A strange ongoing attack (A must read for all members).

[YellowSwap]

There is an exploit going on via EVM chains and sadly enough even the brave ZachXBT can't seem to figure out what's causing the exploit to be successful.



https://x.com/i/status/2006931040225370123

Since this is happening via EVM chains I can't help but believe that approvals that people failed to disconnect from is the reason why this attack is going on, those people who likes to connect to multiple layer2 chains or trade via uniswap like platforms are likely the ones getting affected by this.

There is no update yet regarding this attack but I will like to suggest that if anyone still falls into this category of approval websites and platforms in your metamask or wallets make sure you disconnect them all.

This is one thing that https://Revoke.Cash is very good at, connect your wallet and review your active approvals, some smart contracts have the permission to move your coins and the approved amount too.

Stay safe.

[BitMaxz]

I don't think it's a good idea to use a third-party site just to protect our wallet.
If you want to avoid such attacks, why not switch to a hardware wallet instead?

Since your purpose is to avoid unknown permission, then switching to a hardware wallet would be much better than using a 3rd-party site like you mention above.

[Charles-Tim]

Since your purpose is to avoid unknown permission, then switching to a hardware wallet would be much better than using a 3rd-party site like you mention above.

Hardware wallet can also be drained if the owner make mistake. We have discussed about this before on a thread that the hardware of a user on this forum was drained.

When I connected my wallet in the past, I created new wallet for it and send coins there for the purpose. The amount is usually not much. This is better than risking a hardware wallet for it. I will prefer not to use my hardware wallet for something like that.

Since 2 years ago or so, I do not even connect my wallet at all till today.

The last we heard of was when Polymarket users wallets were affected recently and now this one is happening.

[Bitcoin_Arena]

People have always been advised not to keep any stash on addresses that they use to connect to the different dapps or even collecting shitcoin airdrops, but it looks like many are yet to learn how to safeguard their funds.

[satscraper]

There is no update yet regarding this attack but I will like to suggest that if anyone still falls into this category of approval websites and platforms in your metamask or wallets make sure you disconnect them all.


Stay safe.

It looks like it was triggered by phishing emails that pretended to be sent by MetaMask staff

and claimed an urgent update was required. The email likely contained the link to fraudulent website where unsuspecting users ^{who seems were deeply panic about safety of their stash} downloaded the fake update containing malicious exploit.

[Patikno]

There is an exploit going on via EVM chains and sadly enough even the brave ZachXBT can't seem to figure out what's causing the exploit to be successful.



https://x.com/i/status/2006931040225370123

Since this is happening via EVM chains I can't help but believe that approvals that people failed to disconnect from is the reason why this attack is going on, those people who likes to connect to multiple layer2 chains or trade via uniswap like platforms are likely the ones getting affected by this.

There is no update yet regarding this attack but I will like to suggest that if anyone still falls into this category of approval websites and platforms in your metamask or wallets make sure you disconnect them all.

This is one thing that https://Revoke.Cash is very good at, connect your wallet and review your active approvals, some smart contracts have the permission to move your coins and the approved amount too.

Stay safe.

I think there are many possibilities, whether it is due to an exposed seedphrase or private key, cyberattack (phishing or malware), permission signing of a malicious contract, and so on. Well, I don't think the case has been solved yet, as there hasn't been any further information or inspection, so the source of the problem still can't be determined. I hope it will be revealed soon to be useful information.

Besides that, I think from this case, we need to learn not to store large amounts of crypto assets in wallets we frequently use for various activities, especially large amounts of crypto. It should be better to store these crypto assets in wallets designated for minimal activity, or no sign at all. Essentially, we should be skeptical, and assume that the wallet you frequently use is potentially hacked at any time with various possibilities, so take action or think about securing it, as I mentioned, or we will immediately take security measures such as carrying out a revoke as the OP said.

[Wincob]

There is no update yet regarding this attack but I will like to suggest that if anyone still falls into this category of approval websites and platforms in your metamask or wallets make sure you disconnect them all.


Stay safe.

It looks like it was triggered by phishing emails that pretended to be sent by MetaMask staff

and claimed an urgent update was required. The email likely contained the link to fraudulent website where unsuspecting users ^{who seems were deeply panic about safety of their stash} downloaded the fake update containing malicious exploit.

This could be the reason behind the drains but how come someone like ZachXBT can't figure this out? Which is why I still believe there might be more, maybe this is just one of those attacks we don't know, let's wait for few more days I believe we will have clearer answers, there are many ways that this drains could happen, just too many, and most of the time it's always the wallet owners doing something stupid, either by upgrades or wallet connection to bad websites.

