Had 165k ETH stolen last night.

[Pmalek]

To know if the person sent it to an exchange, I think there are wallet explorer that can do that?

Such services exist for Bitcoin. If the coins get sent to an address that is a known exchange address, the sites will tag them as such. But here we are talking about Ethereum and I don't know if anyone is running a similar wallet explorer analysis service.

These are the ones I know of:
https://oxt.me/
https://www.bitcoinwhoswho.com/
https://www.walletexplorer.com/

The only one that supports altcoins I have heard of is https://www.breadcrumbs.app/.

To everyone: I am afraid about it. Even though I never keep my private key online, is there any way I can check if my wallet is already compromised or not? Is there any wallet that shows login logs? Do you guys believe we can request such a feature to some wallet providers and do you think they may consider it?

If your wallet was compromised, your coins would most probably have been stolen by now. You can't have such a service of tracing who logs in and from where without infringing on your privacy. Serious wallet developers will never consider something like that. Tracking logins is something you have on centralized exchanges, and that's not where you should keep your crypto.

[Lucius]

~snip~
To everyone else: learn from my mistake. If you've got substantial crypto, move it to your hard wallet immediately. Don't let overconfidence or negligence jeopardize your assets. It can happen to anyone, myself being a stark case in point.

For someone who does not understand the basics, even a hardware wallet will not help, because even such wallets are vulnerable when it comes to clipboard malware. It may be a sophisticated attack, but it is very likely that you have a compromised computer with a possible RAT (remote access trojan) installed.

For such a large sum, I would have definitely made a much better effort and checked everything at least ten times, but obviously everyone has their own standards when it comes to such things. The problem is that these standards sometimes come back like a boomerang and hit an inconvenient place, and then we find ourselves in a big problem.

[tvplus006]

...This is huge amount and you should hire someone to track it, hoping that hacker will deposit on centralized exchange...

I am sure that this fraudster will not transfer the stolen ETH to a centralized exchange, as he is too smart for this to allow such an oversight. In addition, it can be assumed that this is not the first theft of other people's coins for him and he has already developed an appropriate algorithm of actions. And do not forget that he can make the exchange he is interested in on one of the many decentralized exchanges.

[ScamViruS]

If you can help trace the transaction or the wallet, please share your advice. Keep your crypto assets secure, folks. It's a hard lesson I've learned firsthand.

Sorry for your loss. So after reading the story I realized that someone targeted you because he didn't transfer the funds even after looking into your $7k wallet. He knew that you have a large amount of funds and that you will use this wallet again to make transactions. It is also possible that your computer was already under the control of the hacker, so that he could see all your activities.

Now if this hacker takes this fund in any centralized exchange, then you can trace him and complain to that exchange and the fund can be held with the help of the exchange. But hackers don't seem to send funds to a centralized exchange.

[khaled0111]

So after reading the story I realized that someone targeted you because he didn't transfer the funds even after looking into your $7k wallet. He knew that you have a large amount of funds and that you will use this wallet again to make transactions.

This is exactly what I wanted to say.
If the hacker had previous access to his wallet, why he didn't steal those $7k? It doesn't make sense. The only explanation is that the hacker didn't have access to the wallet at that moment.
Saying that he was expecting such large deposit doesn't make sense, unless it's someone clise to OP who knew he will receive this large amount if money and was waiting for the right moment to empty the wallet. This is why we need more information from OP to understand what've happened.

[Cricktor]

~snip~

For someone who does not understand the basics, even a hardware wallet will not help, because even such wallets are vulnerable when it comes to clipboard malware. It may be a sophisticated attack, but it is very likely that you have a compromised computer with a possible RAT (remote access trojan) installed.

For such a large sum, I would have definitely made a much better effort and checked everything at least ten times, but obviously everyone has their own standards when it comes to such things. The problem is that these standards sometimes come back like a boomerang and hit an inconvenient place, and then we find ourselves in a big problem.

This doesn't look like a case of some clipboard malware as the OP described that the large transfer reached his software wallet, only to find it being swiped 8 minutes later.

