Got hacked on metamask - but how?

Question

Got hacked on my metamask account. Call me a n00b, stupid, whatever.

But I want to understand how that is even possible. I need to understand what has been compromised. I am even worried now to use my Trezor (which was not involved with the metamask account).

What happend: I had a couple of SAIs and DAIs on my account sitting there for like 3 months. I got a last transaction 2 weeks ago.

Then someone sent me some ETH and then moved everything out.

It's not my life savings but it always hurts, especially if one believes to not be the dumbest dumbfuck.

So - please help me understand, how is that even possible? I usually use Trezor for all crypto stuff, but for a specific app they suggested to use metamask to be paid. These guys are absolutely trustworthy.

The metamask interface even shows "History: You have no transactions" for that account. So I can exclude to have made a transaction 3am totally drunk. I should conclude that someone has access to the private key?

So AFAIK, "Metamask stores your private keys using your browser's data store. " "Metamask is a Chrome extension (or is directly integrated with Brave), and it stores its private keys in the browser -- not on a remote server" Does metamask store private key on server or anywhere else?

This means that someone must have got access to my browser. 19th April I had my cache completely wiped. My metamask is secured via password which is very complex and stored in pass.

I can't imagine any other way someone may have got access to my private keys...?

Answer 1

Where did you save your MetaMask Secret Backup Phrase (menmonic)? If someone get access to that, it means he has your private key, hence your wallet and your money. He can easily transfer all of your money to his wallet. Your private key is your Secret Backup Phrase and only the encrypted version is stored inside the browser, which means no one can decrypt it and get back the Backup Phrase. Someone must have copied your Backup phrase.

Answer 2

If your computer is hacked (from downloading an infected app / running it, or your web browser becoming infected from an un-patched attack vector after visiting a malicious site / installing malicious add-on), all bets are off on security of ANY kind.

A keystroke logger could have captured your metamask password (then they could decrypt your private key in the browser cache). Or a clipboard logger could have captured you copy / pasting your seed phrase.

If you use Windows, grab a decent virus scanner like bitdefender and scan your system for viruses.

Answer 3

I'm new to this with in 2 years. But, I try to do my homework. And what I conclude and do is strictly tied to my Crypto.

1. Get away from any computer, except a MAC 2)All seeds should be written, not stored, saved,or screen shot
2. If you have money to buy Crypto you have money to separate the best way you can. Use 1 wallet to store and save, only you will transferring to and from it. Use all other wallets to receive and send. Ok, someone send you ethereum to your make shift wallet, as soon as you get it move it to your main wallet as for keeping your other wallets 0 at all times, but these the ones you really worry about because you not storing here just transacting here. Same when you send, send to yourself, and then send to who you want to have it.
3. last but not least Apple Cellular device to conduct business of Crypto and even its own device with its own number for Crypto. But, the Cellular is just for viewing, buying, or selling not transferring Crypto. All though you could but you will do it the same as # 3 , but connected to your personal WiFi not Cellular service or some local Hotspot! The security is only as good as you and how you layer it. No footprints is the key. Get you a family pack of Ledgers 1or 2 for storing and the others for transferring... just like a Bank Account. You move money from your savings to your checking for transactions, big deposit in checking and move some to your savings, but you still leary even when setup all these precautions. Thanks LJ

Answer 4

Because it shows "You have no transactions", there is a possibility you have not lost your coins. Instead, it's possible that you have lost track of your account, and once you find the correct account, it will still have the coins in it.

This is an example of the mathematical derivation path used in crypto wallets:

Mnemonic 0 > Private Key 0 > Public Key 0 > Account Address 00 > Contract Address 000
                                                               > Contract Address 001
                                                               > Contract Address 002
                                                               > Contract Address 003
                                                               > Contract Address 004
                                                               > ...
Mnemonic 0 > Private Key 1 > Public Key 1 > Account Address 01 > Contract Address 010
                                                               > Contract Address 011
                                                               > Contract Address 012
                                                               > Contract Address 013
                                                               > Contract Address 014
                                                               > ...
Mnemonic 0 > Private Key 2 > Public Key 2 > Account Address 02 > ...
                                                               > ...
Mnemonic 0 > Private Key 3 > Public Key 3 > Account Address 03 > ...
                                                               > ...
Mnemonic 0 > Private Key 4 > Public Key 4 > Account Address 04 > ...
                                                               > ...

The first part Mnemonic > Private Key is optional, but used in Metamask and all wallets where you have "secret recovery phrases" i.e. mnemonics. You can also start off with a private key, skipping the first step.

These steps are "deterministic", meaning if you start with the same mnemonic (e.g. 12 word recovery phrase) you end up calculating the same private keys, from which you calculate the same publics key, and so on, every time. There is no randomness or variance.

From this mnemonic + a counter, you can calculate many private keys. The counter is called a "nonce" and the mnemonic with a nonce of "0" gives you your first address. This is probably what address you used in metamask.

The mnemonic when used with the next nonce of "1" gives you another Account Address, and so on. (The same process is used to derive multiple contract addresses from one account address.)

My point is, all these account addresses are derived from the same Secret Recovery Phrase, in sequence. They are all your accounts, and they all come from the same Recovery Phrase.

And I suspect metamask is just not looking at the correct nonce (sequence number) i.e. not the correct account.

If you know your original account address (which looks like a 0x followed by a 40 character hex string; possibly you would have shared this account address in order to receive funds) then just pop over to blockscan.com where you can publicly see which chains this address is on, and look at the account balance and transactions on the etherscan website (assuming you used this on ethereum).

If you can see the previous transaction amounts and dates and they match up with what you remember, and yet now the current balance is zero, then yes you lost the funds. But you can also see which account address the funds have been sent to and when.

More importantly, if you can't see your previous transactions directly on the blockchain via a blockchain explorer (like etherscan.io for ethereum), then it's clear that you have the wrong account address. The blockchain is immutable and past transactions cannot disappear.

Re-setup Metamask by removing the account, and re-adding it using the original 12-word recovery phrase. The first account is created with nonce 0. Keep creating additional accounts (Metamask will use the same private key and automatically increment the nonce, to 1, 2, 3 and so on) till you hit the correct account with balance in it.

Here is the related answer from the metamask site: https://metamask.zendesk.com/hc/en-us/articles/360015489271-How-to-add-missing-accounts-after-restoring-with-Secret-Recovery-Phrase

There are online services to recover missing crypto from metamask wallet which can identify these accounts and display on-chain balances to identify the right accounts but it's better if you can download and run such software locally. Also immediately move the funds to another account after recovery.