Bitcoin Forum

Be careful using your metamask and other wallets , i have encounter that my funds are being stolen automatically and being sent to a certain address, experience this in binance network, other coins are not stolen only the bnb token, every time funds are being sent, there is a few seconds before your funds will automatically sent to an address.

So how will us be able to transfer tokens to a new address? here is what i did

• Prepare funds for transfer of your token to a new wallet, don't make exact value or amount since gas fee's changes
• Create a new wallet from another computer don't create a new wallet on the same computer
• Select assets and make the transaction ready, remember that what ever automation made from your wallet has delays of few seconds
• On the other computer or laptop send the funds to the old wallet where you need to remove your other tokens, then send the token to your new address
• In the process once your old wallet received the funds, the transfer of you made from your old wallet will be the first to process
• Repeat this process until you transfer all your tokens to the new address

This process may or might not work with others but i have tried this to two of my friends, then i suggest format your computer, to make sure since my suspicion are computer might be infected of a certain malware, or because of the connection you made before to a certain app, or network on a chain.
I hope this will be able to help others who might experience it before or in the future

As you can see to the transactions we made funds are being sent out once we send decent amount to the wallet
so next time be very careful on where you connect those metawallets or other wallets to avoid this king of trouble
https://i.ibb.co/HHGh7m7/out.png (https://ibb.co/3CSR1t1)

Hey are you kidding??
You create your post today and your transaction history showing about 251 days ago and you coming up to cook a story today and your btt account created July 22, 2022? Now how do you even mean, note that your token can only be tempped whenever you compromise your key phrase or possibly you were too careless to reveal phrase and private key.
If you think you are not safe using metamask wallet then try using trustwallet I have been using for long and no bad news or fraudulent activity recorded so far.

well because the tokens where not stolen only the BNB where automatically sent to a certain address, I'm not making anything here, because 2 weeks ago one of my colleague experience this issue and he is so careful when using the wallet, if I'm not mistaken he said 1k+ usdt in bnb where stolen, i have known the person and he will not lie to us, i made it because of what happen, to make everyone aware, the reason with the image is because I'm the one who remote it and guide him before with the process, the other person while my colleague just told us, 251 days is not long my friend, sharing experience is better.

I don't know where you are coming from but I'm just sharing what I have experience, and also few weeks ago my colleague also experience this kind of hacking those screenshot are proof that it really happens, I'm not here to argue besides I'm just a new member, if I'm a member then , I should have shared it with others earlier, the purpose of the post is not to make story, but to let others know that they should be very careful god bless you sir.

whatever reason you use your screenshots which are long enough to create hacking stories on your assets. the story is not only experienced by you and your friends. this is a case that has been experienced by many users. especially those who like to participate in airdrop campaigns.
connecting the main wallet on the airdrop site is not a good way. simply store your assets in your main wallet which you never connect to any device. use a new wallet if you want to do it. you don't need to send your assets several times to different addresses. If you continue to use it to link to an obscure website, it will not change the risk.
I wish you more luck in the future.

I think it doesn't matter if he takes evidence from cases that have been experienced even though it's been a long time, but the important factor is he shared a useful thread to be aware of connecting wallets with third parties because there is a possibility that we can lose assets in our wallet, many beginners don't know about it because they are involved in airdrop event by connecting a wallet with a fake project without knowing the risk of losing assets in the wallet.

I also have the same opinion, it doesn't matter how long the case has been going on, what matters is how someone can overcome the case of hacking the wallet so they can get their remaining assets. this is indeed a useful thread, but also keep in mind, that there are many similar threads with the same case.

Regarding the use of metamask, it should be noted that many phishing applications disguise themselves as metamask. Download the metamask plugin only on their official website.

Wallets that have been hacked like this usually lure users to send some assets for Fee, and when they are in they will quickly move them to another wallet. some of them use bots to make fast transactions,

I believe this story because it look like a wound that failed to heal, the timing might be old but you will never forget.

The same happened to me years ago when I was a fan of coinomi wallet, I never knew the difference between a closed source and open source wallet then. I connect the wallet to countless website since I was into airdrop.

The mistake I made was leaving some valuable tokens on the wallet, and one day I got a notification that I sent out tokens, it wasn't me and when I checked it out it was moved to a new ETH wallet.