It's always the ones operating the wallets doing something they shouldn't be doing. Sigh! This isn't going to stop in any way.

[FinneysTrueVision]

I looked at some of the wallets that were drained and many didn’t have any approvals for the specific tokens that were stolen. The Metamask phishing email theory, shared in the replies above, might be true, but the Twitter account who posted that didn’t provide any evidence besides a screenshot of an email.

The suspicious wallet has already swapped most of the funds to ETH, around $100k, and sent them to Tornado Cash.

[ancafe]

Since this is happening via EVM chains I can't help but believe that approvals that people failed to disconnect from is the reason why this attack is going on, those people who likes to connect to multiple layer2 chains or trade via uniswap like platforms are likely the ones getting affected by this.

Third-party sites aren't completely secure because expectations can sometimes differ and the reason for using a third-party wallet for protection is also less than ideal. I believe it's better to use a hardware wallet to avoid these types of attacks and most importantly, to significantly secure our assets, as the sole purpose is to prevent unauthorized access. While hardware wallets can be compromised if the owner makes a mistake, this is more about avoiding it. For greater security never connect your personal wallet to a shitcoin airdrop collection preventing unauthorized access and correct me if I'm wrong.

[hugeblack]

The easiest solution is to have a temporary wallet that you use to access third-party applications. This wallet should be funded with enough money to make transactions and withdraw funds to an air gapped wallet or hardware wallet.

In this case, the worst that can happen is losing a small part of your balance, not all of it.

[BlackBoss_]

The easiest solution is to have a temporary wallet that you use to access third-party applications. This wallet should be funded with enough money to make transactions and withdraw funds to an air gapped wallet or hardware wallet.

In this case, the worst that can happen is losing a small part of your balance, not all of it.

If it is a big fund, it's worth to spend money for buying hardware wallets.

If it is a not a too big fund, it's still worth to practice carefully and consider it as your temporary hot wallets. Funding that hot wallet with enough fund to use for a trade, and avoid funding it with bigger money than a trade value.

After finish a trade, I would like to uninstall that extension and I will use wallet backup for importing that wallet in the future if I want to use it again. Let that extension on my device, browsers a long time makes me feel very unsafe.

How to Revoke token approvals. This attack is not new and years ago, Coinmarketcap had this helpful article in its academy.

[Maliceprime]

I don't think it's a good idea to use a third-party site just to protect our wallet.
If you want to avoid such attacks, why not switch to a hardware wallet instead?

Since your purpose is to avoid unknown permission, then switching to a hardware wallet would be much better than using a 3rd-party site like you mention above.

People who use hardware wallets can also fall for this type of scams too, I know someone who uses his hardware wallet to join many Airdrops, I keep telling him  that the hardware wallet is no more safe because I know how many rubbishes are available on Airdrops,  you need to click on many links and also approvee many requests in your wallet.

Hardware wallets are cool but it depends on the users, someone who knows what they are doing can use electrum wallet for many years to come while someone who don't know what they are doing can get their hardware wallet compromised in a matter of time, to me it is all down to who is using the wallet.

I know that some hardware wallets are not recommendable, like ledger and all closed source wallets but using a open source wallet isn't enough if you are a complete careless or stupid person.

[BitMaxz]

People who use hardware wallets can also fall for this type of scams too, I know someone who uses his hardware wallet to join many Airdrops, I keep telling him  that the hardware wallet is no more safe because I know how many rubbishes are available on Airdrops,  you need to click on many links and also approvee many requests in your wallet.

Hardware wallets are cool but it depends on the users, someone who knows what they are doing can use electrum wallet for many years to come while someone who don't know what they are doing can get their hardware wallet compromised in a matter of time, to me it is all down to who is using the wallet.

I know that some hardware wallets are not recommendable, like ledger and all closed source wallets but using a open source wallet isn't enough if you are a complete careless or stupid person.

Yeah, I agree, but I don't use the hardware wallet where my main coins are held. I have a separate wallet for airdrops because you can't immediately trust someone or their own chain that your wallet is going to connect to. I'm not going to do that unless I have a separate wallet.
Having a hardware wallet doesn't mean you are 99% protected; users still need to be aware of possible attacks and always avoid random chains or anything that asks for permission directly to your hardware wallet. The OP is providing a link to revoke permissions, but the problem is it will also ask for your permission to connect to your hardware wallet, which I don't agree with.

I suggested switching to another hardware wallet. What I mean by this is that is by switching to another hardware wallet, like I think Keystone3 that has a security feature like the smart decoding feature ABI that decodes data and shows you the exact amount you are going to approve, unlike other wallets, when the transaction is asking to sign a transaction, it only shows a hex or raw transaction that you don't know if it sends the whole amount of coins or the amount you set.

