🚨 Galxe has been hacked

[OmegaStarScream]

For those who are familiar with the platform, and use it on a regular basis to complete tasks for different projects, you should stop using it. Don't connect your wallet, and don't sign any transactions either. It has been hacked as mentioned here[1].

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

[1] https://twitter.com/Galxe/status/1710318639381881280

[MAAManda]

For those who are familiar with the platform, and use it on a regular basis to complete tasks for different projects, you should stop using it. Don't connect your wallet, and don't sign any transactions either. It has been hacked as mentioned here.

Currently the website is down and can't be accessed, there's also a warning if you visit the website. many people think that this is just a scam from Galxe to take money from their users accounts, BTW, thanks for the quick information you share in the forum.

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

Some of them are just trolls, but most of them are the truth, I even saw in a comment that hackers also took balances in accounts that only had $4 in them, so it's impossible for them (Hacker) to miss accounts with large balances.

[ryzaadit]

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

They have a recovery plan, let's see how the process of their recovery plan is.

Checking the comment, most of the time is only troll comment with big amount $ and hoping they got a refund the total being hacked based on the information in comments is around 150K$. Based on the total number of visitors and users of Galxe is really small.

I'm sure they still can refund with these numbers.

[OmegaStarScream]

As mentioned by ryzaadit, It looks like there is indeed a recovery plan (TBA). The team also managed to gain control over the domain[1].

@MAAManda AFAIK, that error message would've only shown to MetaMask users. I'm just guessing here, but I don't think the users of other wallets (Exodus, Trustwallet, SafePal, etc.) would've gotten that.

[1] https://metamask.github.io/phishing-warning/v2.1.0/#hostname=galxe.com&href=https%3A%2F%2Fgalxe.com%2F

[MAAManda]

Checking the comment, most of the time is only troll comment with big amount $ and hoping they got a refund the total being hacked based on the information in comments is around 150K$. Based on the total number of visitors and users of Galxe is really small.

I'm sure they still can refund with these numbers.

Even if it was at $500K I'm sure they could still return the money to their users, don't know if this will continue or not, but the last interaction on the hacker wallet was 44 minutes ago. The hacker has also moved a large balance worth 31.3 $ETH to another wallet.

@MAAManda AFAIK, that error message would've only shown to MetaMask users. I'm just guessing here, but I don't think the users of other wallets (Exodus, Trustwallet, SafePal, etc.) would've gotten that.

Confirmed, Exodus users won't get that warning message, it looks like it's really a special message for MetaMask users.

Hacker wallet: https://etherscan.io/address/0x4103babcfa68e97b4a29fa0b3c94d66afcf6163d | BSC | FTM | Crono

[nelson4lov]

Too bad for the Galxe team. So far, are there any leads of the reason Galxe was compromised? I have revoked all access to their website. Last time I used the protocol was a couple of months ago.

Even if it was at $500K I'm sure they could still return the money to their users, don't know if this will continue or not, but the

I'm not sure what their business model is but the Galxe team is a beneficiary of some of the grants offered by L2 projects like Arbitrum, etc so definitely they can cover "legitimate" from users.

[dbshck]

I was doing the Arbitrum Odyssey on Galxe just 2 hours prior to the DNS attack. Had I been active a few hours later, I might have been one of the victims too . Stay safe everyone

Too bad for the Galxe team. So far, are there any leads of the reason Galxe was compromised? I have revoked all access to their website. Last time I used the protocol was a couple of months ago.

It was a DNS attack similar to what Balancer had a few weeks ago. So the cause is likely similar as well, a social engineering on their domain registrar.

[bluebit25]

According to information shared, it seems that users have lost money from this scam. Funds from the Galxe hack were transferred to a wallet address 0x4103…6163d. More notably, that the wallet address receiving money from this Galxe hack is closely related to the hacker who attacked the Balancer protocol on Sep 20.

Perhaps we have all received warnings to stop using and connecting to galxe at this time, according to what I have been told, Revoke should be done in this situation. But in terms of scale and severity, we can still hope that this is just a small incident and Dev is still diligently finding a way to fix it.

[cryptoaddictchie]

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

Ive saw the news too. Ive easily disconnected my wallet within galxe. It seems the hackers are having fun on exchanging oat to 1eth per wallet. What a crazy thing to happened actually, how could they exploit just like that. Also it worth noticing that the hacker only moving funds from those wallets that contain bigger amount of eth and neglect the smaller values.

Its like the process has autoskipped on contracts if the wallet only have few gas and cant even profit from transfer.  Very smart and scary hacker.

[fapar]

I was lucky, yesterday I didn't use Galxe at all. But the situation is sad, although not unique over the past 1-2 months. The system of approvals itself - signatures for identification - is very convenient, but as we see, it is not safe. That is, we need to make changes to the signature mechanism itself; it should not be directly related to the funds in our wallet. As for Revoke, it’s worth remembering the situation in the summer when he too was attacked using fake contracts. Any service is vulnerable.
I express my gratitude to MetaMask, which I use - today he blocked access to the Galxe website and warned me. And this is not advertising.

[D ltr]

very surprising this incident, even though there are many programs that I followed there,
and haven't gotten the results, (sad) after I got the info I rushed to break the connection to Galxe

[TribalBob]

Seeing that the amount of loss is quite large, sometimes negative thoughts come out about hacking like this, is it really hacked or is it just a rumor, thank you for the information provided. I hope my wallet is safe because the day before the incident I was still working on one of the programs there.