I'm not going to comment on the screenshot you shared or whether your story is true or not as this is completely irrelevant (and I have no reason not to believe you).
According to your description, it seems your device (the one you have your main wallet on) is infected with the clipboard hijacker malware. This malware replace the address you are intending the coins to with the hacker's address.
You can read more about it on this guide:
How to lose your Bitcoins with CTRL-C CTRL-V (https://bitcointalk.org/index.php?topic=5190776.0)

One of my known person's wallets was completely drained in the same manner. He used a single address to connect several sites and had never disconnected. Suddenly, funds were transferred to an unknown wallet. And funds are gone from all of his wallet's addresses. You must therefore exercise caution when using Metamask. Use a single wallet with a single address and don't keep your money in it. Simply move your token or funds after the swap or whatever else you want to do.

The best decision in a situation like that when you think your wallet has been compromised is to get a new one. It costs next to nothing to install a new one.

Most of these sob stories flying around here about how they lost money is just cooked up cock and bull stories. For whatever reasons those who present them here do, I can't figure it out. Perhaps it's to gain sympathy of the community and their merit.

I believe what the OP said, if you just want to get a new one then create another one but not in the same computer since that computer that has your metamask wallet might be compromised. So, it's better to create it on another computer the one that hasn't been compromised but also we have to make sure that we downloaded the right app before going to install it on the computer.

There are same stories like this happened in the past so it's not that different but this should be enough to warn most altcoins user especially when using this app(metamask).

I would also suggest also get a new wallet, but if your old wallet have some valuable coins, there is a need for the coins to be transfer, what happen is a bit different because they can't pullout the other coins which has also have a value, they can only pull-out bnb token in binance network, but other coins or altcoins they can't move or transfer it, that process save my friends other token, the only reason i share it is because maybe someone have experience the same issue, since few weeks a go another friend also experience it and it drains all his bnb, its up for the reader if they will take this seriously,  but sharing info like this for me is very important since we have done an alternative to pull other tokens safely.

You should have many different wallets and each of them is used for different things: investing, trading, gambling with hidden gems or shit tokens.

A most important wallet is for investing, that should be used for investment only. With that wallet, you should never log in and use it to connect to any new, strange websites, applications. That is very risky for your main capital for investment stored in that wallet.

For trading, you can use that wallet for trading only and should not use it to connect to strange dApps, websites, etc. Similar to a wallet for investment.

For a last wallet type, for gambling with shit tokens, you can connect it to dApps, websites that you don't actually know how good or hazardous they are.

Most of these hack was as a result of clicking on any site without applying caution, I don't clicked to any link  shared with me or send to me left alone to connect my with wallet with any swap or exchange. As member in this forum him or she should be wise enough to avoid being hacked.
Now what they should do is that.. Don't associate your main wallet with any other websites or dex, if you want to swap you need a spare address were you could send fund to swap or connect with any site at this point you have avoided being hacked or compromising your wallet.

The most common hacks occur where you connect your wallet with untrusted sources and also don't revoke permission to those sites which results in draining of the wallets and whole funds in them.People see some lucrative offers on the site and click on them but the main problem occurs when you give them access to your wallets in hope of earning few dollars or without you even knowing about it.

There are many things you need to do as precautionary measures for safety of your funds and the best is not to connect your wallet on these sites and use burner address having limited funds over them because your safety lies in your hand.

The annoying part is that some of these supposed victims are already members of this educative crypto and awareness sermonizing forum, yet they allow shit happen to them. It baffles me when people throw caution to the wind once they hear or read that there's a giveaway or freebies going on. You dare connect your wallet to a site because you heard there's an airdrop going on or a mining blablabla... Then be ready to bear the cost of hacks and theft.

The problem that you described is not because of the wallet, someone knew the private key or seeds and then designed a fast bot that automatically sends tokens once it is deposited. I do not know how the fraudster gets the private key, but access to these deep information requires you to delete all the data your operating system your and start again.

This may happen not only by connecting your wallet, but also by entering your wallet seed into online site or by connecting the wallet to a suspicious site.

You give them the permission to do any transaction on your wallet if you connect your wallet on your platform so we need to be careful on those since mostly those hackers will spread out this thru airdrops that's why we need to be vigilant on all free things we see. If we can't avoid it since we love to participate on any airdrops much better for us to use only the dummy wallets available to avoid get any further damage from unfortunate hackings.

If this is the reason then all the other assets should be stolen as well right whenever if the wallet loads up with funds so this is probably due to some other reason like allowed access to x number of times instead of once.

