1

So I got hacked on Metamask and all the funds lost. The hacker somehow connected to my google session and was able to get to the google drive files where I had couple of sensitive data. This was my mistake and I learnd from it. I had my 2FA enabled on google but there was not even one suspicios activity on my phone from google. The only proof I have is that I managed to get a print screen from Gmail session activity where I saw two strange IPs from other countries connected to my session. There is an asterix * that indicates the current session and it was marked at my IP and on the attacker IPs.

If you compare some Metamask wallet with let say Binance exchange the funds on exchange are infinitely more secure then Metamask. All you need for Metamask is secret phraze and the original owner cannot do anything to block the attacker from the wallet. The wallet now has basically two owners and there is nothing that can be done here. Fo Binance let say if you have good security enabled with 2FA, SMS, email confirmation it is very hard for the attacker to withdraw your funds even if he has email and password. If Binanace gets hacked and the attacker gets private key then it is the same story as with Metamask.

Basically etherum at its core I think is very very unsecure. I think some form of another confirmation of transaction either by SMS, Authenticator or email shoould be built into the network itself. Currently this implementation depends only from 3rd party developers if they implement multilayer security.

So what to use to trade some coins that are only on Uniswap and transactions have 2 layer security? Does even exisits some wallet with 2 layer security? It seems I need to become my own cybersecurity specialist just to trade some shitcoins :)

5
  • In blockchains like Ethereum, Bitcoin, .. you are your own bank. If you make a mistake it is your responsibility. Centralized exchanges like Binance provides some security but they can be also hacked. Less than two years ago it was hacked for 40 million USD and it passed the loses to its customers. For more security you can use a hardware wallet with Metamask. – Ismael Jan 14 at 2:40
  • Where or how has Google Drive and sensitive data on it played in all that? – アレックス Feb 2 at 7:01
  • got my seed phraze in a text file on google drive. I had all security on google account to max. – TheMentor Feb 2 at 12:37
  • I think I may have been hacked. I'm kinda new to crypto. My wallet is empty. could there be a mistake or is that just naive? I don't have any of key info on my computer. I wrote it all down on paper. And that's basically all I did... The tokens were on there and I didn't know how to move them. Any feedback appreciated... including.. if we buy tokens on something like metamask then what is a safe way to store them if they are not one of the popular coins? thank you – Simon T Feb 23 at 14:36
  • That wasn't secure then, I would suggest you to use a hardware wallet or even encrypting the files related to the cryptocurrency area with a password on your google drive – oktapodia Apr 3 at 13:24
4

Unsure where to start.

Ethereum, at its core, is not insecure in any sense. It has been proven time and again to be secure and it works as intended.

Now, let's list some things which are not part of the Ethereum core which may be insecure:

  • Wallets. These are created by an arbitrary third party and their security can be whatever.
  • Smart contract. These are also created by an arbitrary third party and their security can be whatever.
  • Various services connected to the network
  • People using Ethereum and the services around it (the user is typically the weakest link in any security)

Centralized exchanges have typically good security, yes. They have MFA and whatnot. This is because they are centralized: they collect your user information and they collect substantial fees from you so that they can run all of those processes and they have your user data to use (where to send confirmation emails, for example).

Now, decentralized exchanges obviously have none of those security settings since they are anonymous. And they can't have any of such security settings because there is no central authority to hold the data and do the KYC & AML screening and to send emails. And no assets to upkeep such structures.

The point of any decentralized system is that that the core is secure and users are free to build anything they want around it. Some of the stuff built around Ethereum is secure and some less secure. But if you don't like some service, you are free to build a better one.

If you want better wallet security you could consider hardware wallets. Also, Metamask can't be hacked by just knowing some secret phrase (unless it's your private key, in which case it has nothing to do with Metamask). Metamask stores the private key locally and encrypts it with the password you give - the attacker needs both your password and the locally encrypted keyfile to get to your private key.

3
  • Well...no. Metamask Seed Phrase (those 6 or 7 words which seems are also private key somehow) is enough that the attacker is basically another owner of your wallet. They do not need any password. They import wallet at their computer with seed phraze with their own password which is password just for that local computer and they can tranfer monney from your wallet. One seed phraze which is basically just a little more complex password and you need to write it down on a paper and not store it electronically is the only layer of security on decentralized exchanges. So from a security stand point. – TheMentor Jan 13 at 17:45
  • ....very bad desing for some massive general public use. Not to mention the code base for Metamask is open source and the attacker can really study its holes. The concept of wallet and its security should be build into the network itself. Now I am maybe blabbing nonsens here since I dont know technical details of eth network but what is etherum without users and their wallets. Is there another purpose to it? – TheMentor Jan 13 at 17:46
  • @TheMentor don't use virtual wallets. Problem solved. I know this is a difficult issue, but you should never consider a virtual wallet as secure IN ANY SENSE. It is, by nature, hackable without a physical device.. if you store on a cold wallet (which you can integrate with MM easily) then nobody is authorising a transaction without that physical device. – Damien Roche Feb 16 at 0:08
0

My metamask has been compromised, as soon as eth is deposited it is automatically shipped to another address, however I still have numerous other coins in there. How can I transfer them out without eth that will just get stolen the minute I deposit it. Any help would be amazing.

0
  1. You could try using the Binance Smart Chain in case any of the coins support transactions via BSC, which use BNB to pay for the "gas" of each transaction. Or any other chain that's not the Ethereum one for that matter, just verify which coins are supported by other chains and which chains are supported by Metamask.

  2. Check if there's a way to block that ETH address on your metamask account, which will buy you extra time after receiving the Eth to perform all the transactions towards your secondary wallet.

Hope any of these work out, or are even possible, best of luck

1
  • I think no way to block it. You basically need to be faster than the thief. – TheMentor Feb 2 at 12:36
0

I've been hacked for 30k too. I had a virus in my computer that was here way before I started using Metamask. *which I've got while surfing the dark web.

The lesson I've learned: DO NOT use Metamask if you don't have a reliable (paid) antivirus. It's the digital age, people. Don't be cheap like me and get the antivirus software.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.