toyo87 (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 738
Merit: 100
Follow on Twitter @realToyoTheo
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 22, 2021, 06:59:52 AM Last edit: February 22, 2021, 07:27:11 AM by toyo87 |
|
My MetaMask Wallet was #penetrated and all valuable asset swapped through the "MetaMask Swap Router" contracts and all my ETH was depleted to ZERO BALANCE. I have checked my wallet on connected App and I found out MetaMask Swap Router is connected. This was not authorized by me. And For my #ETH to be withdrawn to ZERO balance, this is not an outside attack on my wallet. My wallet address: 0x6e82Dfba66Bb9E55E287A1B98C2179Acd94d5C3c Screenshots of my wallet. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FSKxqNB5%2FScreenshot-20210221-195900.png&t=665&c=_p07eNW87haGbA) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FyQkyHn8%2FScreenshot-20210221-200042.png&t=665&c=9ZRkyKomBMSY5A) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FWBggzwt%2FScreenshot-20210221-212428.png&t=665&c=wLlIZof06FgJGg) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FPFpWW8J%2FScreenshot-20210222-075308.png&t=665&c=XAVX5E0lDMvj2g) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FPrrFMyY%2FScreenshot-20210222-082516.png&t=665&c=c9zHF315DwtZgA)
|
🧬⛓Blockchain ENTHUSIAST and EVANGELIST🎊. Crypto Investor💻, Miner🧰, Trader👨💻. Project Ambassadors👨💼, Community Manager👥, Blogger🥳 & MORE.
|
|
|
makishart
Legendary
Offline
Activity: 3122
Merit: 1029
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 22, 2021, 04:51:02 PM |
|
Im sorry for your lose but you should learn if metamask has a lot of bugs and it seems like the hacker has access to your wallet. Metamask is the crap wallet that ever exist in ethereum ecosystem. You should never use this again. Move to the mobile or desktop wallet.
|
|
|
|
Mighty_crypt
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 784
Merit: 21
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 22, 2021, 06:53:19 PM |
|
Should we blame metamask for this? I don't think so, for the fact that you are using any crypto wallet as plugin/add-on on your phone makes its so unsafe, you have no idea what's lurking around browser plugins and add-ons, I've seen the worst and I knew that add-ons are safe, I'm using metamask but that's their mobile app only, sorry for your loss
|
|
|
|
agustina2
Legendary
Offline
Activity: 2436
Merit: 1008
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 22, 2021, 08:49:20 PM Last edit: February 22, 2021, 09:00:15 PM by agustina2 |
|
My MetaMask Wallet was #penetrated and all valuable asset swapped through the "MetaMask Swap Router" contracts and all my ETH was depleted to ZERO BALANCE.
With the high gas price, why the possible hacker will do some transfer by batches if that can be done in a single transaction. What research have you already done on that matter?
|
|
|
|
batang_bitcoin
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 22, 2021, 10:16:58 PM |
|
Maybe you've become a phishing victim and input elsewhere your private keys or json file to that phishing link. If not, that router, it's the first time to hear it although I've used Metamask a few times but didn't have any chance of using it. Is that another third-party add-on for the wallet that you have downloaded? the possible chance that you've lost it because of it is high.
|
Rent this sig space so that BTC goes to $100k.
|
|
|
TheUltraElite
Legendary
Offline
Activity: 2968
Merit: 1311
So anyway, I applied as a merit source :)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 06:55:40 AM |
|
Im sorry for your lose but you should learn if metamask has a lot of bugs and it seems like the hacker has access to your wallet. Metamask is the crap wallet that ever exist in ethereum ecosystem. You should never use this again. Move to the mobile or desktop wallet.
I dont think that is the case. OP has probably been a victim of a phishing scam. These are too sophisticated to detect only from the transaction data posted by the OP. Even then, let me ask, did the OP click on any suspicious link in the last 6days - because that is when these have started. Logging in from a hacked extension can also be the case. There is only one legit Metamask extension and hackers have attempted to hijack systems running vulnerable software to get access to them. Metamask itself is not the problem. OP might be running a older version of the OS and older vulnerable version of a browser, maybe not on their phone but on other devices.
|
R |
▀▀▀▀▀▀▀██████▄▄ ████████████████ ▀▀▀▀█████▀▀▀█████ ████████▌███▐████ ▄▄▄▄█████▄▄▄█████ ████████████████ ▄▄▄▄▄▄▄██████▀▀ | LLBIT | │ | CRYPTO FUTURES | | | | | | | │ | 1,000x LEVERAGE | │ | COMPETITIVE FEES | │ | INSTANT EXECUTION | │ | . TRADE NOW |
|
|
|
toyo87 (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 738
Merit: 100
Follow on Twitter @realToyoTheo
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:16:00 AM |
|
Maybe you've become a phishing victim and input elsewhere your private keys or json file to that phishing link. If not, that router, it's the first time to hear it although I've used Metamask a few times but didn't have any chance of using it. Is that another third-party add-on for the wallet that you have downloaded? the possible chance that you've lost it because of it is high.
