Wallets connected/created through lootbot are being wiped out

[Orpichukwu]

There is a serious attack and wallet draining in more than 3800 wallets already affected, which is connected to users who might have been said to have connected their wallet to “lootbot” (a project which they alleged connected to a Vietnamese scammer who has stolen millions of dollars through a presale).

It all started like a joke this afternoon on X when a user complained about his ETH wallet being emptied without any trace of how it happened, until it escalated to other chains and wallets of others.

Anyone who might have their wallet connected to LootBot should check if their tokens are safe and move them out if anything is left. I don’t buy that revoke advice; take action first and then think of anything else later, according to the tracker and who reported it, they said most chain under the eth layer have not yet been swept by the hacker so their might still be chance for some people to save money.

🚨 If you ever used @lootbot_ai , move your funds right now.

Someone has the private keys to wallets generated by LootBot and has been
draining them since 13:18 UTC on September 7. 252 ETH (~$620k) taken so far
from 3,825+ wallets across 9 chains. It is still running as I post this.

0x4e5df8422271690327c0348845b639196aB0081E

THIS IS A PRIVATE KEY COMPROMISE, NOT A PHISHING ATTACK.

1,967 wallets were swept on two or more chains. Five were swept on all seven.
Same address, different chains, minutes apart.

No approval, no signature, no malicious contract can do that—none of them.
can even move native ETH, let alone on seven chains at once. Only possession
of the key can. You didn't click anything. There was nothing to click.

https://x.com/somaxbt/status/2097297279921340482

[Agbamoni]

Tragic news at this late hour. By now, the number of wallets swept of their coins has increased to 2X, if not more.
Unfortunately, the post on X is getting less engagement since it's not coming from a well-known account on X. Only 9 retweets as we speak.
The people involved are part of the Lootbot group. It's to find them and arrest everyone involved.

[Antidote47k]

If the private key has already been compromised, revoking approvals won’t help much. In that case, an attacker with the key can directly sign transactions from the wallet which may include moving native ETH, so it’s right to treat the affected wallet as compromised and therefore move the funds to a fresh wallet with a new key.

For now though, I’d separate what we know from what we’re still trying to determine cause the investigation is still on going and evidence points to a private key compromise but is yet to establish who obtained the keys and who is behind the draining address. Currently there is no on-chain link between the LootBot team’s deployer wallet and the drainer, SomaXBT has also specifically clarified that he isn’t accusing LootBot team and a third party breach is possible. Although a statement from LootBot would be more convincing at this point. Thoughts ?? 🤔

[RGBTC]

I don't know what kind of software this is; besides, have Bitcoin users ever actually been motivated to create a dedicated wallet there to conduct transactions?
If I’ve understood the information correctly, this platform operates on Telegram. Therefore, the conclusion is that creating a wallet there would be suicidal.

[BitMaxz]

This is why I don't trust any 3rd parties. If you are taking any airdrops or free tokens from any site, make sure you always have a separate wallet. Don't connect your main wallet to protect most of your funds, and only deposit a small amount to the separate wallet for transaction fees.

I never heard of lootbot, but after checking the domain, it is a .xyz domain, which, for me, I can't trust any project that uses .xyz domains.
I hope some users are still able to move their funds to a new wallet.

[bitmover]

I never heard of lootbot, but after checking the domain, it is a .xyz domain, which, for me, I can't trust any project that uses .xyz domains.
I hope some users are still able to move their funds to a new wallet.

I got curious about this. Any reason for that? Have you seen many scams in .xyz?

.xyz were initially designed to be an alternative to .net and .com domains, for technology and inovation projects.

I saw many good solid projects using it.

Even google bought  them for Alphabet https://abc.xyz/

Also found this:
https://hackernoon.com/is-xyz-the-new-com-6f3c3e5829df

[shinratensei_]

Anyone genuinely storing money in a telegram bot generated address? like come on. You're letting third party generate an address for you, you never know the randomness it have and whether it would be enough, and the most fatal thing is, you don't even know if your private key is stored on their database. I never ever trusted any address created by these bots and treat them as already compromised, the developer behind the bot, if they ever stored your address info, can sweep it in under 1 seconds.

I never heard of lootbot, but after checking the domain, it is a .xyz domain, which, for me, I can't trust any project that uses .xyz domains.
I hope some users are still able to move their funds to a new wallet.

I got curious about this. Any reason for that? Have you seen many scams in .xyz?

.xyz were initially designed to be an alternative to .net and .com domains, for technology and inovation projects.

I saw many good solid projects using it.

Even google bought  them for Alphabet https://abc.xyz/

Also found this:
https://hackernoon.com/is-xyz-the-new-com-6f3c3e5829df

Tons of good project with .xyz domain like trade.xyz, it isn't the fault of the domain if it ever used for phishing or scams, it's just a domain and anyone can register one if they're willing. It's also not rare to see .com domains being used for scams.

[BlackBoss_]

There is a serious attack and wallet draining in more than 3800 wallets already affected, which is connected to users who might have been said to have connected their wallet to “lootbot” (a project which they alleged connected to a Vietnamese scammer who has stolen millions of dollars through a presale).

I don't know about the Lootbox project but when people want to do interactions with new projects, new sites, new smart contracts for either presale or airdrop, they must have a wallet for that purpose.

If people practice like creating one new wallet, funding it with the amount they want to join the presale, and have interactions with that wallet only, their other wallets and funds in those other wallets won't be affected.

It's a very basic principle but many people ignore this security advice.
If they follow this principle practically, maintain it, they will never lose big fund in their main wallets.

How to revoke token approval.

[avp2306]

I never heard of lootbot, but after checking the domain, it is a .xyz domain, which, for me, I can't trust any project that uses .xyz domains.
I hope some users are still able to move their funds to a new wallet.

I got curious about this. Any reason for that? Have you seen many scams in .xyz?

.xyz were initially designed to be an alternative to .net and .com domains, for technology and inovation projects.

I saw many good solid projects using it.

Even google bought  them for Alphabet https://abc.xyz/

Also found this:
https://hackernoon.com/is-xyz-the-new-com-6f3c3e5829df

I think because the .xyz is so cheap, this is the reason why many scammers choose to use that domain.

That one actually perfect for those people want to create clones, phising and for temporary site.

But yeah I agree that not all sites using .xyz are scam, but due to many scams happening and what people usually notice that the site scam them is using .xzy domain. It left some impression to people that majority of the site using that are just the same scam.