My private key just got stolen. The thieve sent to me a message starting by ”nice payment for your work„ on https://chat.blockscan.com along an e‑mail from
[email protected] revealing a seedphrase telling he performed a hack linked to the Profanity vulnerability.
But although it’s normally possible to build a seed phrase for almost all addresses, I didn’t use a software linked to that. I generated that address in 2017 using Parity Ethereum and never used a seedphrase (only the privatekey). I also don’t own any kind of ɢᴘᴜ except on my phone. There are no public links to my Ethereum address and my e‑mail so, the most likely case is the private key got stolen from a Python script on the server’s provider which is https://sdfeu.org which could explain how my e‑mail address could be found or how the attacker found my Ethereum account.
But my money temporarily landed on a well identified address from a bot trading service. When I confronted it’s owner on Telegram without sharing any details, instead of telling it was something like a received payment, I was told yet again about the Profanity hack, but that time, to assert that the address was compromised and that ownership of the Token was transferred to a new address.
That seems strange to me because the address weren’t relabelled as
old on Etherscan and it never had significant funds and the contract’s ownership transfer dates from 62 days ago whereas the Profanity hack is more than 1 year old. And if true, the only thing that was stolen from him was his remaining balance of 0.002352784892748944eth : a single transaction with a dust amount that says nothing on how it could had happened.
What do do :
Nerveless, any defence arguments needs to debunked with a proof. So if the address with 0 funds starting by
0xF43D was really attacked using the Profanity vulnerability, then the deterministic alghorithm from 1inch should work on the public key.
But the only reference code I found about it is :
Since the disclosure of accurate information can lead to hacking other projects, you will only see generalized data here.
So how to prove the said deterministic algorithm doesn’t works ? Meanwhile, funds were transfered to a that time centralized bot trading service that use Union Chain as it’s withdrawal mechanism but I wasn’t able to find to which platform https://etherscan.io/txs?a=0xbfcd86e36d947a9103a7d4a95d178a432723d6ad corresponds to.