How did I get my private key stolen?

Question

Recently i received around 1400 USDC on my Ethereum wallet that I access through Metamask. Today I opened Metamask because I wanted to transfer those USDC, but I found that there were no USDC anymore in my wallet.

This is my address on etherscan: https://etherscan.io/address/0xa1ed7b3740994bd6919483405a35264f9f57e506. Looking to the ERC20 token transfers, I found out that around three days ago there is a transfer of my 1410.21 USDC to 0x532D6c35178195Dde7ff21510eB77d6FF8f08844.

I never signed this transfer transaction, and I have never interacted with any DeFi protocol or website using the wallet where i was holding the USDC (0xa1ed7b3740994bd6919483405a35264f9f57e506) on Ethereum, but I have interacted with Defi protocols on other chains with the same wallet. I also never shared my metamask password and private key by any means. The only potential problem that I see is that the metamask password is the same password that i use for many other web2/web3 authentications (so it may have been leaked somehow).

I can't understand how the attacker was able to steal my private key. If we look into the suspect transfer transaction (https://etherscan.io/tx/0x233bd512a359b6e0863355fcb0e79dc45cc8b107484d1e68785220e9b7e26820), we can see that the "from" is my wallet address, so I deduced that the attacker must have access to my private key, otherwise they wouldn't have been able to sign the transfer transaction.

Moreover, I have around 250$ worth of other tokens in the mentioned wallet (on other chains, not on Ethereum), but they have not been stolen, and I don't understand why.

I understand that I don't have many chances to get my funds back, but at least I would like to understand what happened and how should I act now.

Thanks in advance for any useful answer.

Edit: Looking at the scammer's transactions i found that there is another account (0x76A02bB3d4E6fCb32643A9cA38569f1A959b9d2c) from which 437.5 USDC were stolen by the scammer: the interesting fact is that those 437.5 USDC came from a Disperse.app transaction (https://etherscan.io/tx/0x2b693ee3dad3c72f576438e6a4013ac6f5136bc1f580075a8234f97e45f1dc04) very similar to the one from which my stolen USDC came (https://etherscan.io/tx/0xf89c5dbfde1a777450d37e4c787837209ffd520e8d4aa9095e04131b579ecc25). They are similar because they are both transactions that distribute USDC to various addresses using Disperse.app and the signer is the same address (https://etherscan.io/address/0xe993486b257cd1481aef74b3b909a2627fc8d305). To add a bit of context, i won the stolen USDC at the EthGlobal Paris hackathon, so i guess that they used Disperse.app to distribute the prizes to the winners. This makes me think that also the 437.5 USDC that were stolen from the other account that i mentioned should be an EthGlobal prize, and makes me wonder if this could mean anything in particular. Maybe the private keys theft happened in the context of the ethglobal hackathon? It feels strange that the scammer was able to steal from (at least) two addresses involved with the hackathon, given that the total number of scammed addresses are not so many.

Answer 1

The attacker used the transfer() function to transfer the USDC, which means it came from your private key. If you didn't sign any suspicious messages then that means the attacker has your private key.

Your metamask password (the passphrase not the mnemonic) would only be relevant to an attacker if they also had remote access to your computer and the browser which you have metamask on.

I see your Ether balance was also drained to same account; the attacker may be running a sweeper bot on your account, in case you try and deposit any more Ether.

Regarding the other chains, maybe the attacker just didn't realize.

On a side note, what is Disperse.app? I see this come up a few times in other addresses the attacker transferred from

Answer 2

If the transaction that drained your USDC is the one you linked, then there's zero doubt that the attacker has your private key since that transaction came from your wallet. In order to submit a transaction from 0xa1ed7B3740994BD6919483405a35264f9F57e506 the only way is to have the private key of that address. And since they have your private key, they could drain that same address from any other EVM chain from its native currency, ERC20 tokens and NFTs. Now the fact that they didn't systematically drain everything anytime that was possible doesn't say they don't have your private key, it just says that you have a bit of hope to salvage whatever you can before switching to another address.

As mentioned by @peter the Metamask password should normally not be relevant in this case. That password only protects your wallets from people who have access to your computer. Now maybe someone had access to your computer in a way you wouldn't expect.

Since you mentioned ETHGlobal, there is one possibility. Did you try running other people's projects? As in: git clone their repo and run yarn start or whatever command starts the projects? I noticed once at a previous ETHGlobal hackathon that a team had submitted a project that contained malicious code. The whole project looked super legit but a malicious piece of code was hidden in a fake express middleware. What it did (among other things) was look for some folders inside your chrome profile storage and upload files from there to a remote server.

If someone had access to your metamask's storage (typically available in your filesystem in Chrome's data dir) + your metamask password, then they could exfiltrate your private keys.