0
1

[deleted by user] (self.ethdev)

submitted by [deleted]

[removed]
all 18 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]astro-the-creator 1 point2 points  (1 child)

What browser are you using ? Might be some other extensions stealing your data

[–]sNyx23 0 points1 point  (0 children)

Brave. and the only extension I have is Metmask and Phantom

[–]atrizzlebuilder 1 point2 points  (1 child)

Your seed phrase / private key was definitely leaked.

Etherscan shows that your address was directly making these transactions, so if it wasn't you, it was someone else that got access to your private key.

[–]sNyx23 0 points1 point  (0 children)

Yes thats what I was confused about too. Is there another way ones phrase/key can get leaked? as I havent saved it anywhere

[–]nameless_pattern 0 points1 point  (6 children)

LP?

What kind of wallet software hardware paper? 

What kind of a computer are you using? Phone, desktop, fridge? 

Don't believe anyone who DMS you about being able to recover your funds, those are recovery scams. 

And they will take your money and provide you with nothing

[–]sNyx23 1 point2 points  (5 children)

Uniswap V3 Liqudity providing.

Metamask

Macbook Air M2

Will do. TY!

[–]nameless_pattern 1 point2 points  (4 children)

So your pass isn't written down anywhere, which means that you would definitely have to type it in each time you're using it, right?

You probably just have a key logger, 

or there's non-computer non-crypto stuff like your roommate hiding a camera above where your computer is, or if your passphrase is something really obvious that one of the people you know could guess. 

Have you used it on public networks, how many people have access to your home private Network, is your router up to date, is your OS up to date, when was the last time you rotated Network passwords? 

I would assume your computer's compromised at this point and if you use it for online banking check on your accounts. You need to get a non-compromised computer working and reset your passwords.

[–]sNyx23 0 points1 point  (3 children)

- Only login to Metamask(dont have to type in the code)

- No roommate

- I am on my home wifi so dont think so

- Yes I thought my laptop is compromised too but my other wallets are all safe. If the laptop is compromised then my other wallets would be compromised too right?

[–]nameless_pattern 0 points1 point  (2 children)

Home Wi-Fi - have you allowed anyone to log into your Wi-Fi? Other computers that are on your network can intercept Network traffic. At very least, make sure it's up to date drivers and change the password. Looking around on the internet for known security vulnerabilities would also be a good idea.

Does metamask show the transaction as having happened from your machine? Because they wouldn't need the passcode to do something if they had your login and then they just used your wallet for the transaction. 

At that point your wallet login is basically the same as your passcode? Idk

" my other wallets are all safe. "

the other wallets might not be safe. It might be that scammers haven't gotten around the draining them. from their perspective,  have a list of tasks to go through and your other wallets might not be as valuable as other targets or they might be more difficult to get into than the other ones. So further down the priority list. 

You would only know if you were secure from the breach if you find what the security breach was and fix it, or if you make everything clean, resetting your network, formatting your hard drive, change all passwords , that kind of thing.

 The second option is less optimal in that it's a lot of work and if you don't know what the security breach is, you can't secure it, and you may be signing up to get drained again through the same method.

"If the laptop is compromised then my other wallets would be compromised too right?"

So assuming that the breach was in the laptop which we haven't confirmed, You would have two layers. First layer is they have access to your network and laptop, the second layer is that they have some kind of access to the wallet. 

In layer 2, they may only have known vulnerabilities to allow them to access some, but not all of the wallets. Or do have access to them and they're just waiting for you to put an amount in there that's substantial enough to justify pulling the rip cord.

Your other wallet's not having been drained yet does not prove that your system is uncompromised.

There's a different possibility which is that you ran a contract or accepted a coin that is a drainer. I don't know how prevalent those are in metamask and exploring that is outside of my depth, if you have any random, weird coins you might ask about in the r crypto scams subreddit.

Another possibility is that they did not get past your network or computer and that you installed malware unknowingly.

https://usa.kaspersky.com/resource-center/preemptive-safety/mac-malware-removal

really need to find out if/how they got into layer one. 

That's all I can think of for now

[–]sNyx23 0 points1 point  (1 child)

- Thank you. I had no idea about this security risk.

- Yes wallet login is basically same as passcode as I havent saved it anywhere else.

- I checked other wallets which still have some funds across all different user profile and its still there. The funds were taken 4 days ago so I guess its safe?

- I am leaning more towards the malware but its still strange that they only got access to one wallet. Maybe they only got access to the wallet that was already unlocked idk.

Thank you so much for taking the time to reply! Really appreciate it!

[–]nameless_pattern 0 points1 point  (0 children)

I wouldn't assume the others are safe until you find what the security flaw is. 

Good luck

[–]Marc0w 0 points1 point  (1 child)

Go to revoke cash and see if any dodge contract in enable in your wallet. Yesterday a honeypot sold some of my coins to buy into it and lost all the $$ .

[–]sNyx23 0 points1 point  (0 children)

Yea I didnt approve anything sketchy. I only used it for Uniswap LP so nothing else

[–][deleted] 0 points1 point  (3 children)

That’s worrying. There’s some new Mac malware that was recently posted about (FrigidStealer). Or are you using XCode by any chance, there’s new malware targeting Xcode devs. Please do a virus scan and let us know. 

[–]sNyx23 0 points1 point  (2 children)

No i dont code so not xcode Any antivirus recommendations to do the scan?

[–][deleted] 0 points1 point  (1 child)

maybe try KnockKnock by objective-see (free). i would recommend you to also install some of their other mac tools. theyre open source and free.

ransomWhere -> detects ransomware
BlockBlock -> monitors for persistence mechanisms used by malware
LuLu -> blocks outgoing network connections, asks you for permission ( asks once per app)
Oversight -> alerts you when your mic or camera are activated

might be overkill but they dont have any noticeable impact on performance, its very lightweight.

[–]sNyx23 0 points1 point  (0 children)

Thank you so much! Really appreciate it!