Got hacked on my metamask account. Call me a n00b, stupid, whatever.

But I want to understand how that is even possible. I need to understand what has been compromised. I am even worried now to use my Trezor (which was not involved with the metamask account).

What happend: I had a couple of SAIs and DAIs on my account sitting there for like 3 months. I got a last transaction 2 weeks ago.

Then someone sent me some ETH and then moved everything out.

It's not my life savings but it always hurts, especially if one believes to not be the dumbest dumbfuck.

So - please help me understand, how is that even possible? I usually use Trezor for all crypto stuff, but for a specific app they suggested to use metamask to be paid. These guys are absolutely trustworthy.

The metamask interface even shows "History: You have no transactions" for that account. So I can exclude to have made a transaction 3am totally drunk. I should conclude that someone has access to the private key?

So AFAIK, "Metamask stores your private keys using your browser's data store. " "Metamask is a Chrome extension (or is directly integrated with Brave), and it stores its private keys in the browser -- not on a remote server" Does metamask store private key on server or anywhere else?

This means that someone must have got access to my browser. 19th April I had my cache completely wiped. My metamask is secured via password which is very complex and stored in pass.

I can't imagine any other way someone may have got access to my private keys...?

  • How did you generate metamask's menmonic? Did you use that mnemonic in another wallet? Did you backup it in someplace?
    – Ismael
    May 13 '20 at 3:58
  • Same thing happened to me :/ Answers like 'maybe someone got your seed file' are not very illuminating. Presumably people who use ethereum and are on stack overflow are aware of that. So, yeah, sure maybe that happened, but we also do try to protect against that kind of thing (I'm also using Linux, BTW). What seems far more likely is that there is some kind of XSS-like attack, or that some part of the seed can be generated to make a kind of rainbow table. But y'know... I got my ETH stolen too, so what do I know? ;) I really would like to find out though, because if my machine has been hacked Sep 10 '20 at 17:22
  • Did you enter your mnemonic anywhere other than Metamask (e.g. MyEtherWallet/MyCrypto/...)? Maybe you fell for a phishing site.
    – Bobface
    Sep 10 '20 at 17:30

Where did you save your MetaMask Secret Backup Phrase (menmonic)? If someone get access to that, it means he has your private key, hence your wallet and your money. He can easily transfer all of your money to his wallet. Your private key is your Secret Backup Phrase and only the encrypted version is stored inside the browser, which means no one can decrypt it and get back the Backup Phrase. Someone must have copied your Backup phrase.

  • Yeah. The question is how. I have the mnemonic saved inside keepass. The password for keepass is not trivial to say the least. I live in the mountains with just my wife, so nobody peeping over my shoulders...I literally can't fathom how this can have happened. Ah, I did not write the mnemonic on paper.
    – cryptot00l
    May 13 '20 at 13:20

If your computer is hacked (from downloading an infected app / running it, or your web browser becoming infected from an un-patched attack vector after visiting a malicious site / installing malicious add-on), all bets are off on security of ANY kind.

A keystroke logger could have captured your metamask password (then they could decrypt your private key in the browser cache). Or a clipboard logger could have captured you copy / pasting your seed phrase.

If you use Windows, grab a decent virus scanner like bitdefender and scan your system for viruses.

  • Right. I use linux though so the keylogger is extremely unlikely.
    – cryptot00l
    May 16 '20 at 21:38
  • Sure, but what do you have for browser addons? That type of malware is cross-platform and very prevelent, because hackers can see every you do in the browser with proper permissions allowed.
    – M. K.
    May 19 '20 at 6:06

I'm new to this with in 2 years. But, I try to do my homework. And what I conclude and do is strictly tied to my Crypto.

  1. Get away from any computer, except a MAC 2)All seeds should be written, not stored, saved,or screen shot
  2. If you have money to buy Crypto you have money to separate the best way you can. Use 1 wallet to store and save, only you will transferring to and from it. Use all other wallets to receive and send. Ok, someone send you ethereum to your make shift wallet, as soon as you get it move it to your main wallet as for keeping your other wallets 0 at all times, but these the ones you really worry about because you not storing here just transacting here. Same when you send, send to yourself, and then send to who you want to have it.
  3. last but not least Apple Cellular device to conduct business of Crypto and even its own device with its own number for Crypto. But, the Cellular is just for viewing, buying, or selling not transferring Crypto. All though you could but you will do it the same as # 3 , but connected to your personal WiFi not Cellular service or some local Hotspot! The security is only as good as you and how you layer it. No footprints is the key. Get you a family pack of Ledgers 1or 2 for storing and the others for transferring... just like a Bank Account. You move money from your savings to your checking for transactions, big deposit in checking and move some to your savings, but you still leary even when setup all these precautions. Thanks LJ

Not the answer you're looking for? Browse other questions tagged or ask your own question.