Users who are using their metamask air drop rewards then they should always maintain a secondary wallet instead of their primary where usually they receive funds with actual value.

I guess that the bottomline from this post is that, if there are any suspicious links that are being sent anonymously by some random newbie or stranger, avoid clicking it and putting any of your additional details. One of the purpose of this forum is have an extra layer of security when it comes to suspicious links, websites, and/or exchanges. You can literally post the name of a desired exchange/website and ask for feedback if it is genuine or not.

Again, any random and suspicious links being sent by strangers should be avoided at all cost. Like what I always mentioned to similar posts like this, prevention is always better than cure. Avoid putting yourself in a situation where the risk is significantly high.

A user needs to raise maximum awareness before anything happens. Otherwise, you may be exposed to various dangers. It is your responsibility to protect your account from random and unknown sites. Connecting a wallet in the hope of a simple gain is a major loss. In this case, you have to make sure that your private information is not stolen or hacked or that you do not share it through any phishing sites. This is mostly due to the weakness of the user.

Moreover, his wallet can be accepted for hacking through various types of malware. A few days ago there was a news where a person downloaded a trojan app on the device. Once installed, the Trojan app steals $600,000 worth of bitcoins from the wallet app. This is what the Android Trojan known as "Sharkbot" does. Sharkbot initiates money transfers from crypto and banking apps to compromised devices, bypassing the verification system. Adding insult to injury, the malware also prevents its users from deleting it.
In addition to using malware, hackers often try to exploit the interfaces that connect the crypto wallet to the backend services that support the app.

At the very least a user will be able to use their device and wallet with maximum risk reduction when they use it securely. Keep in mind that downloading any app from an unknown source is risky. Especially if you have a wallet on that device.

For more info: https://www.appdome.com/dev-sec-blog/top-5-attacks-aimed-at-crypto-wallet-apps-and-how-to-solve-them/ (https://www.appdome.com/dev-sec-blog/top-5-attacks-aimed-at-crypto-wallet-apps-and-how-to-solve-them/)

Little difficult not connecting wallet access when joining many kinds airdrop right now, actually have several airdrop campaign eligible with old wallet participants but to know qualifying or not have to connect or give access to our wallet. I have prepare before accessing or connecting my wallet to airdrop need to sign in or approved wallet by using wallet without any fund yet. I don't brave when connecting new airdrop site and have fund in my wallet because we can't guarantee which one trusted site or scam.

I am interested with this points and better transferring fund to other wallet if want connected with new airdrop site, or main wallet better used for joining airdrop actually airdrop form can appear with your wallet directly.

This has happened before in MyEther wallet, when this happened, it's more likely you don't have any remedy about it because whenever you try to send some ETH to get some of the tokens in your wallet, the ETH will automatically be sent to some unknown address and I believe that's what's happening to you but instead of ETH, yours is BNB. The tokens right there is just a decoy, they purposely leave it there for others to send some ETH or BNB to be able to get it but the wallet is already compromised and there is a bot that will gonna send the remaining BNB or ETH balance to the scammer's address.

Two different crypto wallets is enough to solve this issue.

Use one to store your coins and tokens and use the second one to participate in any airdrops or whatever, the reason why a crypto wallet get compromised is connecting the wallet to a fake platform or trying to sell a fake token you get out of nowhere.

Or, users should pay more attention what they accept while connecting their wallets, they should not immediately click on "YES" or "Apply". I think nothing can be wrong if you allow someone to see your balance or list of transaction, address are transparent after all.

To all given suggestion here, I would like to add to google the information about the place you are going to connect your wallet to. Sometimes there are already "bad experience stories" on first links or pages that google search give.

what you are experiencing has often happened to a number of people here, especially airdrop participants who often connect their wallets to certain sites to claim free tokens but don't see whether the site is safe or not. so that there is malware that infiltrates your wallet or computer.

so my advice is not to store coins or tokens that have a high value in the wallet that is used to take part in airdrops or bounties. so you have to have 2 separate wallets from 1 computer to another.
so that every time you have a coin/token that has a high value, immediately move it to a second wallet that you don't use to take part in airdrops or bounties

Absolutely right according to my experience is that if you need to connect your wallet into website,exchanges etc so be careful because many people connect there wallet into a wrong website and then a hacker hacked there wallet so be careful and first of all see the website are real are not many time we connect over main wallet in unverified website so that a Big mistake and we loss our fund .

