1

I was using my Trust wallet on my mobile and tried to do a swap from ETH to an ERC20 token but realized a day after that it got drained to this account: https://etherscan.io/address/0x2b5b060d57b1333c9b2739e9c15b039726dd51ec#comments

It also seems that this person was able to steal from others too. My main question now is how did this happen?

When I did the swap, I received my ERC-20 tokens, and it was sitting in my account fine. But looking at the blockchain, 5 hours later it moved to this person's wallet. However I bought another ERC20 token and managed to get it out when it arrived. So its safe to assume this "loophole" is done manually and there isn't a bot monitoring my address. Currently my ETH account still has $150 worth of ETH that isn't drained.

So I'm not sure what type of loophole did this hacker is using to steal my ERC20 tokens. Right now the possibilities is either trust wallet or Uniswap is comprised.

9
  • What wallet did you use to carry the Transaction? Are you sure your device is not compromised by malware?? Also did you check if the token had a Approval function?? Mar 16 at 17:17
  • how and where do i check this on etherscan? when giving approval function is it only gives approval to send that erc-20 token only and not others? what about ETH itself? does this explain why my still have ETH in my wallet? Mar 16 at 17:52
  • It will be easier to diagnose the problem if the Token Smart contract is known. Mar 16 at 18:28
  • This was the transaction that stole the token: etherscan.io/tx/… Mar 16 at 18:32
  • Here's Etherscan's approval checker for your address (looks like only USDC has been approved): etherscan.io/… Mar 16 at 19:51
2

There are many possibles reasons that this happened and I will try to list them all.

First of all, the problematic transaction called the transfer() function on the POLS token contract, not the transferFrom() function. It means that this fraud has nothing to do with the approval you made earlier to Uniswap. The transaction must have been signed either by you or by someone who has access to your private key.

Possible reasons:

  1. You made this transfer transaction yourself thinking that you were making another transaction, possibly through a phishing website.
  2. You lost your private key or mnemonic. For instance, you stored it insecurely or on a compromised device, you entered it on a phishing wallet (fake wallet that sends your mnemonic to the scammer), you uploaded it on github by mistake or anywhere public, etc.
  3. Your phone where you keep your wallet is seriously compromised.
  4. There is a very serious issue with Trust Wallet. However, from the comments on etherscan it seems that some may have use Metamask and not Trust Wallet. Also, many more users of Trust Wallet would have been affected if it was a problem with Trust Wallet.

My advice would be to create a new wallet (new mnemonic) on a different device and transfer everything you have to that new address. Assume that all the devices you used are compromised.

3
  • Its safe to say # 2, 3 and 4 is out of the question since my wallet still has ETH in it untouched. If I did lose my seed, I'd imagine everything would be gone and not just specific tokens. Mar 24 at 15:43
  • You'd be surprised - it would seem to me from a few cases I know about that often the hacker (or bot) just grabs some stuff and isn't too particular about sweeping out everything. Thing is, if the hacker is good with automation, they can theoretically monitor the address to see if you try moving out anything else and outbid you. Contact a professional before trying to move anything still in the address imho. Mar 24 at 16:19
  • @Patoshiパトシ Please accept the answer or the bounty will be lost.
    – Undead8
    Apr 1 at 13:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.