OK, the OP lacks to provide some very basic case details  (e.g. which wallet he used), how and with what he interacted with his wallet in the past (some gross mistakes like connecting your metamask to some shady website and granting ridiculous access rights or similar stupid stuff). Who knows, too much room for speculation open.

On the other hand you're very right that much better effort to secure such amounts is mandatory. I mean the user still appears quite composed regarding such a loss, but anyway, no judgement. Even Ledger hardware crap could've prevented this very likely and as OP said, it sat unused in his desk. No further words...

[Pmalek]

Sorry for your loss. So after reading the story I realized that someone targeted you because he didn't transfer the funds even after looking into your $7k wallet. He knew that you have a large amount of funds and that you will use this wallet again to make transactions.

It's quite possible. Sometimes it's those closest to us that we forget to look into or don't suspect initially. I would like to ask OP who else close to him/her has access to the computer/phone they were using? Who knew about the money they had and were expecting to receive in the wallet that got emptied?

It is also possible that your computer was already under the control of the hacker, so that he could see all your activities.

I think that if the hacker had prior access to the wallet, he would have emptied it when he saw the $7k in it. Unless, of course, the person knew it's only a matter of time before something more vulnerable gets deposited there. The question OP needs to ask themselves is how could they have known, and who knew of the upcoming transaction?

[tvplus006]

Worth noting, I had about $7k in my wallet all day, untouched. But as soon as the large deposit came in, it was swiped. Clearly, it was a targeted operation.

But there was another withdrawal on 26.8381 ETH, which you don't mention, which at that time was $50 thousand dollars. And this transaction was carried out 5 minutes earlier than the amount of 88 ETH was stolen. Maybe someone saw how you made the first withdrawal from the wallet?

[FinneysTrueVision]

CertiK's Skytrace is a blockchain exploration tool that might be helpful in tracking your stolen funds. Using a hardware wallet wouldn't have been helpful if you already interacted with a malicious smart contract and hadn't yet revoked it's permissions. Your wallet has thousands of transactions. With that level of activity you are bound to lose track of what contracts you've approved and what sites you interacted with. Scammers are clever and will disguise their scam to look legitimate enough so that you will overlook it amongst all your other activity.

[NotATether]

What was the Ethereum wallet software used? Scammers cannot steal your coins unless they already have your private key or seed.

Also I saw on Reddit how a hacker who stole ETH was "frontran" by a bot and lost the coins to it, and someone explained to be that frontrunning is just when you take a high-value transaction and change the receiving address to your own and sign the transaction with your own keys - that still doesn't make much sense to me but I think that's what happened in your case. TBH I have no idea how an ETH hard wallet is supposed to protect you from that since it seems to be a network feature.

[kingjudas]

Sorry for your loss.

Care if I ask which wallet(s) you used to access this account?

Worth noting, I had about $7k in my wallet all day, untouched. But as soon as the large deposit came in, it was swiped. Clearly, it was a targeted operation.

So, the first question you should be asking yourself is who knew you were about to receive the large deposit.  Obviously you don't want to answer that here.

It was an unforeseen windfall from a game, and thus nobody could have known about it beforehand, including myself.

First, I'm sorry for your loss.
Based on the little information you have shared, I suppose this is your eth address: 0xbed5681AB526863c4CCee75e394db537A75DA761, right!
According to etherscan.io, you received 111eth from bitcasino.io then, few minutes later, ~28eth were sent to a contract address and the remaining balance sent to the address you have mentioned.

I'm not an expert when it comes to ethereum and other altcoins but I think your case hase more to do with the smart contract than with the wallet you are using.

Yes, the address is correct. I received 111 ETH from Bitcasino.io. I managed to transfer 28 ETH to a contract address (Kraken), and then the remaining 88 ETH was maliciously taken. The involvement of a smart contract is indeed peculiar, and if anyone has insights into this, I'd be grateful to hear them.


About my wallet safety: I've been vigilant with my wallet, private keys, and funds. With 'Rewind' on my MacBook, I've been able to track all actions. The only notable event was connecting to MetaWin Dapp via Metamask. My private key or secret seed phrase was not stored on my device, adding to the mystification of this event.

