1

I'm deeply ashamed to say but I got scammed on Discord with a link to a website that was advertising an NFT drop.

I clicked on "Login with metamask" and it opened a fake metamask overlay with an input to unlock my wallet, it looked exactly like the metamask window when it's locked. I put my password in there and then it asked for my 15 words mnemonic. That's when I realized this was a fake metamask overlay and sure enough, I clicked on my metamask icon and it opened the real one.

So at this point the password I use to unlock my metamask is comprimised

Interestingly enough, I watched the HTTP POST request go to a discord.com webhook. When I opened that URL with a GET request I got this:

{
   "type":1,
   "id":"911035908327895071",
   "name":"Captain Hook",
   "avatar":null,
   "channel_id":"910936613050265630",
   "guild_id":"910589640057176064",
   "application_id":null,
   "token":"e09HfloP6tJ6suppuQ18qUIxKOi35ZpvF5uJe382bvgGnYJzNI3QMJ7h21HAn9WiXbxQ"
}

Now I don't know if I needed to do this but I created a new ethereum address outside of metamask and sent my balance there

Now what can someone do with my metamask unlock password? What should I do now that it's compromised?

1
  • 2
    The worst that can happen is they gain access to your browser an steal the seed phrase losing control of your wallet. I'll recommend to change the password, check if there's malware in your computer. I'll also consider moving any funds to another seed phrase.
    – Ismael
    Nov 21, 2021 at 5:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.