Mnemonic is no longer safe?

[chaser15]

Mnemonics are completely safe. It can't be hacked or something that easily unless of user's fault. Maybe OP's friend is not just aware that something happened that leads to unauthorized access to its wallet. They should start looking at the main cause of the problem on the device used as it might be potentially harmed by some malware. OP's friend might also be a victim of phishing.

That case can't just be assumed right away that it's because mnemonic is not safe.

[Sarah Azhari]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.

that mnemonic is safe, depending on how you keep it save. I've experience hold my token about 3 years by keep only mnemonic seed on my flash disk. maybe in this case your wallet have malware or any virus who can access it. so don't keep mnemonic online again and use open source wallet.

[inanilujimi]

What token or coin has the address taken??
Has your friend's wallet address previously interacted with Smart Contracts or 3rd party websites??
because as far as I use Mnemonic there are no problems with the altcoins that I have.
I've also lost assets of around 500 busd because I've interacted with smart contracts that are designed to drain the contents in your wallet when you interact with them.

[GatotKaca]

What token or coin has the address taken??
Has your friend's wallet address previously interacted with Smart Contracts or 3rd party websites??
because as far as I use Mnemonic there are no problems with the altcoins that I have.
I've also lost assets of around 500 busd because I've interacted with smart contracts that are designed to drain the contents in your wallet when you interact with them.

yes, I saw some people who posted lost their tokens in the telegram group.
even the case experienced is the same as what you are experiencing.
we can see quite a lot of fraud tokens in our wallets. so if we suddenly get a token that we don't know about and it turns out to be quite expensive. never expect it to be an airdrop. it will drain the tokens we have in the wallet.

[danherbias07]

I'd ask him/her more questions if I were you.
Like where did he save the seed phrase? Was it on the computer? E-mail? Cloud? Or just written on a simple piece of paper which is the safest of all.
How about phishing? Is he honestly telling you everything? How about checking his browsing history?
There are a lot of ways now being done by scammers and hackers to gain access to your accounts.
I never had a problem even in Metamask or other wallet services like Trust Wallet even though it's not recommended to keep your funds there.

[glendall]

mnemonics should be very safe
I've experienced this, and I realized that if I was connected to a site that was infected with malware, I just didn't know which site, and for the safety of my wallet I left it and threw it away from my cellphone and computer.

[Punakawan]

I think Mnemonic are safe because many wallet like metamask, Trustwallet we create a new wallet so we use mnemonic through we create so mnemonic are safe way but some time we save mnemonic in that file are email etc which are hack easily then hackers easily open over wallet so secure your system other than mnemonic phrase are safe.

Every security, of course there is a small case that is common, this is natural because it is impossible for all perfect wallets, but whatever the team has done is a big thing that makes everything easier and if a case like this happens massively, of course we can say it is not safe .

[Zhi Wei]

Hello community thank your for great discussion.

The address keep active with same activity.

I saw ENS domain

-  080995.eth
- sircryptoofblock.eth
- dmuz.eth

If  you're own the domain, might you want to share please.

Let this thread being an archive, in case I found the main problem or gap. will share here.


I found owner dmuz.eth

https://twitter.com/DMUZNFT/status/1583004596204863489

[tsaroz]

I have been hacked twice using mnemonic phrase through metamask. Can't be sure of the reasons both time. After the first hack, I was too cautious not to make any mistake. The only way of my mnemonic phrase being stolen is, I once loaded my wallet in a PC using a pirated/cracked windows os. I can't prove it but I had no other ways of getting it stolen. I was too cautious and had always used a legit OS and it was once event to load my wallet in different PC and just after a week of incident, my balance was stolen. So everyone should be sure that they are not using pirated softwares while dealing with wallets.

[justdimin]

What token or coin has the address taken??
Has your friend's wallet address previously interacted with Smart Contracts or 3rd party websites??
because as far as I use Mnemonic there are no problems with the altcoins that I have.
I've also lost assets of around 500 busd because I've interacted with smart contracts that are designed to drain the contents in your wallet when you interact with them.

yes, I saw some people who posted lost their tokens in the telegram group.
even the case experienced is the same as what you are experiencing.
we can see quite a lot of fraud tokens in our wallets. so if we suddenly get a token that we don't know about and it turns out to be quite expensive. never expect it to be an airdrop. it will drain the tokens we have in the wallet.