What makes this situation even stranger: I had earlier withdrawn 12 ETH, which remained untouched, yet 88 ETH was swiped suddenly after I sent 28 ETH to Kraken. Moreover, the hacker took the minuscule MATIC I had, followed by a confusing sequence of events involving ACS on the Solana chain. The entire series of transactions has left me bewildered.

Why I don't think it's a sweeper bot: I've even tested depositing a small amount of ETH (as suggested on Reddit), and none of that was taken.

The lingering questions: I'm grappling with how this could have happened. The fact that the funds haven't been moved from the thiefs address and that 12 ETH was left untouched nearly all day that day has me questioning my sanity.

The links to the transactions are:

ETH withdrawal
MATIC transfer
Solana block explorer

I appreciate everyone's understanding and continued assistance. If anyone has insights into this matter, I would greatly value your input.

Best Regards,

[rat03gopoh]

With 'Rewind' on my MacBook, I've been able to track all actionsMy private key or secret seed phrase was not stored on my device, adding to the mystification of this event.

I'm not a macbook user, are you referring to this app: rewind.ai? How does it work, how to make sure that this app also doesn't stalk your screen then feed it to the server?

The only notable event was connecting to MetaWin Dapp via Metamask.

Is it your habit to interact with the web3 app with the main wallet? That's another faux pas.

Who are the people around who are allowed to access your device?

[Pmalek]

About my wallet safety: I've been vigilant with my wallet, private keys, and funds. With 'Rewind' on my MacBook, I've been able to track all actions. The only notable event was connecting to MetaWin Dapp via Metamask. My private key or secret seed phrase was not stored on my device, adding to the mystification of this event.

When did you connect your wallet to this MetaWin application? Was it sometimes in the days leading to the hack or long time before that? You could check their social media and official website to see if there are any reports of hacks or vulnerabilities on their side. Regarding your private keys and seeds not being on the device. You are using MetaMask, right? That's a hot (browser) wallet that holds the necessary signing keys, otherwise you wouldn't be able to sign and broadcast transactions.

[kingjudas]

With 'Rewind' on my MacBook, I've been able to track all actionsMy private key or secret seed phrase was not stored on my device, adding to the mystification of this event.

I'm not a macbook user, are you referring to this app: rewind.ai? How does it work, how to make sure that this app also doesn't stalk your screen then feed it to the server?

Yes I am referring to Rewind.ai, Screen and audio recordings from Rewind.ai are stored locally and never leave my computer.

The only notable event was connecting to MetaWin Dapp via Metamask.

Is it your habit to interact with the web3 app with the main wallet? That's another faux pas.

Who are the people around who are allowed to access your device?

This is the first Web3 App I have used in a very long time, and I used connected to it on July 21st for the 1st time. I reached out to them directly to let them know but they blew me off. The only person that has access to my devices is my long time partner who lives with me.

[examplens]

Yes, the address is correct. I received 111 ETH from Bitcasino.io. I managed to transfer 28 ETH to a contract address (Kraken), and then the remaining 88 ETH was maliciously taken. The involvement of a smart contract is indeed peculiar, and if anyone has insights into this, I'd be grateful to hear them.

I am truly sorry for your loss but this whole thing is very strange to me.
You said that there was about $7k at that address earlier, but that the "hacker" (or whatever is behind it) did not touch that money, but was waiting for a larger amount. When that larger amount has arrived, he hesitates and allows you to transfer a solid part of that money (about 1/3) and only after that, he transfers the rest of the ETH.
This really doesn't look like a serious hacker to me, To me, this really doesn't look like a serious hacker, it's just that he would leave the possibility of saving $50-$60k.

[kingjudas]

Yes, the address is correct. I received 111 ETH from Bitcasino.io. I managed to transfer 28 ETH to a contract address (Kraken), and then the remaining 88 ETH was maliciously taken. The involvement of a smart contract is indeed peculiar, and if anyone has insights into this, I'd be grateful to hear them.