It is important to learn to separate the main wallet from the casual wallet. If you have a wallet that holds the majority of your funds be mindful of the site you connect it to, in fact, if possible avoid connecting to different sites, but rather use a separate wallet for such things.
Also, maintain the habit of always completely disconnecting your wallet from any site you visited. Little mistakes can cause a lot of havoc.

You are right Brother and also Thanks for sharing good information. This post is specially for a newbie because they have less knowledge about a wallet how to secure your wallet and also how to save your wallet from hacker.

I am sad about what happened to you buddy, thank you for sharing your advice with the crypto community, it is a big mistake to connect your main wallet to participate in any Airdrop or claim NFTs, or give permissions to malicious DApps through which the scammer can control your currencies completely, but we have to create a new wallet for that, and we do not put a lot of fees inside this new wallet so that the scammer cannot steal huge fees inside the wallet, and we have to use a cold wallet to keep our wealth away from MetaMask and others, as it is the safest.

Lot of scam project was begin to steal our crypto currency. Because crypto currency was not easily trackable one. It’s better to do background verification before connecting to any other external resource which is not a trusted one. Many people had bad stories because of connect the wallet to the unknow wallet. Even one can hack your wallet, if you connect your wallet to get some fake coins. So don’t involve in most of airdrops, many of them are scam one.

This is the reason why I often change the ETH address and even the password.
Though I have no experience from what you have maybe because I anticipate it already. If you are a long-time user of that wallet then can be prone to malware attacks and much more if exposed to huge transactions. It wasn't safe already and before that things happen, we have to take action first and send our valuable coins to another wallet (that is what I usually do). However, paying huge fees is really a burden to us.

This is an extraordinary experience and can teach us to be careful. Connecting an online wallet is indeed risky, especially when we try to connect with a certain platform that we don't trust. Or when we click on a link and it turns out to be phishing. Currently, there are many ways hackers and scammers carry out cyber attacks and steal our assets. This is just one example and I'm sure there are other ways they use it.

In my opinion, whether this is true or not, we can take lessons from all of this. We will never know what will happen next and by reading ii, we will become more aware and careful. It may not seem so believable, but the lessons that can be drawn from this possible experience are well worth it. It's true, we need to be more careful in connecting our online wallet so that we can avoid something bad happening to us. Regardless whether we believe in the story above, it's up to us. The important thing is that we learn the lesson.

Despite the bear market hackers and scammers are very actively lately and it seems we are seeing more and more people losing their coins, so we need to be extremely careful with how we take care of them, I really think that people need to do an introspection and if they cannot protect their coins then they need to simply accept it and get a hardware wallet, even if a person is only holding a few hundred dollars worth of coins getting a hardware wallet is a good idea, as it is way more difficult for scammers and hackers to access your coins when you are using one of those devices.

Hackers are becoming attracted to crypto maybe after finding how lucrative it is to take hack some wallets compared in doing traditional hacking works. Hackers are evolving and they are creating and finding new methods of hacking and beating the system. Even non-custodial wallets are being hacked just by using smart contracts, I'm assuming that sooner or later we will see new methods as we progressed near the bull market season. One thing is for sure, Hard wallets is much more secured but I'm pretty sure that at this time there are a hacker or group of hacker finding a way to also bypass the strong security of hard wallets. So even how secured hard wallets are, I believe that we still need to be careful.

When certain hacking methods had been busted up or been known the these hackers arent really stopping on finding or making new ways just to stole out peoples money.This is why its really need up that common

sense of ours to be in use so that you would really make yourself that able to avoid on getting hacked or stolen up your funds.When it comes to wallet connectivity then you arent that dumb on making out

suspicious connections or permissions which would really be causing up those huge problems.When you are really that mindful about security then dont make yourself download
carelessly anything online. Everything should really be handled out with extreme caution specially on steps and move that you would be doing.

It is quite hard to compete against a bot script  because they are activated once the BNB touches the infected wallet address.  There is a huge chance that you will be wasting your BNB trying to transfer all your coins from the infected wallet to a new wallet.  Though you would be lucky if there is a time delay set on the script implanted to your wallet address contract before it activate to steal your coins.  I think the best course here is to setup a faster bot script to compete with the hackers bot script.

Technically, your funds can't just be stolen easily if you just connect your wallet.

