Security guide

Verify before you follow a link

A practical baseline for evaluating Tornado Cash websites, repositories, contract references, and people claiming to offer support.

TORNADO CASH HUB / RESEARCH NOTEPrimary references preferred

Never disclose: A legitimate information site does not need your seed phrase, private key, or Tornado Cash note. Anyone holding those secrets may control the associated assets.

Start with the verified resource directory

The Tornado Cash official links and verified resources directory separates archived original repositories, community-maintained source, documentation, and external interfaces. Each category has different operators and trust assumptions.

Check the complete destination

Read the full hostname, not only the page title or link text. Treat unfamiliar spelling, added words, unusual subdomains, and urgent wallet prompts as reasons to stop and verify independently.

Prefer reproducible evidence

Look for public source code, a specific commit, build instructions, contract verification on a block explorer, and references from established community documentation. A visual copy of a familiar interface proves nothing.

There is no fund-recovery support desk

Be skeptical of unsolicited direct messages, “validation” forms, remote-access requests, and anyone asking for an advance fee to recover funds. Tornado Cash Hub does not provide transaction support or contact visitors privately.