Ethereum

random

ZachXBT

Rocket Pool

On-chain researcher ZachXBT has noticed another wallet-draining attack, spanning dozens of addresses. The seemingly random hauls have all been connected to the Last Pass data breach, potentially exposing multiple wallets.&nbsp; 
ZachXBT reported a total of <a href="https://www.chainabuse.com/report/0ea24e3c-0b02-46f4-bb5d-5196700f0149?context=browse-all" rel="nofollow noopener" target="_blank">$5.36M</a> taken from personal wallets containing Bitcoin and assets from the Ethereum ecosystem. All the seemingly random addresses had one thing in common – using Last Pass as their password storage and protection. After a data leak in 2022, the list of wallets turned out to be compromised.&nbsp; 
ZachXBT also identified the attackers as a cohesive entity, the ‘Last Pass threat actor’. The attackers had a similar approach of draining the wallets, then immediately swapped through instant exchanges for Ethereum and Bitcoin. The attack affected multiple tokens, but the hackers were trying to simplify their holdings. 
<h3 id="span-style-font-weight-400-last-pass-victims-face-another-round-of-wallet-attacks-span">Last Pass victims face another round of wallet attacks</h3> 
Apparently, some of the wallet owners also stored private keys on the service, leaking direct access to the wallets. The actual attack happened long after the data leak, and there may be more wallets that are potentially exposed, but not drained yet.&nbsp; 
The recent batch of drained wallets includes crypto influencers with ENS names, as well as active <a href="https://www.cryptopolitan.com/hyperliquid-hype-debridge-native-dex/">DEX</a> and DeFi users. Despite being experienced, the exposed addresses led to total losses. Wallets automated to receive funds or rewards from smart contracts may be especially at risk. 
In one of the cases, the funds <a href="https://intel.arkm.com/explorer/address/0x7cc818422E795c98F0710aE63ceE1881f85541B9" rel="nofollow noopener" target="_blank">received</a> came from an OpenSea user, potentially from the sale of an NFT. In this case, the receiving wallet may be automated and already linked to the NFT marketplace. The wallet was drained soon after that, with the funds sent directly for an anonymous swap. 
More than 40 addresses in total were drained to date. In some cases, the addresses show evidence of being watched, as the draining happened right after a recent deposit of funds. Some of the wallets received funds from exchanges for <a href="https://www.cryptopolitan.com/ripple-crypto-storage-services-for-banks/">storage</a> or as intermediate holding, and were drained within a short time after the incoming transaction. 
ZachXBT had already tracked an earlier batch of 22 addresses, with losses exceeding $6.2M even at the earlier stage of the bull market. Other on-chain researchers have also sounded the alarm on potentially exposed wallets.&nbsp; 
<blockquote class="twitter-tweet" data-theme="dark"> 
 It’s been 2 years since Path sounded the alarm. 
 Since then we’ve investigated thousands of these thefts. 
 Including 2 more in the last few hours. 
 Please migrate your funds to fresh wallets if you’ve used LastPass. 
 Please tell your friends. 
 Please. Begging you. 🙏 <a href="https://t.co/5xd5oYxbwb" rel="nofollow" target="_blank">https://t.co/5xd5oYxbwb</a> 
 — Tay 💖 (@tayvano_) <a href="https://twitter.com/tayvano_/status/1868791243205230651?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">December 16, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The only solution for users is to abandon all potentially exposed wallets. The risk remains for anyone using Last Pass before the exploit in 2022. All funds must be moved to new addresses, as the old ones are already monitored for incoming transactions.&nbsp; 
The latest wallet attack follows a previous batch of wallets linked to Last Pass data. In October 2023, a total of 25 wallets were drained of $4.4M worth of digital coins and tokens. As previously reported, some of the wallets had substantial funds and belonged to crypto insiders, even VCs and DeFi developers.&nbsp; 
The previous hack did not alert all wallet owners exposed to Last Pass. <a href="https://www.cryptopolitan.com/zachxbt-the-masked-detective-unmasking-crypto-criminals/">ZachXBT</a> has previously warned about potentially exposed wallets, though the hackers still managed to attack more accounts.&nbsp; 
<h3 id="span-style-font-weight-400-hacks-sent-straight-to-exchanges-span">Hacks sent straight to exchanges</h3> 
Unlike other hacking attempts, the wallets were drained directly onto exchange accounts. This suggests the hacker had full control and decided to trade the funds as a way of concealing them. In one case, a <a href="https://app.nansen.ai/profiler?address=0xfb7ed59be933b145055b94aed31095827946daed&amp;name=0xfb7ed59be933b145055b94aed31095827946daed&amp;chain=ethereum&amp;tab=transactions" rel="nofollow noopener" target="_blank">wallet</a> was drained of 15 ETH, which were sent directly to a swapping address.&nbsp; 
Another wallet lost 32 ETH, which was <a href="https://intel.arkm.com/explorer/address/0x4E5B2e1dc63F6b91cb6Cd759936495434C7e972F" rel="nofollow noopener" target="_blank">sent</a> to the FixedFloat hot wallet. The exchange was used for other wallets as well. The exchange itself is not affected and is completely neutral to the hack. However, the DEX is a regular target for hackers, used to transform funds and cover their tracks. Previously, analysts have tracked funds from an attack against Rocket Pool to the same DEX.&nbsp; 
FixedFloat offers a simplified swap service with relatively high fees, without requiring an account or KYC. The exchange itself has been a target of hackers, when it was exploited in March for $26M in ETH and BTC.&nbsp; 
From Zero to Web3 Pro: Your 90-Day <a href="https://www.cryptopolitan.com/crypto-career-launchpad-waitlist/?utm_source=cryptopolitan&amp;utm_medium=banner&amp;utm_campaign=ccl-waitlist-3" target="_blank">Career Launch Plan</a>

ZachXBT explores $5.36M wallet-draining attack

Table of Contents

Cryptopolitan_News

Other articles published on Dec 17, 2024

Why Binance Coin (BNB) Could Be Your Best Bet this Crypto Bull Run

$6.9M Raised and 10% Price Hikes – A Must-Have as the Best Crypto to Hold for the Long Term as Ve...

Zoth and Singularity Finance Launch ZTLN Prime to Bring Institutional Grade Funds On-chain (17 Dec)

Weekly Article Recap: 12/09-12/13

Santa Rides Shiba (SANTSHIB) Memecoin Will Explode Over 19,000% Before Exchange Listing, While Sh...

Ripple News: Fresh ‘XRP ARMY’ Logo Unveiled by Designer Behind XRP’s Icon

Join our free newsletter for daily crypto updates!