3

Recently i received around 1400 USDC on my Ethereum wallet that I access through Metamask. Today I opened Metamask because I wanted to transfer those USDC, but I found that there were no USDC anymore in my wallet.

This is my address on etherscan: https://etherscan.io/address/0xa1ed7b3740994bd6919483405a35264f9f57e506. Looking to the ERC20 token transfers, I found out that around three days ago there is a transfer of my 1410.21 USDC to 0x532D6c35178195Dde7ff21510eB77d6FF8f08844.

I never signed this transfer transaction, and I have never interacted with any DeFi protocol or website using the wallet where i was holding the USDC (0xa1ed7b3740994bd6919483405a35264f9f57e506) on Ethereum, but I have interacted with Defi protocols on other chains with the same wallet. I also never shared my metamask password and private key by any means. The only potential problem that I see is that the metamask password is the same password that i use for many other web2/web3 authentications (so it may have been leaked somehow).

I can't understand how the attacker was able to steal my private key. If we look into the suspect transfer transaction (https://etherscan.io/tx/0x233bd512a359b6e0863355fcb0e79dc45cc8b107484d1e68785220e9b7e26820), we can see that the "from" is my wallet address, so I deduced that the attacker must have access to my private key, otherwise they wouldn't have been able to sign the transfer transaction.

Moreover, I have around 250$ worth of other tokens in the mentioned wallet (on other chains, not on Ethereum), but they have not been stolen, and I don't understand why.

I understand that I don't have many chances to get my funds back, but at least I would like to understand what happened and how should I act now.

Thanks in advance for any useful answer.

Edit: Looking at the scammer's transactions i found that there is another account (0x76A02bB3d4E6fCb32643A9cA38569f1A959b9d2c) from which 437.5 USDC were stolen by the scammer: the interesting fact is that those 437.5 USDC came from a Disperse.app transaction (https://etherscan.io/tx/0x2b693ee3dad3c72f576438e6a4013ac6f5136bc1f580075a8234f97e45f1dc04) very similar to the one from which my stolen USDC came (https://etherscan.io/tx/0xf89c5dbfde1a777450d37e4c787837209ffd520e8d4aa9095e04131b579ecc25). They are similar because they are both transactions that distribute USDC to various addresses using Disperse.app and the signer is the same address (https://etherscan.io/address/0xe993486b257cd1481aef74b3b909a2627fc8d305). To add a bit of context, i won the stolen USDC at the EthGlobal Paris hackathon, so i guess that they used Disperse.app to distribute the prizes to the winners. This makes me think that also the 437.5 USDC that were stolen from the other account that i mentioned should be an EthGlobal prize, and makes me wonder if this could mean anything in particular. Maybe the private keys theft happened in the context of the ethglobal hackathon? It feels strange that the scammer was able to steal from (at least) two addresses involved with the hackathon, given that the total number of scammed addresses are not so many.

5
  • If you are very sure that the private key was safe from your side, then this might be a case of random private key guessing. Not sure. Aug 24, 2023 at 12:07
  • Scammer has your key, you should focus on how that could of been leaked, and move to using a hardware wallet, or something where your keys never leave the device for hardware connected to the internet. If you generated the key with metamask it is not likley someone guessed it.
    – Maka
    Aug 24, 2023 at 13:17
  • 2
    There are more private keys than atoms estimated to exist in the known universe (not sure how they came to this number). So guessing a private key for an account that 'already exists' is effectively impossible
    – Peter
    Aug 24, 2023 at 19:03
  • It is not impossible, it is highly improbable. Aug 25, 2023 at 12:19
  • Hence why I said "effectively impossible". Pay more attention when reading please
    – Peter
    Aug 25, 2023 at 17:26

2 Answers 2

5

The attacker used the transfer() function to transfer the USDC, which means it came from your private key. If you didn't sign any suspicious messages then that means the attacker has your private key.

Your metamask password (the passphrase not the mnemonic) would only be relevant to an attacker if they also had remote access to your computer and the browser which you have metamask on.