I am truly sorry for your loss but this whole thing is very strange to me.
You said that there was about $7k at that address earlier, but that the "hacker" (or whatever is behind it) did not touch that money, but was waiting for a larger amount. When that larger amount has arrived, he hesitates and allows you to transfer a solid part of that money (about 1/3) and only after that, he transfers the rest of the ETH.
This really doesn't look like a serious hacker to me, To me, this really doesn't look like a serious hacker, it's just that he would leave the possibility of saving $50-$60k.

Certainly, the scenario you described is indeed puzzling. I agree that if a malicious actor had gained control of my private key or seed phrase, we would expect them to act more opportunistically. The presence of 12 Ethereum (~$35K as of my case) sat in my wallet untouched for almost 18 hours, I was withdrawing from that amount so it is highly unusual if a hacker had control over my wallet that they wouldn't touch those funds.

The sequence of events is indeed perplexing. The malicious activity started almost synchronously with the deposit of the larger sum of 111 Ethereum that I won from Bitcasino. Within minutes of this deposit, I successfully managed to transfer 26 Ethereum to my Kraken account. Only after this transaction, the unauthorized transfer of the remaining funds began.

The hacker's hesitation and the delayed reaction seem counterintuitive if we're dealing with a classic case of private key compromise. It doesn't make sense why they left a significant amount untouched in the wallet for so long, and why they waited until after a large deposit and a subsequent withdrawal by me before they moved the funds.

One potential explanation is a triggered event or condition - possibly a smart contract interaction or some other automated mechanism that was set to activate upon the receipt of a large deposit. I mentioned in my previous responses about a smart contract transaction that occurred immediately after the 111 Ethereum deposit. While the connection is uncertain, it's a point of interest that could potentially explain the odd timing.

Of course, these are all speculations based on the peculiar circumstances surrounding this incident. The reality may be different, and a thorough investigation is underway to get to the bottom of it.

It's indeed a perplexing situation, and I appreciate your interest in understanding this unusual case. I'll continue to update as I make progress with my investigations and hopefully provide some clarity in due time.

It's literally driving me crazy.

[Cricktor]

As OP uses MetaMask which is a browser based wallet: which browser extensions do you have installed? If you don't pay attention to what extensive rights some extensions demand and if you install shady ones, you're quick in trouble.

Do you have some sort of extension from Bitcasino installed??

I consider a browser based wallet like MetaMask already as a very bad idea. Browsers are very complex software beasts that constantly interact with the www, that is mostly external data thrown at your try-to-be-everything-software-renderer which has gazillions of bugs, constantly.

Any exploit in your browser puts your browser wallet at risk. What could possibly go wrong here? Nevermind...

<snip>

That is indeed quite uncommon behavior of a malicious actor who has enough control to send coins from OP's wallet.

[JoyMarsha]

For someone who is unable to regulate their emotions, the notion of this enormous loss can be intolerable. This is a tragic tale that OP will carry on with.

If there was a way to get your stolen $165k Eth back, we would have all taught you the way, but in this situation, there is no way to discover the person who stole your crypto assets.

Have courage, and consider it a lesson well learned. You should not use your Eth wallet once again because it has been compromised. Instead, use a hard wallet to create a more secure wallet that won't be vulnerable to hackers.

[Sim_card]

Sorry  for your loss OP,this is a hard lesson for you. I am not blaming you but it has always been an advice here by experts that don't keep big amount of bitcoin in an online wallet because you will be vulnerable to hackers but instead use a hard wallet to keep your coins but this information was irrelevant to you not until you have become a victim. A link with malware was sent to you and that was how your wallet was compromised. I don't think that such an hacker will transfer the funds to an exchange only if he is dumb. If crypto is not illegal in your country and the funds was sent to an exchange, then it is possible to freeze the account with the help of the police.

[Pmalek]

<Snip>

Maybe your keys leaked with the 26 ETH transaction that you made from Metamask to your Kraken account. After that, someone got the secrets that they needed to steal the remaining coins. I don't know how, though.

What about your partner that you said lives with you. Does she use your computer? It doesn't have to be that she stole from you, maybe she used some fake app. Does she play games or use some dubious apps and permissions over social media?