My Kaspa Web Wallet was hacked

[Echo8002]

I would like to inform Kaspa users that on 18.03.2023 at 00:24 and few minutes later somehow 2 unauthorized transaction stole around 87000 Kaspa tokens from my Web Wallet. The transactions appeared on the Kaspa Blockchain Explorer but did not on the Web Wallet transaction history or KDX GUI wallet. I have contacted Kaspa Telegram group and Discord but the only answer I got is that somehow I clicked on a fishing website which I 100% didn't because my Web wallet is constantly opened in my browser. First they thought that my coins just "disappeared" from the interface and still there and proposed steps to recover them. I tried all the suggested steps by moderators to recover the coins via Compound ,Delete Data Folder ,entered my seed in KDX wallet etc. In the end they agreed that I was hacked somehow but didn't even try to investigate where are my funds go no matter the fact I asked few times for help. I have showed them screenshots and pictures of my wallet that these transactions are not registered in the history and didn't get any reasonable explanation. I'm begin to think that this was an inside job because one more person contacted me that he has the same problem at the same time. Blockchain analysis shows that around that time at 18.03.2023 around 75k USD of Kaspa tokens were stollen and send via multiple transaction ,divided by 2 after each transaction. So at the end I contacted Uppsala security to investigate the issue and waiting second response from them with offer after which I will contact the law enforcement agencies. If someone experienced the same lost of their Tokens from the Web Wallet write here ,contact as many as possible groups in the crypto space ,blockchain investigation firms or DM me

[Bitcoin_Arena]

I do see a lot of phishing web wallets when I just google kaspa web wallet. Are you sure you didn't enter your sends to the wrong site?
Don't you have any other alternative software wallets that support the coin?

I have seen a few individuals complain about their coins disappearing too on Reddit. May there's a problem with the blockchain or even the web wallet you guys think is official

[JayDDee]

If this was intended to warn users then why no reference to the web wallet being used or how it was obtained?
It's hard to take this seriously.

[fuzzyohm]

I have the same issue.  Hackers were able to drain my web wallet https://wallet.kaspanet.io/.  Web wallet shows no transfers, but explorer shows the hack.

https://explorer.kaspa.org/addresses/kaspa:qpjzr74gdseh60mzcjqkw7fy8la2f39vm9lgx2rwnkyu8aqjtw5yqqjtqkrx2?page=1

[JayDDee]

I have the same issue.  Hackers were able to drain my web wallet https://wallet.kaspanet.io/.  Web wallet shows no transfers, but explorer shows the hack.

https://explorer.kaspa.org/addresses/kaspa:qpjzr74gdseh60mzcjqkw7fy8la2f39vm9lgx2rwnkyu8aqjtw5yqqjtqkrx2?page=1

Web wallets are always a risk. Not your keys, not your wallet.

The real lesson here is don't use web wallets, especially if you don't control the keys.

[FloppyPurpleGherkin]

You clicked a phishing link or you have dodgy software on the computer that you setup the wallet with (keylogger etc)

It's a bitter pill to swallow but this happens a lot, across all cryptos.

[adaseb]

This has been going on for years and Google has not done a thing about it. Its not only for crypto. Its the same with banks and sites like Amazon.

Way too many people google the site and click the first link and sometimes that link is a "paid advertisment" and its usually a phishing site. Google won't do anything about it because thats how they earn their money.

Next time, type in the link in your browser AND bookmark it.

[JayDDee]

Way too many people google the site

... just begging to be phished. Googles's fault?

[sxemini]

I will contact the law enforcement agencies.

And you think you get your money back? Or what is your intention? I mean we speak about $1200 from you, the law enforcement agencies have more important things to do.
I have some coins in kaspa wallet and i also use for this coins the web wallet - all fine for me. Every transaction is in the transaction history - but it is not in a row.

Why you have the wallet always open? Is not so save. And why should the kaspa team help you to investigate where you money goes? You think you are the only person on the planet? I mean you made the mistake. And no one from us know how you work on your computer.
You should check your pc for running phishing software. Maybe you tried a phishing miner. Who knows

Web wallets are always a risk. Not your keys, not your wallet.

Hmm but he has the key for the wallet - so your sentence makes no sense in this case   Web wallet is a normal wallet, like every wallet you have on you pc.

[GEMIN_M4]

This is very hard to believe, I have my kaspa wallet keys saved in an encrypted Linux OS and til date nothing happened to the wallet, I am more than sure that you did something wrong on your end, I feel skeptic about web wallets too and that's why I don't invest in some coins that have no standalone wallet but I just can't take eye off kaspa, somehow you have been phished, be more careful next time.