Not unless you provide your private keys, passphrase, or anything that can open up and access your wallet, you will be doomed.

Maybe you are also infected with malware and related stuff. Next time, be vigilant as our wallet safety depends on our own.

I think majority of airdrops doesn't work like that but you will only need to provide your wallet address in the submission form. Why not join those types of airdrops if you are scared of connecting your wallet? But, you should keep in mind that your wallet address can be exposed in public and someone can send you random coins which are shady.

We shouldn't touch those coins for our safety. Other than transferring most of your funds to a new wallet, why can't you just create a new wallet? That should save you time and transaction fees. It's also possible to know if the airdrop is scam or not by researching their name. Sometimes a scam airdrop will show a warning.

It is very important to check dApps websites before you connect - such as airdrop websites, etc. In recent times, performing some airdrops now requires connecting ones wallet to the project website, but unfortunately, some of these websites are malicious and are designed to infect/drain the participants wallet, it is safer not to even interact/approve a transaction with such websites. IMO, I prefer to perform airdrops that does not require wallet connection, moreover, you save yourself some gas fees. Sometime last year, some of us witnessed something strange in the crypto space - where fake tokens were sent out to wallets. Till date, I still receive fake tokens in my wallet. Some of the tokens will have a website in the token name suggesting that you visit the website. Interacting with such websites may be dangerous. One important thing is that such tokens are never found is CEX, also some are fake versions of already existing tokens.

Summary: I prefer to perform airdrops that does not require wallet connection. Secondly, cross check the original contract address of the tokens you are dealing with in airdrops, etc. in a place like CMC if the token(s) are already listed. Take extra measures to insure you are connecting to a good website if you must interact with such website.

It is not about being scared, it is about not even wanting them. Just because it would be free, I wouldn't want 100 zimbabwe dollars neither, because we all know it worths nothing, so why spend time on it. Most of the airdrops require you to follow them on twitter, join their telegram group, retweet their tweet, and tag 3 friends.

This is the most common thin they ask for, and I believe 90% of the ones we have right now worth nothing at all, so why would I do those things for free? They believe that they can grow it and make it bigger thanks to your help, but I know that it won't and that means I worked for free and that makes no sense to me at all.

I think the most dangerous part of connecting your metamsk wallet is to a new domain which is registered most recently and is not listed as trustworthy by ratings sites. One such experience is with the NFT website. The trend did not followed because it might have been worthless attempts by hackers to steal but they used to connect the wallet on fake NFT selling sites and promising the ownership transfer. However, that was just worst way to lure people into the trap and it was actually taking the coins from you and never ever talked about the trade as well. It's funny that hackers could go to any extent to get some extra bucks.

However, the point here is there could be millions of ways to loot us, but one should have their personal discipline as to where to connect your wallet and where to ask legitimacy questions before proceeding.

I had also connected my Trustwallet to many websites, although that was Trusted. And we can reduce this risk, through revoke cash website, which means that we can reduce the risk of being connected to other websites. One of my friend's PC was hacked and all of his funds were stolen, so revoke cash website will be a better option after all these.

Some airdrop project eligible for old wallet or have reach many transaction and I don't think used with new wallet will eligible earn airdrop coins, I have one trick after connecting with new site of airdrop few hours later revoke with all connecting seems not trusted. Usually on BSC coins receiving have warning with scam coins but I understand all if problem with dusting attack token.

I can protect my wallet from dusting attack and I know which one scam coin arriving in my wallet but I don't sure when connecting with dapp exchange actually with new dapp airdrop keep my wallet secure or not, every day active joined with many kinds of airdrop and I don't remember about which one airdrop site trusted or scam because looking on website secure and not the website of airdrop looks like nothing suspicious.

Many cases happen that we put blame because our wallet is connected to many websites which is also possible. Hackers can simply wipe out your funds once they got access to your PC especially if you are using an online wallet. We should have to avoid this kind of doing. Extra precaution is really needed to keep safe of our funds and we don't let these scammers take our hard-earned money. Though we know it was a trusted website still we can't assure that we are safe, better if we have to hesitate about the possible things to happen that being sorry later.

These are unwritten rules. It is money we are talking about, we have to take extra cautions of risks involved regarding important informations and that includes website that you access on a daily basis which could endanger your assets or wallet itself.
Problem is; if your infos leaked, it would be hard to retrieved especially if your assets were already stolen. Reporting it would cost you time proving that ut is really stolen. Prevention is always better than cure. Some are even double checking the spelling of the website they are accessing 'coz there are fake platforms mispelling the known one by single letter only. Once you've input your infos, everything's done for.