I see your Ether balance was also drained to same account; the attacker may be running a sweeper bot on your account, in case you try and deposit any more Ether.

Regarding the other chains, maybe the attacker just didn't realize.

On a side note, what is Disperse.app? I see this come up a few times in other addresses the attacker transferred from

5
  • 1
    hi Peter, thanks for your answer. First, my ether balance was not drained by the attacker (i made the 0.05 and 1.94 eth transfers on purpose). The attacker just sent me some eth before the malicious transaction in which he stole USDC in order to pay for gas and took back the remaining eth after the malicious tx. Disperse.app is a service for sending eth or tokens to multiple addresses. I won those USDC in the EthGlobal Paris hackaton, so I suppose it is the service they used to distribute the prizes. I wonder if the problem could be somehow related to this.
    – Andrea
    Aug 24, 2023 at 13:31
  • If you look at the edit section in the original question I provided more details about the Disperse.app transactions. Does that tell anything to you?
    – Andrea
    Aug 24, 2023 at 17:30
  • @Andrea Their disperseToken() function just takes some input addresses and sends out USDC, nothing malicious. So assuming you provided the address for them to send to (and they didn't pick it), there is no room for malicious activity. I see on your address you have transactions from Avalanche and Polygon from over a year ago. It's possible your private key was exposed a long time ago, but never had any value worth taking. Always good to rotate keys regularly and use a hardware wallet for longer term storage.
    – Peter
    Aug 24, 2023 at 19:19
  • thanks again. Of course, i didn't mean that Disperse.app could be malicious; i meant that maybe the private keys theft may have happened in the context of the ethglobal hackathon (during or after), because both the diverse.app transactions that i mentioned in the edit section are distributions of ethglobal prizes. So it feels strange to me that the scammer was able to steal from (at least) two addresses involved with the hackathon, given that the total number of scammed addresses are not so many.
    – Andrea
    Aug 24, 2023 at 20:13
  • Regarding the fact that the private key may have been leaked a long time ago, i held 2 eth for about 3 days recently in that same wallet, so i think they should probably have been stolen too if it was the case.
    – Andrea
    Aug 24, 2023 at 20:17
3

If the transaction that drained your USDC is the one you linked, then there's zero doubt that the attacker has your private key since that transaction came from your wallet. In order to submit a transaction from 0xa1ed7B3740994BD6919483405a35264f9F57e506 the only way is to have the private key of that address. And since they have your private key, they could drain that same address from any other EVM chain from its native currency, ERC20 tokens and NFTs. Now the fact that they didn't systematically drain everything anytime that was possible doesn't say they don't have your private key, it just says that you have a bit of hope to salvage whatever you can before switching to another address.

As mentioned by @peter the Metamask password should normally not be relevant in this case. That password only protects your wallets from people who have access to your computer. Now maybe someone had access to your computer in a way you wouldn't expect.

Since you mentioned ETHGlobal, there is one possibility. Did you try running other people's projects? As in: git clone their repo and run yarn start or whatever command starts the projects? I noticed once at a previous ETHGlobal hackathon that a team had submitted a project that contained malicious code. The whole project looked super legit but a malicious piece of code was hidden in a fake express middleware. What it did (among other things) was look for some folders inside your chrome profile storage and upload files from there to a remote server.

If someone had access to your metamask's storage (typically available in your filesystem in Chrome's data dir) + your metamask password, then they could exfiltrate your private keys.

2
  • 1
    yeah, the attacker has my private key and that's for sure. I din't clone and run any other people's project at the hackathon, but I did actually leave my mac unattended a couple of times for brief periods (even though the mac obviously has a password). As I mentioned in the question, I am starting to think that the private keys theft could have happened in the context of the hackaton, because i found out that another account who won a prize at the same hackaton was victim of this scammer. Moreover, the scammer's wallet activity started right after the distribution of the prizes.
    – Andrea
    Aug 25, 2023 at 10:25
  • Yep sounds like this might be it then. Sucks to have to be wary of people during a hackathon
    – Mouradif
    Aug 25, 2023 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.