Crypto researcher identifies massive wallet draining operation
Crypto researcher Tayvano posted a Twitter thread about a massive, mysterious wallet draining operation that has siphoned more than 5,000 ETH (~$9.88 million at today's prices) as well as other tokens and NFTs from wallets across more than eleven blockchains since December 2022. The operation appears to target more sophisticated crypto users, but the mechanism of attack is unclear. The researcher hypothesized that "someone has got themselves a fatty cache of data from 1+ yr ago & is methodically draining the keys as they parse them from the treasure trove", but emphasized that that was only speculation.
Tweet thread by Tayvano_
The theft and post-theft on-chain movement is VERY distinct. It's incredible. If you've been drained by this attacker you will gasp as you read this. If you don't gasp, this isn't your thief, sorry.
1. Primary theft txns are almost always between 10am–4pm UTC.
2. Secondary thefts and "dust" collecting occurs anytime but usually 4pm-10pm UTC.
Follow-up drains (for assets missed on the initial sweep) usually occur ~4hrs after the initial theft or at ~7am UTC the following day.
Sometimes accounts are re-swept weeks or months later.
Afaik, no one has determined the source of their compromise. Multiple devices have been forensic'd. Nothing. The only known commonalities are:
- Keys were created btwn 2014-2022
- Folks are those who are more crypto native than most (e.g. multiple addresses, work in space, etc)
I'm tired af but I'll lay out some details of the attacker below. Really the ONLY thing you need to read is this:
PLEASE DON'T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS. THE END.
Split up your assets. Get a hw wallet. Migrate. Now.