If you don't remember where you connected your wallet, then you just need to check it and revoke the dapps website that was connected. Use a website like unrekt.net to do a revoke, the website will provide information about where you have been connected and at the same time revoke the address so that it doesn't become a place for scammers to exploit your wallet. And to prevent unwanted things from happening, before connecting with any dapps, it's a good idea to check whether the dapps are safe or not by looking at other user information.

I've tried using Metamask before and found out that as you can easily link and connect it to other websites, the easier you'll also get hacked by phishing sites so you must think before you click and be observant as you will be targeted by scammers and hackers so as much as possible, store your funds in a more secured personal wallet. It's better to be skeptical than to lose all your funds.

We have to protect the wallet that is connected to a suspicious project, so we have to disconnect the wallet immediately after finishing using the features of that project, but it is recommended that we use an alternative wallet to connect with any project because the access to the wallet connection will provide opportunities for hackers to find bugs so that access our wallet and steal all the assets we have in that wallet

What are you trying to say? I'm using trustwallet and the experience the OP share had happened to me early this year. I can confidently tell you that my phrases are highly secured but I don't know how this things are happening. When I checked the transaction time, both my phone and my pc were in my possession. Was just wondering and no option than to transfer out the rest of my assets. Mind you, I don't actually subscribe to ideas of connecting wallet to strange sites.

^This is fine if you don't save your private key on the computer or a device that you frequently use.
This is what I usually do when an exchange wants to connect your wallet to them, just create a new wallet that is intended for that exchange and transfer your token and send a little amount of ETH for the gas fee, connect your new wallet to them and your main wallet is safe from linking to them. Though this process will probably have an additional cost for us at least we are safe from hacking. However, connecting is not a problem, but if it asking for your private key, that is a big problem.

There are some airdrops that require us to connect the wallet.
And if that happens and becomes one of the requirements for getting tokens or coins, I will think several times about doing it.
- If the project is new and still in doubt, it's better to leave it.
- If we have doubts about the project because many say it is good but some say it is doubtful, then leave it.
- If the project is really good and the team is proven to be real, then we can follow these requirements. However, don't use our main wallet. It would be better if we use a new wallet to connect it. If not allowed, then leave.

This is a matter of assets and money, so we must be more careful to avoid things that we don't want or expect.

Metamask is open source, but Trust Wallet is not. Metamask wallet is way more encouraged to be used in many degrees.

Talking about digital security, in this case, the wallet itself has lesser significance compared to the user's digital security practice. Both wallets without a doubt is widely used and for sure many hackers keeping an eye on them, but, a more approachable weak point is the user itself who doesn't have thorough digital security knowledge to store their own cryptocurrencies safely.

Yes.  I have also experienced something similar to what you are experiencing.  Indeed, I admit, this instantly steals the coins we have.  so I immediately created a special wallet that I don't use carelessly (connecting to a web that we don't know)

Here, perhaps, the reason is that when you connected to the site, you provided excessive permission to use your funds. In this case, it was enough to check the list of connected sites in the MetaMask settings and disable suspicious sites.

If someone is not skilled enough to avoid getting a virus on their computer or connecting to a malicious site then it is unlikely they will be able to use a faster bot than the one implemented by a hacker trying to steal their coins, in that case it would probably better for those people to just wipe their computer clean and make a fresh install, get a wallet from the official website and transfer whatever coins they have left from their old wallet to a new one.

There are to many Phishing sites and apps that sets traps for stealing our money , in world of crypto we are the owner of our funds and for any mistake only we are responsible for loose of funds , and we know that in crypto there is no any rule of reversing transaction ,
So my advice is keep you real wallet on which our life saving and big investment present keep them offline and use a second wallet for active small amounts and if you are Airdrop hunter or participate in bounties then you are on high risk separate your primary wallet .

Yeah, most of it were just worthless and I even recall one airdrop team trying to even phish my MyEtherWallet back in 2018. I used the unsecured method of storing coins which where they provided the wallet file and gave me what I needed such as the phrase/seeds and the private key.
These airdrop scums are just looking for the obvious free advertisement and it is the reason why I started thinking that they are not worth my attention now these days.

