{
 "tag": "tornado-cash",
 "name": "Tornado Cash",
 "group": "Other",
 "incidents": [
  {
   "slug": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "title": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
   "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "json": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bsc"
   ],
   "method": "eip-7702-phishing",
   "product": "A PancakeSwap liquidity provider (BNB Chain)",
   "tags": [
    "bsc",
    "eip-7702-phishing",
    "eip-7702",
    "pancakeswap",
    "liquidity-provider",
    "tornado-cash",
    "specter"
   ],
   "amountUsd": 2960000,
   "victims": 1,
   "startedAt": "2026-07-23",
   "closedAt": "2026-07-23",
   "updatedAt": "2026-07-23T12:00:00Z",
   "summary": "A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out."
  },
  {
   "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-attack",
    "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed."
   },
   "chains": [
    "solana"
   ],
   "method": "durable-nonce",
   "product": "Drift Protocol (Security Council multisig)",
   "tags": [
    "solana",
    "durable-nonce",
    "drift",
    "multisig",
    "security-council",
    "social-engineering",
    "admin-takeover",
    "cctp",
    "wormhole",
    "admin-key",
    "dprk",
    "tornado-cash",
    "laundering",
    "ai"
   ],
   "amountUsd": 285000000,
   "victims": null,
   "startedAt": "2026-04-01",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk."
  },
  {
   "slug": "address-poisoning-4556-eth-jan-2026",
   "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum whale wallet",
   "tags": [
    "ethereum",
    "address-poisoning",
    "eth",
    "dusting",
    "lookalike-address",
    "tornado-cash",
    "scam-sniffer",
    "whale"
   ],
   "amountUsd": 12250000,
   "victims": 1,
   "startedAt": "2026-01-30",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-01-31T12:00:00Z",
   "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss."
  },
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  },
  {
   "slug": "address-poisoning-50m-usdt-dec-2025",
   "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025",
   "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder (funds withdrawn from Binance)",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "tornado-cash",
    "binance-withdrawal"
   ],
   "amountUsd": 49999950,
   "victims": 1,
   "startedAt": "2025-12-20",
   "closedAt": "2025-12-20",
   "updatedAt": "2025-12-20T12:00:00Z",
   "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  }
 ],
 "changes": [
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-21",
   "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-20",
   "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "incidentTitle": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-23",
   "title": "Specter reports a dormant PancakeSwap LP lost about $2.96M after signing a malicious EIP-7702 authorization; about $1.46M goes to Tornado Cash.",
   "sourceUrl": "https://www.chaincatcher.com/en/article/2277886",
   "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-03",
   "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-30",
   "title": "A new durable nonce account tied to a member of the updated multisig appeared.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-27",
   "title": "Drift executed a planned Security Council migration to replace a member.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}