If we take the question at hand, then we can easily say that we are not going to get our mnemonic cracked or anything like that, it's impossible and the power that is required to crack that would be bigger than any server I know of, and if anyone could have done that then I would assume it would have been the famous big wallet of satoshi and not some 300-400 dollar account.

However, about the fact that it was cracked into and money was stolen, I agree that some token situation, or some other way it was designed to get the owner participate a bit was involved, that way they could socially hack your cooperation and then get it directly from you.

[mdzahed134]

I think there was no fault with mnemonic/seed phrase/private key, it’s happened for malware in your friends computer most probably. Somehow his PC was compromised otherwise it will never happened. Mnemonic is of course if you can keep it in the safe place, i don’t keep store any wallet private key in the online.

[TheGreatPython]

I never heard of Coin98 Wallet, and upon checking it out, it seems there is no source code available. Its availability is also only on Chrome.

Mnemonic code generation by a popular and trusted wallet is fine. The seed generation process is secure as it widely can be viewed by those who understand. Until this time, A popular wallet user is safe from any mnemonic code vulnerability that I'm aware of.

The possibility of your friend getting hacked due to personal security issues is more likely than a standard process of mnemonic code generation and potential collision. So without knowing your friend's digital hygiene, it is hard to seek the actual reason for it getting hacked.

Coins98 was once in binance and then later on I just saw they have their own wallet. They are not new though so I think it's kinda trusted. I even created one in my browser extension only for airdrop purposes but I never received my coin on that airdrop that I join but I know it wasn't the fault of coins98. Maybe I am just unlucky.

OP said that malware is the primary suspect for the hack so by there, I think his friends so called "digital hygiene" are not that clean enough and maybe he likes to visit random websites and connect his wallet there. It's also possible that he downloaded the fake version of the wallet since this wallet isn't that popular as the other so the original version may not have that small blue check yet.

[Minecache]

I'd ask him/her more questions if I were you.
Like where did he save the seed phrase? Was it on the computer? E-mail? Cloud? Or just written on a simple piece of paper which is the safest of all.
How about phishing? Is he honestly telling you everything? How about checking his browsing history?
There are a lot of ways now being done by scammers and hackers to gain access to your accounts.
I never had a problem even in Metamask or other wallet services like Trust Wallet even though it's not recommended to keep your funds there.

I assume this problem is user-side and not Mnemonic or insecure private key. Most likely his friend was negligent in the process of using it, like the computer was infected with a virus or connected to strange dapps and did not revoke the connection...there are many reasons for property theft.

I'm also using metamask and trustwallet on my phone, so to say I've been using that wallet for 5 years and never changed to a new address but I haven't had any unfortunate problems. Security is the most important thing when entering the market, everything will be useless if we do not know how to protect our assets from hackers.

[goinmerry]

Your friend doesn't tell you everything. It's technically difficult to hack a wallet because of mnemonic problem.

It's on the user side I guess why that unusual activity happened to your friend.

And next time, try to use another reputable wallet and not the mentioned one by you as I didn't aware of it.

[Kadal Ijo]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.

My friend just got hacked, lost about 300-400 USD.

He wonder how it happened, make some probably the device was infiltrated by malware, if yes. All his key is gone(all), so there's no only 1.

He was generated Mnemonic by coin98. Never connected to MetaMask or some things like login to connected, never.

Address land to "0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82"

0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82 has lot network. There's 5 I found. https://blockscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

ETH  https://etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
BSC  https://bscscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
Poly https://polygonscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
OP https://optimistic.etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
ARBI https://arbiscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

Take a sample :

Code:

	Txn Hash	Age	From		To	Value	Token
0x3cf166bd6c86b610162daa81f1cbc3dba78383fdd6399eac3091f1e1266158e6	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1,000	DEXTools (DEXT)
0x12449d639d36ff5360bf2ef507175ac0d2d7ee4b28397f0841d7b7760fe9cd00	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.124008	Wrapped Ethe... (WETH)
0xe11c041c8a3a34cb4c3127ef16c9ac42c144d76a825c962998187634d13cbae3	1 hr 33 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.02358337	Governance O... (gOHM)
0x1f56d27daaf2eb9ea62a34488a52ba1290f67c5c69bff3e1470a20466861a031	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	16.55468149	Ethereum Nam... (ENS)
0xec5390bed60aec9deeea96e9518b20b21959a1e5a03eaf983008616656357ce1	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.5	Wrapped Ethe... (WETH)
0x4486b49d823e35d72194cfb1103dff731d917ecc302e0c39f1feced1d0cad3df	1 hr 35 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	166.78365256	StargateToke... (STG)
0xd80d62c04f17f25d7481acfc2b10e7358337751580991b26031083386ee2ee37	1 hr 54 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.09542125	Wrapped Ethe... (WETH)
0xf3bb3f7954b5b85bb4d9dd3d691d72fd1eb8cc18be23c55440bbb52a31fa87bb	1 hr 59 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,325,000	 ERC-20: Met.....yAi
0xd9c4a28c70c551b251876cfa94d0d66181a925f1fd5e75b550ea547ecfd412a1	2 hrs 1 min ago	0x3e99ef9745c7174ef20639b1035b79ed1b8a085e	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	250	Polkastarter... (POLS)
0x19a9516e5dfc3695edfdba696ae2b6527f9384e7e286acd48569a9cd6242eae3	2 hrs 5 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.507535	Wrapped Ethe... (WETH)
0xda35ffcb30ebe56c4e3e5303170dfc12ab313bdf653c8b4c4752aecd37d3019d	2 hrs 10 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.54064217	Wrapped Ethe... (WETH)
0x94d3ad9ea80dc5df577fa37f25383e049aa98f76715f8df922ad8b51b4bd7663	2 hrs 17 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.8296811	Wrapped Ethe... (WETH)
0xef4e4413bb3535c78bce921f9d05814961c3a9b14aa3ace872ac51de20e80644	2 hrs 37 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41.99255724	Olympus (OHM)
0xf0b29887ad526399f291462a4b3eef4283001037a3547f5c030b59ccb52fd00a	2 hrs 38 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	92,976,341,396.66919415	The People’s... (PEEPS)
0xa752e2a30cfdc25107013f9ea2338f2b0eb55ac423762c8a614a08fe6c9d8188	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,810,550,290,956.5476974	Bezoge Earth (BEZOGE)
0x7039964c4e99532c75aada210d1d81d7231bc49d7fe268fff4a69d3711e1fdb2	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41,267.59937671	MintySwap (MINTYS)
0x08aed967fba449b94e5ff4536fba07d25f8ae1a67ff956781dd1e1aedea81bdc	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	49,999.99999716	Falcon 9 (F9)
0xa2223addbef9999d87140a013e751b443bbdde4d459ed6b345b6d925e92aa81e	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	80,462.26	ACCEL (ACCEL)
0xd012dc1d82c7f8cb602a0e1b9d4b0295691431b4aac90c6e5ef0e497e2432769	2 hrs 57 mins ago	0x8090b15679d7b67625f5655883a7e42fad1adffa	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22792	Wrapped Ethe... (WETH)
0xd33bb3f40d8ad5158c5798ea0cf5ea680779a18ee3bf7b7e4f11018ffdb948a0	3 hrs 2 mins ago	0xe9c14ea0d6e9aaa7c58774b05cc6f455cc506bda	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	246.6231	Ultra Token (UOS)
0x56909ca1b3b820959a45daa3792c7002d7786be28821b0f3c32e006761ce4de4	3 hrs 5 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	501.793375	Litentry (LIT)
0xfbd778310d2b08c183a564de912355cf6c923b27e2fa4bd5cbc17be0ae101fc7	3 hrs 6 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	413.79544305	StaFi (FIS)
0x75f905d63f8725364e6feb94d2502e0f98b0890e4fa816a8db3dc838d7d92f08	3 hrs 9 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	15,136.99488655	LooksRare To... (LOOKS)
0x5f4ec7cd2719489b1153f84c72ffca0d4e152945d4848c8f0a2eabc61f8c257b	3 hrs 10 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	7.92	Staked Aave (stkAAV...)
0x1b76784ae516a45d3cd0d73b81e5235b9c32aedc7f84f8290700887050e8810a	3 hrs 12 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22316481	Wrapped Ethe... (WETH)

All those sender is sending all assets to 0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

I been research possibility:

I mean theres tons of addresses out there so its like how could you not hit one

Because there are this many possible valid 12 word seeds:
340,282,366,920,938,463,463,374,607,431,768,211,456

Like I said I'm not an expert, just want to share. make this thread as archive in case there solved or new case found.

