tornad[.]cash

This domain, tornad.cash, is actively targeting cryptocurrency users with a crypto drainer scheme designed to siphon digital assets from connected wallets. The site employs deceptive tactics, such as mimicking legitimate decentralized finance platforms or wallet interfaces, to trick users into authorizing malicious transactions. Once permissions are granted, the drainer automatically transfers funds to attacker-controlled addresses without the victim’s knowledge, often resulting in irreversible losses. Analysis indicates tornad.cash was registered on February 21, 2026, through NETIM SAS, an uncommon creation date that may suggest an attempt to evade detection or exploit future-dated records. The domain resolves to IP address 172.67.149.126, hosted on infrastructure belonging to a content delivery network known for anonymizing malicious traffic. Security vendors have flagged the site in 3 out of 95 scans on VirusTotal, a low but significant detection rate that underscores its targeted and evasive nature. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as encrypted connections are routinely exploited in phishing campaigns to appear legitimate. If you have visited tornad.cash or interacted with its content, immediate action is required to mitigate potential damage. Disconnect any wallets linked to the site using a trusted wallet interface or revoke permissions via a blockchain explorer. Scan all connected devices for malware, as crypto drainers may deploy additional payloads to maintain persistence. Monitor wallet activity for unauthorized transactions and report the incident to relevant security teams or community alert platforms. Users should also verify the authenticity of any decentralized application before connecting wallets, as this domain exemplifies the risks of unverified interactions in the cryptocurrency ecosystem.