Got hacked on my metamask account. Call me a n00b, stupid, whatever.

But I want to understand how that is even possible. I need to understand what has been compromised. I am even worried now to use my Trezor (which was not involved with the metamask account).

What happend: I had a couple of SAIs and DAIs on my account sitting there for like 3 months. I got a last transaction 2 weeks ago.

Then someone sent me some ETH and then moved everything out.

It's not my life savings but it always hurts, especially if one believes to not be the dumbest dumbfuck.

So - please help me understand, how is that even possible? I usually use Trezor for all crypto stuff, but for a specific app they suggested to use metamask to be paid. These guys are absolutely trustworthy.

The metamask interface even shows "History: You have no transactions" for that account. So I can exclude to have made a transaction 3am totally drunk. I should conclude that someone has access to the private key?

So AFAIK, "Metamask stores your private keys using your browser's data store. " "Metamask is a Chrome extension (or is directly integrated with Brave), and it stores its private keys in the browser -- not on a remote server" Does metamask store private key on server or anywhere else?

This means that someone must have got access to my browser. 19th April I had my cache completely wiped. My metamask is secured via password which is very complex and stored in pass.

I can't imagine any other way someone may have got access to my private keys...?

  • How did you generate metamask's menmonic? Did you use that mnemonic in another wallet? Did you backup it in someplace? – Ismael May 13 at 3:58

Where did you save your MetaMask Secret Backup Phrase (menmonic)? If someone get access to that, it means he has your private key, hence your wallet and your money. He can easily transfer all of your money to his wallet. Your private key is your Secret Backup Phrase and only the encrypted version is stored inside the browser, which means no one can decrypt it and get back the Backup Phrase. Someone must have copied your Backup phrase.

| improve this answer | |
  • Yeah. The question is how. I have the mnemonic saved inside keepass. The password for keepass is not trivial to say the least. I live in the mountains with just my wife, so nobody peeping over my shoulders...I literally can't fathom how this can have happened. Ah, I did not write the mnemonic on paper. – cryptot00l May 13 at 13:20

If your computer is hacked (from downloading an infected app / running it, or your web browser becoming infected from an un-patched attack vector after visiting a malicious site / installing malicious add-on), all bets are off on security of ANY kind.

A keystroke logger could have captured your metamask password (then they could decrypt your private key in the browser cache). Or a clipboard logger could have captured you copy / pasting your seed phrase.

If you use Windows, grab a decent virus scanner like bitdefender and scan your system for viruses.

| improve this answer | |
  • Right. I use linux though so the keylogger is extremely unlikely. – cryptot00l May 16 at 21:38
  • Sure, but what do you have for browser addons? That type of malware is cross-platform and very prevelent, because hackers can see every you do in the browser with proper permissions allowed. – Michael Kilday May 19 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.