All wallet techniques certainly have a weakness, but what I see is not a weakness of Mnemonic, and I'm sure like that random technique will not be applied to other hack wallets.

[vv181]

~
The possibility of your friend getting hacked due to personal security issues is more likely than a standard process of mnemonic code generation and potential collision. So without knowing your friend's digital hygiene, it is hard to seek the actual reason for it getting hacked.

~
OP said that malware is the primary suspect for the hack so by there, I think his friends so called "digital hygiene" are not that clean enough and maybe he likes to visit random websites and connect his wallet there. It's also possible that he downloaded the fake version of the wallet since this wallet isn't that popular as the other so the original version may not have that small blue check yet.

OP never stated malware is his primary concern, since if it is he thought that all the seed phrases should be exposed not some particular key. But it is also possible that OP lack of additional information or simply security knowledge regarding what any potential vulnerability flaw that his friend has. His saying about 1 particular key getting hacked may happen due to the condition of that particular address is the one who got the funds.

[cheezcarls]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.

My friend just got hacked, lost about 300-400 USD.

He wonder how it happened, make some probably the device was infiltrated by malware, if yes. All his key is gone(all), so there's no only 1.

He was generated Mnemonic by coin98. Never connected to MetaMask or some things like login to connected, never.

Address land to "0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82"

0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82 has lot network. There's 5 I found. https://blockscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

ETH  https://etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
BSC  https://bscscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
Poly https://polygonscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
OP https://optimistic.etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
ARBI https://arbiscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

Take a sample :

Code:

	Txn Hash	Age	From		To	Value	Token
0x3cf166bd6c86b610162daa81f1cbc3dba78383fdd6399eac3091f1e1266158e6	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1,000	DEXTools (DEXT)
0x12449d639d36ff5360bf2ef507175ac0d2d7ee4b28397f0841d7b7760fe9cd00	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.124008	Wrapped Ethe... (WETH)
0xe11c041c8a3a34cb4c3127ef16c9ac42c144d76a825c962998187634d13cbae3	1 hr 33 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.02358337	Governance O... (gOHM)
0x1f56d27daaf2eb9ea62a34488a52ba1290f67c5c69bff3e1470a20466861a031	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	16.55468149	Ethereum Nam... (ENS)
0xec5390bed60aec9deeea96e9518b20b21959a1e5a03eaf983008616656357ce1	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.5	Wrapped Ethe... (WETH)
0x4486b49d823e35d72194cfb1103dff731d917ecc302e0c39f1feced1d0cad3df	1 hr 35 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	166.78365256	StargateToke... (STG)
0xd80d62c04f17f25d7481acfc2b10e7358337751580991b26031083386ee2ee37	1 hr 54 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.09542125	Wrapped Ethe... (WETH)
0xf3bb3f7954b5b85bb4d9dd3d691d72fd1eb8cc18be23c55440bbb52a31fa87bb	1 hr 59 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,325,000	 ERC-20: Met.....yAi
0xd9c4a28c70c551b251876cfa94d0d66181a925f1fd5e75b550ea547ecfd412a1	2 hrs 1 min ago	0x3e99ef9745c7174ef20639b1035b79ed1b8a085e	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	250	Polkastarter... (POLS)
0x19a9516e5dfc3695edfdba696ae2b6527f9384e7e286acd48569a9cd6242eae3	2 hrs 5 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.507535	Wrapped Ethe... (WETH)
0xda35ffcb30ebe56c4e3e5303170dfc12ab313bdf653c8b4c4752aecd37d3019d	2 hrs 10 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.54064217	Wrapped Ethe... (WETH)
0x94d3ad9ea80dc5df577fa37f25383e049aa98f76715f8df922ad8b51b4bd7663	2 hrs 17 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.8296811	Wrapped Ethe... (WETH)
0xef4e4413bb3535c78bce921f9d05814961c3a9b14aa3ace872ac51de20e80644	2 hrs 37 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41.99255724	Olympus (OHM)
0xf0b29887ad526399f291462a4b3eef4283001037a3547f5c030b59ccb52fd00a	2 hrs 38 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	92,976,341,396.66919415	The People’s... (PEEPS)
0xa752e2a30cfdc25107013f9ea2338f2b0eb55ac423762c8a614a08fe6c9d8188	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,810,550,290,956.5476974	Bezoge Earth (BEZOGE)
0x7039964c4e99532c75aada210d1d81d7231bc49d7fe268fff4a69d3711e1fdb2	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41,267.59937671	MintySwap (MINTYS)
0x08aed967fba449b94e5ff4536fba07d25f8ae1a67ff956781dd1e1aedea81bdc	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	49,999.99999716	Falcon 9 (F9)
0xa2223addbef9999d87140a013e751b443bbdde4d459ed6b345b6d925e92aa81e	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	80,462.26	ACCEL (ACCEL)
0xd012dc1d82c7f8cb602a0e1b9d4b0295691431b4aac90c6e5ef0e497e2432769	2 hrs 57 mins ago	0x8090b15679d7b67625f5655883a7e42fad1adffa	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22792	Wrapped Ethe... (WETH)
0xd33bb3f40d8ad5158c5798ea0cf5ea680779a18ee3bf7b7e4f11018ffdb948a0	3 hrs 2 mins ago	0xe9c14ea0d6e9aaa7c58774b05cc6f455cc506bda	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	246.6231	Ultra Token (UOS)
0x56909ca1b3b820959a45daa3792c7002d7786be28821b0f3c32e006761ce4de4	3 hrs 5 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	501.793375	Litentry (LIT)
0xfbd778310d2b08c183a564de912355cf6c923b27e2fa4bd5cbc17be0ae101fc7	3 hrs 6 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	413.79544305	StaFi (FIS)
0x75f905d63f8725364e6feb94d2502e0f98b0890e4fa816a8db3dc838d7d92f08	3 hrs 9 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	15,136.99488655	LooksRare To... (LOOKS)
0x5f4ec7cd2719489b1153f84c72ffca0d4e152945d4848c8f0a2eabc61f8c257b	3 hrs 10 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	7.92	Staked Aave (stkAAV...)
0x1b76784ae516a45d3cd0d73b81e5235b9c32aedc7f84f8290700887050e8810a	3 hrs 12 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22316481	Wrapped Ethe... (WETH)

