Metamask, Trust Wallet, Phantom, and Keplr all drained few days ago (May 16th).

Cryptocurrency News and Public Mining Pools

Metamask, Trust Wallet, Phantom, and Keplr all drained few days ago (May 16th).

I just want to know how someone was able to gain entry into my 4 individual wallets, with full access to transfer all of my assets.

Preface: I haven't touched/traded any 'airdropped' coins that appear in my wallets, I have NEVER shared my seed phrase, I haven't connected any of my wallets to any websites in the last few days before this occured, and when I do, I always double check that the domain is correct, and not is not a phishing link, and then I always revoke access afterwards.

METAMASK – Prior to my account being completely drained, I hadn't used any of my accounts that day, then I suddenly got an alert on my phone that my coins were being swapped into ETH, and a total of 0.0535 ETH was sent at 33:12:59 PM UTC to 0x162 883e75c20Cf01B5C113B60281c4754CE6906t,.The same address also swapped coins in order to transfer 0.0271 BNB at 11:12:59 UTC. Utilizing Mimic:Swapper – (if that's relevant) – to completely drain my portfolio before I could react.

TRUST WALLET – The draining of my XRP was baffling to me as the account hasn't been touched in over 1 year, it is essentially dormant and I had forgotten about it, and it had 0 active connections. 8.9998 XRP was stolen, transferred to: rHUrpwzbtYJwRQrUqbiHbR5c5f4Kx3udGk at 4:10:50 UTC with their name being "register". The account was activated at 4:10:31 UTC.

Would that mean that it took 18 seconds after the account's creation to drain my XRP?

PHANTOM – Coins were swapped to Solana and 1.548827152 SOL was sent to: 7SPPzzfa9KUWgM3jxdiRhY9xMBy5uq1ZcEGBAmjESUiV at 23:03:13 UTC, sadly that's not all that was stolen from my Phantom wallet. They also transferred 0.00137 Bitcoin at 15:53:12 UTC to: bc1qv9cluzqr6rt2agcztdxcmn6p9r7lvfm0lgh5qf (not sure if important) – "order to allow arbitrage bots to trade against the RAMM, it is useful to have a price estimation feature, that would have parameters similar to RAMMSuiPool.tradeAmounttradeAmountInEstimatePrice"

KEPLR – Confuses me the most, as I don't interact with much on this account, I haven't received any airdrops, I just use it to primarily stake, vote, and utilize LP's (that's how they were able to drain this wallet's funds), transferring 100 Akash from my account of at 23:48:57 UTC and sent to: osmo10a3k4hvk37cc4hnxctw4p95fhscd2z6h2rmx0aukc6rm8u9qqx9smfsh7u, they attempted to start un-staking all of the coins in my portfolio, which I cancelled, but am unable to cancel the un-delegation of all of my staked Akash.

I have a semi-hypothesis, though it may sound naïve. Say one of my wallets was compromised, and it was imported into another wallet, would they then have full access all to the pre-existing accounts/wallets that the compromised account was imported into? And if so, would deleting said compromised account from wallet change anything?

Yes I am an idiot, feel free to laugh in the comments, I just would like to hear the communities thoughts on how this occurred. It's safe to say that I will be purchasing a Ledger moving forward.

submitted by /u/Temple-Ball-Z
[link] [comments]