken offline.

Technical indicators confirm the malicious nature of tornadocash.network. The domain was flagged by 2 of 95 VirusTotal security vendors, including Seclookup and SOCRadar, and appears on 4 security blocklists, such as PhishDestroy, MetaMask, and SEAL. Registered through Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság on February 21, 2026, it resolves to the IP address 188.114.97.3, hosted by Cloudflare in the US. The SSL certificate is issued by Google Trust Services / WE1, and the observed page title reads 'Tornado Cash Official | Private ETH, USDT & BNB Transactions'. Technologies detected include Cloudflare Browser Insights and HTTP/3.

Victims of tornadocash.network should immediately revoke any token approvals granted to the site, transfer remaining funds to a new wallet, and monitor accounts for unauthorized transactions. Change passwords for any accounts accessed via the phishing site and enable two-factor authentication where available. Report the domain to MetaMask’s official abuse channels, as well as to platforms like PhishTank or Google Safe Browsing to prevent further exploitation.