En el foro BitcoinTalk apareció una investigación bien detallada sobre un sitio de phishing, tornado-mixer[.]net, que se hace pasar por el frontend del mixer Tornado Cash.

En el hilo publicitario original, el autor vendía el servicio como una interfaz cómoda con generador de informes de cumplimiento (compliance report) para exchanges y brókers OTC —supuestamente sin custodiar fondos ni guardar registros.

Tornado Cash note → compliance report
ETH / DAI / USDC / USDT / WBTC — 0.1–100 ETH equivalent, no account

Short version

Note in, report out. No account, no email, no KYC, no logs. If you've ever had to explain where a withdrawal came from to somebody holding your funds, that's the part this fixes.

What this actually is

A Tornado Cash frontend. Deposits go to the pool contract, not to us — we never hold anything. You keep the note, the note is the money. The addition is a compliance report generator: paste the note, get a document tying that deposit to that withdrawal, the kind of paper a compliance desk or OTC broker reads instead of asking you to describe the source of funds in a chat box and hoping the clerk is in a good mood.

Pool depth at the 0.1 ETH denomination, as of writing: 374,263 deposits. It moves; check the site.

Assets and limits

ETH, DAI, USDC, USDT, WBTC. Minimum 0.1 ETH equivalent, maximum 100 ETH equivalent per transaction. More than that, split and queue.

Speeds

Standard / Fast / Instant. Gas is yours, faster costs more of it. Default is fine unless you're on a clock.

Wallets

MetaMask, OKX, Trust, Bitget, Coinbase Wallet, Phantom, Rabby, Ledger. Extension or QR.

What it's good for

Breaking a balance into pool-sized chunks and consolidating afterwards — the destination field takes one address, everything lands there.
Producing a paper trail that survives scrutiny without producing an identity.
Stablecoin work where you'd rather the on/off ramp didn't see the rest of your wallet.
Sweeping a wallet whose history you don't fully control — the receiving desk gets something to file.

What it isn't

Not a mixer with its own anonymity set. It borrows Tornado's, with everything that implies: relayer dependency, and a protocol with a sanctions history and a messy but improving exchange-acceptance record. Don't lose the note — nobody regenerates it for you. Don't reuse a round number you've used elsewhere.

FAQ

Custodial? No. Contract-level deposit, direct withdrawal.
Logs? Nothing kept past the session.
Fees? Relayer fee plus gas. Relayers set their own rate; it runs around 0.3% on the ETH pool and varies.
Sanctioned? The protocol was. The interface isn't a legal entity. Most desks now take pool outputs with a report attached — which is the point of the report.
Why not use Tornado directly? You can. This is the same pools with a door that doesn't make you assemble a report by hand.

Link

https_://tornado-mixer[.]net

Según el investigador albon, al hurgar en el código fuente del sitio apareció un script malicioso (un wallet drainer) diseñado para barrer por completo los tokens de cualquier cartera que se conecte. En los metadatos de WalletConnect, los del phishing escribieron literalmente para qué sirve la sesión: "Connect wallet to drain".

Cuando se abre la ventana de conexión, la interfaz te avisa sin pelos en la lengua: "The wallet will sign the drain transactions".

Escondida en el código de la página había una función drainAll() que lee los saldos de tokens ERC-20 de la dirección de la víctima y arma las transacciones para transferirlos íntegros a una cartera fija de los atacantes.

En una actualización posterior, albon contó cómo siguió todo. Según dice, después de enviar las quejas, los moderadores del foro borraron el hilo publicitario y bloquearon la cuenta del que lo difundía. Además, tras avisar vía GitHub, el equipo de MetaMask metió el dominio en su lista negra, así que los usuarios de la cartera ahora ven una advertencia de phishing al entrar al sitio. La solicitud al registrador del dominio seguía en trámite al momento del último mensaje del autor.