I have done thorough research on my meatball plugin and there is no record of me connecting to new site nor connecting to metamask swap router, but on Etherscan Approve Checker there is record of metamask swap router. When I check the penetrating address, it is still stealing from other wallet as of 24hours ago. Leaving zero balance ETH on all the victims. Not even a gwei is left.
|
🧬⛓Blockchain ENTHUSIAST and EVANGELIST🎊. Crypto Investor💻, Miner🧰, Trader👨💻. Project Ambassadors👨💼, Community Manager👥, Blogger🥳 & MORE.
|
|
|
slaman29
Legendary
Offline
Activity: 2744
Merit: 1249
Livecasino, 20% cashback, no fuss payouts.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:18:00 AM |
|
I've to admit I'm not technical enough to understand what happened but if it is true that there was no tampering then the most likely explanation to me is that someone got hold of the seed phrase and simply just restored the wallet somewhere else and used it from another device?
|
|
|
|
toyo87 (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 738
Merit: 100
Follow on Twitter @realToyoTheo
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:21:15 AM |
|
The process of the attack on my MetaMask Wallet. 1. My wallet received 0.02ETH from unknown address. 2. My wallet immediately trigger a contract. 3. 0.039879773752756ETH withdrawn to the unknown wallet address. 4. The unknown wallet address sent several ETH to my address again. 5. My wallet trigger the same contract again. 6. My wallet then trigger the MetaMask Swap Router and swapped my 500 SWAP tokens for ETH. 7. All available ETH on my wallet was withdrawn to the tune of 0.71517927781594 to the same unknown wallet address. MY OBSERVATION: This is not an outside attack on my wallet but inside job/vulnerability on MetaMask wallet. If it was an on my PC, there will be no need for the person to send me ETH and then connect to a Contract, and then send ETHs again and then Swap valuable Token on MetaMask Swap Router and then withdraw all available ETH to the extent that there is no single GWEI in my wallet. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FKWXCgwG%2FFB-IMG-1614010479965.jpg&t=665&c=2jfBZ5h07cwoiw) #MetaMask #StaySafe #Vulnerability #MetaMaskIsNotSafeForNow
|
🧬⛓Blockchain ENTHUSIAST and EVANGELIST🎊. Crypto Investor💻, Miner🧰, Trader👨💻. Project Ambassadors👨💼, Community Manager👥, Blogger🥳 & MORE.
|
|
|
toyo87 (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 738
Merit: 100
Follow on Twitter @realToyoTheo
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:23:33 AM |
|
The address that attack my MetaMask wallet, is still going on penetrating other wallet and withdrawing their ETH to ZERO balance.
|
🧬⛓Blockchain ENTHUSIAST and EVANGELIST🎊. Crypto Investor💻, Miner🧰, Trader👨💻. Project Ambassadors👨💼, Community Manager👥, Blogger🥳 & MORE.
|
|
|
toyo87 (OP)
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 738
Merit: 100
Follow on Twitter @realToyoTheo
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:24:32 AM |
|
On your end, MetaMask wallet Plugin keeps records of all web3 sites and dapp your wallet have connected with.
Finding unrecorded connection through Etherscan (which is not recorded by your plugin), shows the wallet is Vulnerable.
I am keeping records of every review and screenshot of my findings on the MetaMask attack.
|
🧬⛓Blockchain ENTHUSIAST and EVANGELIST🎊. Crypto Investor💻, Miner🧰, Trader👨💻. Project Ambassadors👨💼, Community Manager👥, Blogger🥳 & MORE.
|
|
|
OasisDre
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 532
Merit: 41
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 10:07:19 AM |
|
The question is how did the swap router get connected on your app without your authorization? This is weird, is metamask team behind this attack? Have you try reaching out to the team? There is no reason for the team to steal that amount of tokens this way, get in touch with the team and hear them out
|
|
|
|
batang_bitcoin
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 23, 2021, 09:27:23 PM |
|
Maybe you've become a phishing victim and input elsewhere your private keys or json file to that phishing link. If not, that router, it's the first time to hear it although I've used Metamask a few times but didn't have any chance of using it. Is that another third-party add-on for the wallet that you have downloaded? the possible chance that you've lost it because of it is high.
I have done thorough research on my meatball plugin and there is no record of me connecting to new site nor connecting to metamask swap router, but on Etherscan Approve Checker there is record of metamask swap router. Well, then you know who's the suspect for the stealing of your funds. Be careful on downloading plugins because there were posts before that everyone should be careful with such. It's a very important thing that you should know what you download and always be doubtful to use it if it's not familiar or popular. I've used Metamask before and it's just smooth but without downloading any other plugins. If the vulnerability is with Metamask, there's no need for you to stay on it, and sad to say that there's no way to get back what was lost to you. When I check the penetrating address, it is still stealing from other wallet as of 24hours ago. Leaving zero balance ETH on all the victims. Not even a gwei is left.
Whoever is behind it, he will not stop as long as there are possible victims he'll get.
|
Rent this sig space so that BTC goes to $100k.
|
|
|
|