Let me quickly share a related experience to this topic I had a few days ago. It was a random female user on telegram (that was the claim but I knew it was a male at the other end) who tried talking me into a passive mining engagement. I blatantly told him it was a set up but he wouldn't give up. He continued talking to me until I feigned interest and obliged him. The mining app was a Tronlink wallet for me to download on playstore since I use an Android phone. I already had one, so I opened a new account on the one I already had and told him I was set. The next thing was a mining link he sent. It was a suspicious one and then I reminded him of what I thought about what he was trying to lead me into.

I'm sharing this here so that newbies will understand that these scams come in different formats. See my chat with the said user. Be wise, newbies. No free money anywhere online. I had to blank out part of the link so users won't be tempted to copy it out. Take a look at the url, there's nothing related to Tronlink in there. I'm cocksure if I had clicked on it it would've directed me to a scam. Besides, read carefully how he denied knowing anything called malware. In this time and age, does anyone online not know what is malware let alone someone who claims he has a mining gig. It's a red flag when people deny knowing a popular thing you accuse them of.

https://i.imgur.com/Dl5iSbi.png

Part of common sense that you would really be eventually be needing to ignore these stuffs since you could really already notice it out on where these things would be going.If you do have that sufficient
experience and awareness back into those previous years on how phishing and hacking do happens with those wallet due to random downloads and other stuffs into your device,
then you would really be definitely be ending up on a disaster. Better make yourself stick out into those known and popular wallet rather than on downloading
on something which hadnt been heard before and on something that random people do make out recommendations.

Recently there are some sites, which give free Nfts, like (the football world cup Nfts, etc), that are worth around 10$ each Nft for free. So, people think that it is free and that we are getting 10$, but in meantime, they hacked the wallets. which are connected to their website. So, I think we should aware of such stuff if they are even giving it free.

When a trend starts in the market, scammers use that trend to scam. Connecting the wallet to any unknown website is very risky, they create those tempting traps to steal the crypto user's wallet info so that they can access the crypto user's wallet.

If you know details about such websites, then you can make a list of them and post them on this forum, this will alert many crypto users. Because I also get such offers every day through various channels including Telegram, since I am careful enough about these things, I have not fallen into such a trap so far. But new crypto users fall into these traps all the time.

So many scam tricks come out this time and if we don't use our common sense, it is surely we gonna fall into them.
That is why I barely do online communication, especially in telegram and I don't reply to random people messaging me talking about investment, etc. Unless I expect that person to message me.

We have to know that the security of the wallet comes with us, and the way we handle it. If we are too careless, no wonder why we lose control of it and lost our money.

That's the trap, people like and rush if they read the magical word - "free".
And that's why these scammers and hackers are taking advantage of it and making it a trick to those people that are not careful enough how to take care of their wallets. So, they create websites where the victims can claim it and has to connect their wallets, and there it goes.
Just giving access to the hackers and not reading if it's a condition that allows the hackers to give them access.

MetaMask can happen if you’re not careful when you’re using the wallet to make transactions. There are also potential security issues if you decide to use another wallet as well.

One reason why your funds could be stolen would be because you have connected your wallet to an uncertain status, such as when you’ve claimed an airdrop on an exchange website that hasn’t been verified or confirmed yet.

By connecting your wallet with this type of website, it could leave open a vulnerability for hackers to exploit and steal your funds from your account. So, always check connected site in Metamask.

Right, don't be too easy to connect wallet, now too many scam programs will steal assets when we connect, do not believe in the token in the wallet that we do not know, usually they include a website to connect the wallet, and we can be sure after the connection then Our assets will be stolen.

I appreciate your concern regarding awareness of wallet security. I share my technique to secure wallet.
Always keep long holdings in a separate wallet and log out.
Make a new wallet and use it for other purpose like airdrop campaign and
also a separate wallet for connecting staking dapps etc.
Never keep your password and seed phrase on any gadgets.   
 

I had experienced the same incident as @ op because when I checked the wallet via trust wallet on my Android, I saw a transaction out and sending a token to another wallet. I don't know who the wallet is and I don't have to send anything from my wallet to another wallet. This forced me to move all my assets on the trust wallet to other Android phones I did not use. And thankfully, until now, I have not experienced that incident anymore.

I advise you not to open a website link in a browser integrated with a trusted wallet or another wallet if you don't know for sure.