All those sender is sending all assets to 0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

I been research possibility:

I mean theres tons of addresses out there so its like how could you not hit one

Because there are this many possible valid 12 word seeds:
340,282,366,920,938,463,463,374,607,431,768,211,456

Like I said I'm not an expert, just want to share. make this thread as archive in case there solved or new case found.

If the account was created on a hot wallet even if it's non-custodial like Metamask, Trust Wallet, etc., hackers can drain your assets without the need of seed or mnemonic phrases if you accidentally click a malware. That's the biggest and hardest lesson that I have learned several months ago where I did not do my due diligence where I have clicked the malware inside the PDF accidentally and my $12k+ worth of crypto assets goes bye2x.

However if you have a hardware wallet like Ledger Nano S, Trezor, SafePal, SecuX, etc., safety is no question as the wallet was created offline.

[MFahad]

Most of the account hack problem is because malware.  Hacker use different software for PC or Laptop to target especially crack files which need registry. For Mobile hacking they target cloud data. All users who Signup on their mobile using cloud storage 90% has been hacked.
Mnemonic Phrase is secure but it's need to be save in paper and should not be save in Gmail or any online storage area.

[Silberman]

Your friend doesn't tell you everything. It's technically difficult to hack a wallet because of mnemonic problem.

It's on the user side I guess why that unusual activity happened to your friend.

And next time, try to use another reputable wallet and not the mentioned one by you as I didn't aware of it.

I have the same suspicions as well, it is easy to think that you are doing a good job and keeping your computer clean because you do not see anything wrong going on with your system, but if you really begin to try to find malware in your computer you will see that most computers today are infested with malware, and while some of that malware is not that dangerous there are other pieces of malware which are waiting to send out any important information they can collect out of you, and as such I think this is the main reason why the friend of OP lost his coins.

[coin-investor]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.

It's safe there are millions of wallets users that rely on Mnemonic to open their wallet, if it's not safe then we have hundreds or even thousands of complaints and users will discard these wallets

My friend just got hacked, lost about 300-400 USD.

He wonder how it happened, make some probably the device was infiltrated by malware, if yes. All his key is gone(all), so there's no only 1.

Malware and interaction with a project are just two of the reasons but doing nothing is just impossible.

He was generated Mnemonic by coin98. Never connected to MetaMask or some things like login to connected, never.

Your friend needs to dig deeper he might interact with one project and not remember it or use an infected PC to open his wallet, I'm not a user of Coin98 but there's hardly a scam accusation on Coin98