[cheezcarls]

My wallet was not drained after the incident as I didn’t logged in to Galxe that day. After reading the X post of Galxe regarding the incident, I checked to see if the address being mentioned by them was in my history of approvals that needs to be revoked.

But good thing it wasn’t. I’ve also disconnected my wallet from Galxe. If I was not aware of the incident and immediately go to Galxe and approve signature, I might be one of those people who are affected and got hacked.

Thank God I did my homework making sure that all of the hardwork that I’ve built would not be put to waste, especially those NFTs and OATs that I’ve minted.

I really feel for those people who have lost their money and drained to the hacker’s wallet who compromised Galxe back then.

Stay SAFU everyone!

[Taskford]

For those who are familiar with the platform, and use it on a regular basis to complete tasks for different projects, you should stop using it. Don't connect your wallet, and don't sign any transactions either. It has been hacked as mentioned here[1].

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

[1] https://twitter.com/Galxe/status/1710318639381881280

Oh my not a good news since there's a lot of people using this platform. If bad thing happened and those hackers will have full control of these platform for sure there's a lot of users will get affected with it especially that they connect their wallets before they can do some task there. And to awful to read that there are couple of people has been affected already and maybe best for users to drain their wallet before the hacker can locate it.

Lucky to use a dummy wallet on their platform so I don't have anything to lose there, but other people might get affected with this especially those people who are late to receive this news since provably they might wake up that they don't have anything left on their wallet and that is bad sight to see especially those balances is their hard earned crypto's from participating on multiple platforms.

[Kavelj22]

A new hacking operation has been completed successfully. This is unfortunate because the hacking operations happen simultaneously and the victims are always the users. Fortunately, the lost amount is not considered large compared to the number of users on the site, and the site can compensate for the losses, but this remains evidence of weak development and lack of updates.

I express my gratitude to MetaMask, which I use - today he blocked access to the Galxe website and warned me. And this is not advertising.

This is not new to MetaMask because we are accustomed to taking similar measures with any site suspected of being hacked or any links to suspicious sites. They have a well organized support team that reacts quickly to most updates, especially regarding sites linking to the wallet.

[coin-investor]

A new hacking operation has been completed successfully. This is unfortunate because the hacking operations happen simultaneously and the victims are always the users. Fortunately, the lost amount is not considered large compared to the number of users on the site, and the site can compensate for the losses, but this remains evidence of weak development and lack of updates.

I express my gratitude to MetaMask, which I use - today he blocked access to the Galxe website and warned me. And this is not advertising.

This is not new to MetaMask because we are accustomed to taking similar measures with any site suspected of being hacked or any links to suspicious sites. They have a well organized support team that reacts quickly to most updates, especially regarding sites linking to the wallet.

But sometimes they are late to block so on your own you should be diligent if you read or there's speculation or report you should be hurry to take action and always up to date on the latest news about platforms and exchanges you're working on or your wallet is connected.
Hackers and scammers are working 24/7 so you should be vigilant, as much as possible subscribe to newsletters and online magazines about Cryptocurrency and technology, awareness is the first step to safety.

[ultrloa]

For those who are familiar with the platform, and use it on a regular basis to complete tasks for different projects, you should stop using it. Don't connect your wallet, and don't sign any transactions either. It has been hacked as mentioned here[1].

I see some people reporting some losses of huge numbers, but not sure if they're just trolling or it's real. Either way, don't use it for now.

[1] https://twitter.com/Galxe/status/1710318639381881280

This indicates that any platform ask to connect our wallet is not totally safe since issue same with galxe will happen. Galxe is popular site and to many people which hope to earn huge from doing some task, but now that this site has been hacked it open some sleeping consciousness that we must secure our wallets and don't ever trust any site even if they are popular since the same issue might happen then for sure we can't afford to be their victim.

I also see a lots of post saying their lose regarding on incident but we can't verify if this is true and hopefully that's case since if many got scam with that for sure these scammers will attack for second time so we need to be ready or careful on next platform to be attack so that we can assure that we are safe from getting hack.

[Bobrox]

Current survey from all airdrop participants are happiness with Galxe have been hacked, they are not happy when participating in airdrop campaign linked with Galxe to earn reward and connected their wallet with this platform. Hope any one with their wallet connected with Galxe can disconnect as soon possible because I saw with hacker wallet connection fund increasing up every time. Due many platform of cryptocurrency exactly required with wallet connected not secure yet, for all investor or airdrop campaign participants never use your main wallet and as soon possible not recommended holding fund in your wallet have indicated connected in every site for the future.

Make one wallet use for connecting with all cryptocurrency platform, when get hacking we don't worry about our fund loss because not as primary wallet and don't save assets there.

[Yogee]

Latest estimate is around $270K affecting about 1,120 users. How it happened is quite ridiculous. Dynadot got fooled by the hacker when he impersonated someone from Galxe using fake documents. I don't know about their contract but Galxe should probably ask for compensation from Dynadot because they made a huge blunder.

[....]is it really hacked or is it just a rumor.

Are you serious? OP already posted a tweet from Galxe confirming the security breach.

[tvplus006]

...Also it worth noticing that the hacker only moving funds from those wallets that contain bigger amount of eth and neglect the smaller values...

No, this is a wrong observation. If you look at the transactions on the scammer's wallet, you will see that coins are withdrawn from almost all networks, including BSC, Poligon, Avalanche and Fantom networks, that is, from those networks where ETH is not a native token.

In addition, I remind everyone that you can check your wallet on a specially created page - https://revoke.cash/exploits/galxe