I made a new secondary account under my wallet and immediately transferred funds to it through Coinbase exchange. In less than 4 mins, the new account made a random unauthorized transfer to a random wallet.

New Metamask secondary account address (0x0DAdE918Adb44f2CbA379032e537677d3F264f41) https://etherscan.io/address/0x0dade918adb44f2cba379032e537677d3f264f41

Random wallet address (0x9A48cA8B47748844Ff66337116CDADD8248c1ceE) https://etherscan.io/address/0x9a48ca8b47748844ff66337116cdadd8248c1cee

After deposit, the funds in the account were immediately forwarded to the random wallet. No history of sent transaction or confirmation.

enter image description here

I immediately retraced my search history, found no fraudulent or fake websites. I always take extreme measures as well. Haven't downloaded or open recent .exes, nor clicked on any phishing links. Since the account creation is very new and the Coinbase funds were sent to the account immediately afterwards, it is hard to think there could've been a password leak or scam. I store my key in a private discord server, with me being the only member, where I store all my other keys. My Metamask primary account 1 remain untouched along with all my other third-party wallets. I made another $5 transaction deposit from Coinbase right afterwards, and the funds is still sitting in my secondary account as seen above.

I did some digging and notice another wallet address experienced the same situation as me.

(0x6F13F98168B43913DBfa4C3D442D51E79a2E14EA) https://etherscan.io/address/0x6f13f98168b43913dbfa4c3d442d51e79a2e14ea

The wallet made a deposit from a central exchange, exactly 4 minutes later it was sent to the same random wallet.

Is this type of scenario even possible? I want to suspect it is a scam or leak, but I couldn't find any traces of it from my end. Help would be much appreciated.

  • 1
    Difficult to know what went wrong. But reading about you storing keys in a private Discord server is extremely bad practice. Use a real password manager. Jan 12 at 20:47

1 Answer 1


As lauri said in the comments, never store your wallet on an online platform/software.

The "new" wallet you created already had transactions made on: BSC Cronos.

Please make sure to create a new wallet with a seed/private key where no one has access too even discord is no good place to store anything at all.

If your practice of storing private keys/seeds is like this, i would advise you (DYOR/NFA) to create new wallets where NO ONE ELSE can access your private key or SEED ever.

  • I follow on your lead and found the "new" wallet is a used wallet by the attacker. I think the culprit was a malware called ViperSoftX that installed itself in the system log and created a fake google doc extension that had an API which secretly replaced the recipient wallet address with the attackers. As suggested, I off-line everything, removed the extension, rebooted my system, and discarded my old wallets. Thank you for the advices.
    – heng heng
    Jan 13 at 6:52
  • Nice to hear that you have found the cause:, Would recommend looking into more advanced wallet setups like hardware wallets which is more safer. I wish you luck in your web3/crypto journey.
    – Plair
    Jan 13 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.