[sxemini]

This is very hard to believe, I have my kaspa wallet keys saved in an encrypted Linux OS and til date nothing happened to the wallet, I am more than sure that you did something wrong on your end, I feel skeptic about web wallets too and that's why I don't invest in some coins that have no standalone wallet but I just can't take eye off kaspa, somehow you have been phished, be more careful next time.

I have my keys offline. Encrypted linuxos is nice to have, but the safest place is offline.

[JayDDee]

Web wallets are always a risk. Not your keys, not your wallet.

Hmm but he has the key for the wallet - so your sentence makes no sense in this case   Web wallet is a normal wallet, like every wallet you have on you pc.

It was not initially disclosed where they obtained the "web wallet". Most web wallets are provided by a third party and support many coins.
In this case it was an officially supported wallet from the coin devs.

A web wallet in nothing like a full node wallet you can mine. It's a managed wallet, meaning someone esle takes care of your crypto
on your behalf, often including the keys. They are no more secure than using an exchange to store your crypto.

This case now looks more like phishing or the keys, wherever they are stored, were stolen.
So my second sarcastic reply may seem more relevant. In a less sarcatsic way, don't blindly click on links that are offered to you.

It's sad but it's the world we live in. In Darwinian terms, adapt or die.

[swogerino]

The moment I saw Web I immediately said to myself why do people still keep using web wallets and not desktop software wallets which are a bit safer than web wallets.When you are using web wallets you leave your coins at the mercy of the third party who operates that web wallet no matter how trustworthy they are.I am sorry for your loss and that you have learned the hard way that using web wallets is never safe as you are not in control of anything as I said,you do not own your private keys and the third party of the web wallet have those for you.

You have fallen victim of phishing which is another problem with web wallets as you must be very careful when typing the url as many hackers use the technique called "typo squatting" by creating url similar to the original one of the web wallet in this case and they harvest any credentials of any victim that falls into this phishing scam.This is also avoided when you use desktop wallets as you don't need to go to any website,you just open your app and you only need to be extra careful the first time downloading the wallet,it must be from the original site,everything else is in your control then.

[Pterosaur]

Web wallet is red flag, every proof of work coins I own has a PC wallet software if they don't have mobile versions, you will need to download the blockchain data yourself to see your balance, why are you still using web wallet? If the coin don't have wallet software it is better to avoid such projects and look for a better one.

[fuzzyohm]

Hi folks,

I appreciated your feedback and agree with the warnings regarding web wallets.  What I don't understand is why the officially supported web wallet (https://wallet.kaspanet.io/) does not show the transaction where my all of coins are transferred? I see it on the block explorer, but not in the web wallet.  Can someone who knows more shed light on this?

[JayDDee]

Hi folks,

I appreciated your feedback and agree with the warnings regarding web wallets.  What I don't understand is why the officially supported web wallet (https://wallet.kaspanet.io/) does not show the transaction where my all of coins are transferred? I see it on the block explorer, but not in the web wallet.  Can someone who knows more shed light on this?

This question gets into investment strategy, which I won't comment on.

[FP91G]

It is better to download all available wallets using links from the official website, and a link to the official website can be found on the coinmarketcap service. I mine those coins that have a hardware wallet, and if you have a lot of coins, then you need to use a cold wallet that you create on a separate computer.

[Echo8002]

I do see a lot of phishing web wallets when I just google kaspa web wallet. Are you sure you didn't enter your sends to the wrong site?
Don't you have any other alternative software wallets that support the coin?

I have seen a few individuals complain about their coins disappearing too on Reddit. May there's a problem with the blockchain or even the web wallet you guys think is official

100% sure I didn't click on a phishing site. Also check the Discord help-wallet thread. There are more people like me now

[Bitcoin_Arena]

100% sure I didn't click on a phishing site. Also check the Discord help-wallet thread. There are more people like me now

Can't check their discord help-wallet thread. I have no discord installed on my Linux

If you don't mind, sharing screenshots here wouldn't harm. But just like I said I saw similar complaints on Reddit. My question is What are the developers saying about the whole situation? have they confirmed that there is a hack or there's a bug?

Stay away from Closed source web wallets!

[JayDDee]

100% sure I didn't click on a phishing site. Also check the Discord help-wallet thread. There are more people like me now

If that's true where ever the keys were stored was hacked. You still haven't said if you actually had control of your keys or if your "wallet"
(probably more like an account) managed the keys "on your behalf". It doesn't matter whether you say, but it makes a big difference as to
who and what got hacked, or just plain scammed.

But seriously, with $75k worth of crypto you need to be more careful.