1

So, I've been using MetaMask to trade on various DEX. On 6 March, all of my tokens were moved out of my MetaMask wallet. I am using a cold wallet to HODL but always keep a small balance for trading in Metamask. Is it possible someone could have gained access when I connected Metamask to some new yield farms like pooltoken.finance or meerkat.finance? It's impossible for someone to have gotten access to my seed phrase.

I traced the funds and this seems to be highly professional and large scale. the funds all end up in this account: 0x0823beBa3f1F0CAad19Ce9e5724C4f5CE0a2Fb97. Unlikely to collect so many seed phrases from so many people.

Anyone has any thoughts?

Improve this question
6
  • Hi there. How did you generate your private key/seed phrase? Metamask itself? Or was it imported from somewhere (e.g. Truffle/Ganache)?
    – Richard Horrocks
    Mar 13, 2021 at 20:48
  • I generated it with MetaMask back in 2017. I have this hunch it had something to do with these yield farming sites like pooltoken.finance where experimented a bit with pool tokens. it made me accept a pool token contract but i can't recollect in detail. could there have been some extensive permissions to send other tokens from metamask out?
    – Alex Tela
    Mar 13, 2021 at 21:14
  • Is there anything fishy here? -> etherscan.io/tokenapprovalchecker (or here approved.zone)
    – Richard Horrocks
    Mar 13, 2021 at 21:34
  • I'm not sure what i'm looking for but it does seem odd that it says for "approved amounts" either "unlimited" or "9,999,999".
    – Alex Tela
    Mar 13, 2021 at 22:13
  • That's relatively normal (though not necessarily good) - you'll find dapps often request one big approval amount so that a user doesn't have to keep re-approving allowances when they run out. It's a convenience thing, but one considered risky practice (coinmarketcap.com/alexandria/glossary/infinite-approval)
    – Richard Horrocks
    Mar 13, 2021 at 23:08

1 Answer 1

Reset to default
1

You did not provide the transaction hash of the stolen tokens so it's hard to pinpoint the exact cause.

However, since you have been experimenting with many DEX, it is possible that one of those was a scam that exploit the "approve" call you made before swaping. Typically, many DEX ask you to "approve" an unlimited amount of tokens before doing a swap. A scammer could design a DEX that allows him to withdraw all the tokens that you have approved. This has nothing to do with you private key, seed phrase or Metamask. If you did approve an unlimited amount of tokens to a contract, they can in fact do anything they want with your tokens including transferring them to another address.

The "approve" function should always only be called on contracts that you trust (or have read the code).

EDIT: In fact no, this is not what happened. The transaction you provided do not use the transferFrom() function that would have been use if you had approved tokens. Here we see direct transfer() that must be initiated by you or anyone who has the private key of your account. So, either you lost your private key, or you made these transfers yourself thinking that your were making a swap (the scammer could make a fake DEX website where you do transfers to him instead of swaps - you then approved these transfers in Metamask).

Improve this answer
8
  • 1
    Actually this seems very likely. I did not verify the contracts (I'm not a coder). Here is the hash from the 4 transactions that were used to siphon out 3 tokens and the remaining (luckily small) eth balance: 1. 0xc792a4e59bcef647e7647c04ee0b57e76b719fd0b79f514ff266669418a204b3 2. 0x98537db40c03d8221765a29e5c1eb8967996f176e70784a3bf09b7d1db0805fe 3. 0xf096baefdc72413b100636f0d780f405f569ab794294782d78888bf2dfa236c9 4. 0xbe2aee3250256823dcd569c118879fb97c922fd6e2811cd493e23dae12c72a12
    – Alex Tela
    Mar 14, 2021 at 10:38
  • In fact no, this is not what happened. The transaction you provided do not use the transferFrom() function that would have been use if you had approved tokens. Here we see direct transfer() that must be initiated by you or anyone who has the private key of your account. So, either you lost your private key, or you made these transfers yourself thinking that your were making a swap (the scammer could make a fake DEX website where you do transfers to him instead of swaps - you then approved these transfers in Metamask).
    – Undead8
    Mar 14, 2021 at 12:40
  • So, let's assume it was a fake DEX website. (I remember there was an error while doing a swap or while approving a contract, I can't recollect the details. But there was an error and I didn't think much about it... tried again and it worked). However, I didn't use any of the 3 tokens that were stolen on one of those new DEX websites. I got these tokens from Uniswap and they were just sitting in that same account. Could a fake DEX website still have accessed those?
    – Alex Tela
    Mar 14, 2021 at 19:44
  • No, you would need to either approve those tokens or transfer them directly (you do this by approving a transaction in Metamask). You should assume that you lost you private key somehow and create new accounts. Before that, uninstall Metamask and reinstall it from the official chrome/firefox extension store. Make sure your computer itself is also safe.
    – Undead8
    Mar 14, 2021 at 22:42
  • 1
    @djwd You should post a question and provide a link to the transaction in the question.
    – Undead8
    Apr 12, 2021 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.