Sometimes we really can't resist the desire to get free money, so we often forget to do research first about its validity so that we end up in a scam. If we want to do this, never use a wallet that contains valuable coins because it's easy to make a wallet on metamask, so it shouldn't be a problem and if we have to have coins as gas, then just a little left over according to what the need, I think this can reduce our losses

Always great when you dig in for us to educate some of the people here from the scammers like that person in the picture.

Although of course, if people reads this post has some basic common sense. You should not even trust and click any random links sent from strangers on any social medias especially telegram and discord where those two are full of scammers nowadays especially when you are joining some crypto servers. Always be careful with whatever links to you, it might full of malware or just let you connect your wallet to random stuff out there.

The way I was hacked was not because of connecting my wallet to unknown websites. I was just stupid enough not doing my due diligence in not double or triple check the Telegram handle whether if that “dev” member is real or fake.

That was last April 2022. I accidentally clicked that fake PDF which is the malware and I fell for it. As a result, I was hacked $12k of my total assets and it’s probably the very worst experience I have in my crypto career.

I could have not recovered emotionally until today if I am not in a better position in my crypto career or a guy who has no reputation and starting from scratch. Thank God I’m just glad that I positioned well thanks to what I have built tirelessly during the lockdown days.

I’m still on my way to fully recover all what I have lost, but I’ve decided to do much more than being contented for what I have. So I was doing business travels starting a campaign for Web3 adoption in some islands in the Philippines.

I’m still in good hands until today. I moved most of my assets into cold wallet like the Ledger Nano S.

It is necessary to separate 2 concepts: This is the connection of the wallet and the interaction with the smart contract. In the first case, site administrators will see your IP address and wallet address. But if you make transactions in the hope of getting free NFT tokens, but in fact it will be a fraudulent smart contract that will gain access to your assets, then you will lose money. For such cases, you need to have a separate wallet.

I believe that most hacks occurred at that time given that it's bull season, Hackers are becoming active because there are many newbies who don't have any idea how to secure themselves. Even seasonal crypto users like you where hacked, This means that even you are a good idea on how crypto and hacking works, It is still possible for you to be hacked if you become over confident in terms of your own security. I haven't experience any hacking incident that greatly affects me today but I'm still being careful with my assets. Storing it on a hardware wallet is a must even if it is bull run where it is expected that our assets will be moved/transacted from time to time.

Before connecting make sure to do some research however it is very important,
scams are everywhere and we must always be careful,
small mistakes will make our assets stolen so we have to be wise

When free money is involved so many people tend to forget what they're supposed to do.
Some don't even care to second check the website that they want to connect their wallet to.
While others become blinded by the money that they would even neglect red flags and still connect their wallet risking their funds to be stolen.

You can probably lose all your funds with just one wrong click. Nowadays, scammers are targeting wallets with weak security so it is necessary to double-check every link that you're clicking or linking in your wallet or as much as possible, try not to connect anything to it. Scammers can easily create fake domains so you better be observant. Hackers and scammers are being more active especially now that the holiday season is approaching. Your wallet is your personal responsibility so you need to be vigilant so you can keep your funds safe and try not to fall for hackers' trap.

It is good that you will carefully check the sites so as not to become a phishing attack, but you will not be able to check every smart contract. Therefore, the best option would be to create a separate wallet for each project or cancel the approvals for each project.
https://bitcointalk.org/index.php?topic=5227888.msg59615169#msg59615169

This is what fraudsters always use to lure their victims to connect with something they have to check whether the site is really safe or not. What happens is they (who are deceived) experience unwanted things because of their own carelessness, which they can actually anticipate if they are more careful.
This is actually basic knowledge that must be known when using a wallet. But yes, back again when someone is tempted by nominal money, they will forget things they shouldn't do.
I'm also not one to never connect my wallet with a particular site, but I always do research whether the site is really safe or not. Or even if needed I always use a new wallet even though it is very safe to minimize risk.

I have been in crypto for a while now, and for many many years I have managed to protect myself, and yet again I did it recently as well but this time around I made a mistake. This shows you that you could be here for a very long time and you could still lose money and make a mistake, it's just about our days, some days we are just too tired and could not function properly, or at least our brains do not function properly.

I connected my metamask to some weird website, all because I wanted to try to play a game, and I couldn't play it, and a bit later I figured it was a website that had no game, just wanted you to connect so they could empty it. Glad I realized it and disconnected quickly enough that they didn't even attempted to empty it yet.