I am more comfortable if everyone is going to practice to use a new wallet if they encounter a new site, new coins or tokens, or a new chain that they are going to connect to. This is always the best thing you need to do if you don't want all your funds being compromised and hacked.

[Tungbulu]

People have always been advised not to keep any stash on addresses that they use to connect to the different dapps or even collecting shitcoin airdrops, but it looks like many are yet to learn how to safeguard their funds.

A lot of people undermine the importance and value of good wallet hygiene, and that’s because they forget that a good wallet hygiene is more about risk separation. Rather than loading all your funds in one wallet, separate the funds, your holdings in one wallet, mostly advised to use a hardware wallet for this one, and then use another wallet where you can put a lower amount for your experiments, airdrop farming and dapps. So even if you lose the lower amount, it wouldn’t be as devastating as losing your whole stash. Until people stop undermining the importance of security and start thinking this way, mistakes like this will always be inevitable and scammers and hackers will continue to thrive on their ignorance. 

[Youngrebel]

Scam.here, scam.there, it seems scam is the latest talk of the time now, and it is obviously going viral and more victims arising by the day.  But come to think of it, with the high level of scams, and fraudulent activities on the increase with more intensifying methods and tactics the security agencies seems to be relaxed about the whole situation.  There's no much of improvement from them to detect criminal activities that are in the rise. By now I expect that security agencies be ahead of the activity of criminals that are master minds perpetuating much evil and causing much pain to people here and there.

[I_Anime]

This was the reason I had to reduce doing of airdrops , because it usually involves a lot of connecting your wallet into random site inorder to participate in some airdrops.

I had to separate my personal wallet from that of airdrop , so I won’t endup falling a victim of any scam activity, this same reason why I don’t use browser extensions in the device I have my asset store, then they use such method to drain alot of users.

[X-ray]

The easiest solution is to have a temporary wallet that you use to access third-party applications. This wallet should be funded with enough money to make transactions and withdraw funds to an air gapped wallet or hardware wallet.

In this case, the worst that can happen is losing a small part of your balance, not all of it.

Or use multisig address to interact with dapps but this will be pretty complicated to using ordinary address.

The easiest way to keep wallet hygiene is to revoke any delegation or approval. That way we will be safe even if a smart contract got exploited because they don't have right of spending.

If it's phishing however, I doubt any wallet hygiene maintaining procedure could prevent someone from getting social engineered.

[o48o]

This was the reason I had to reduce doing of airdrops , because it usually involves a lot of connecting your wallet into random site inorder to participate in some airdrops.

I had to separate my personal wallet from that of airdrop , so I won’t endup falling a victim of any scam activity, this same reason why I don’t use browser extensions in the device I have my asset store, then they use such method to drain alot of users.

Same here. Connect your wallet to check if you are eligible to our token that no one has neve heard about. Right.

Well, actually sometimes i just emptied my wallet and tried it for them. As you never know and i am out of the loop when it comes to new 2nd layer scaling solutions. Problem is that i might have forgotten to deny the rights after checking, so some of my wallets might still be vulnerable. So i won't be sending anything in them before i check what they are connected to.

[gunhell16]

I don't think it's a good idea to use a third-party site just to protect our wallet.
If you want to avoid such attacks, why not switch to a hardware wallet instead?

Since your purpose is to avoid unknown permission, then switching to a hardware wallet would be much better than using a 3rd-party site like you mention above.

Correct, and I think our fellow members haven't been lacking in reminders that using third-party services is really not advisable. We know all too well that these platforms are often where problems arise; they provide hackers with the perfect opportunity to strike.

If a person isn't vigilant, this will be their unfortunate fate. Using hardware wallets or non-custodial wallets, as long as they are implemented correctly
It is a much better alternative than relying on third parties.

[FinneysTrueVision]

The OP is providing a link to revoke permissions, but the problem is it will also ask for your permission to connect to your hardware wallet, which I don't agree with.

In order to have revokable permissions you would have needed to connect to a website at some point in the past. Connecting to a site to remove spending permissions from a smart contract isn’t any more dangerous inherently than connecting to any popular dapp. If the website is compromised or the developers are shady, that’s a different story, but this is assuming we are dealing with honest actors and revoke.cash seems to be reputable. There was one incident last year, but it was the fault of Ledger's Connect Kit and it affected many other major websites.

You can also do the same thing from Etherscan, Metamask Portfolio, or Rabby Wallet if revoke.cash isn’t suitable. The best way to avoid drains related to token allowances is to avoid giving unlimited spending approval to any contract. Only approve the amount you need to complete your trade or whatever action you are taking.