Metamask, Trust Wallet, Phantom, and Keplr all drained few days ago (May 16th).
I just want to know how someone was able to gain entry into my 4 individual wallets, with full access to transfer all of my assets.
Preface: I haven't touched/traded any 'airdropped' coins that appear in my wallets, I have NEVER shared my seed phrase, I haven't connected any of my wallets to any websites in the last few days before this occured, and when I do, I always double check that the domain is correct, and not is not a phishing link, and then I always revoke access afterwards.
METAMASK – Prior to my account being completely drained, I hadn't used any of my accounts that day, then I suddenly got an alert on my phone that my coins were being swapped into ETH, and a total of 0.0535 ETH was sent at 33:12:59 PM UTC to 0x162 883e75c20Cf01B5C113B60281c4754CE6906t,.The same address also swapped coins in order to transfer 0.0271 BNB at 11:12:59 UTC. Utilizing Mimic:Swapper – (if that's relevant) – to completely drain my portfolio before I could react.
TRUST WALLET – The draining of my XRP was baffling to me as the account hasn't been touched in over 1 year, it is essentially dormant and I had forgotten about it, and it had 0 active connections. 8.9998 XRP was stolen, transferred to: rHUrpwzbtYJwRQrUqbiHbR5c5f4Kx3udGk at 4:10:50 UTC with their name being "register". The account was activated at 4:10:31 UTC.
Would that mean that it took 18 seconds after the account's creation to drain my XRP?
PHANTOM – Coins were swapped to Solana and 1.548827152 SOL was sent to: 7SPPzzfa9KUWgM3jxdiRhY9xMBy5uq1ZcEGBAmjESUiV at 23:03:13 UTC, sadly that's not all that was stolen from my Phantom wallet. They also transferred 0.00137 Bitcoin at 15:53:12 UTC to: bc1qv9cluzqr6rt2agcztdxcmn6p9r7lvfm0lgh5qf (not sure if important) – "order to allow arbitrage bots to trade against the RAMM, it is useful to have a price estimation feature, that would have parameters similar to RAMMSuiPool.tradeAmounttradeAmountInEstimatePrice"
KEPLR – Confuses me the most, as I don't interact with much on this account, I haven't received any airdrops, I just use it to primarily stake, vote, and utilize LP's (that's how they were able to drain this wallet's funds), transferring 100 Akash from my account of at 23:48:57 UTC and sent to: osmo10a3k4hvk37cc4hnxctw4p95fhscd2z6h2rmx0aukc6rm8u9qqx9smfsh7u, they attempted to start un-staking all of the coins in my portfolio, which I cancelled, but am unable to cancel the un-delegation of all of my staked Akash.
I have a semi-hypothesis, though it may sound naïve. Say one of my wallets was compromised, and it was imported into another wallet, would they then have full access all to the pre-existing accounts/wallets that the compromised account was imported into? And if so, would deleting said compromised account from wallet change anything?
Yes I am an idiot, feel free to laugh in the comments, I just would like to hear the communities thoughts on how this occurred. It's safe to say that I will be purchasing a Ledger moving forward.
submitted by /u/Temple-Ball-Z
[link] [comments]