robin lehrke
10 posts

robin lehrke
@LehrkeRobin
Makeup and design consultant
Katılım Haziran 2022
26 Takip Edilen3 Takipçiler

@PaulGoldEagle In other news, water is wet. Thank you for the earth-shattering news alert. 🙄
English

Yesterday, the admin wallet for the Kondux Staking Treasury was targeted and drained. Approximately $98,000 in $KNDX tokens and ETH were stolen.
We're sharing everything we know because our community deserves full transparency, and because what happened to us is happening to others right now.
This is not a post we wanted to write. But it's one that is important for our community, our investors, and the broader crypto ecosystem.
What Happened
A Kondux admin wallet was compromised through a new class of phishing attack that exploits EIP-7702, a feature introduced in Ethereum's Pectra upgrade in May 2025, that temporarily handed control of the wallet to a malicious smart contract. We are still investigating how the off-chain authorization was obtained to complete the EIP-7702 exploit.
No Kondux smart contracts were compromised.
This was a sophisticated and highly targeted attack against an individual admin wallet. The attacker temporarily converted the admin wallet into an externally owned account (EOA) that could be converted into a proxy for a purpose-built drainer contract.
The admin wallet they targeted had admin authority to the treasury, a contract built as the vault for the staking contract. With their ill-gotten delegate authority, the attacker withdrew roughly 3 eth directly from the account and roughly 96 million KNDX via withdrawal.
The wallet has been secured. Since this was an EIP-7702 authorization exploit, we were able to remove the delegate wallet access and secure the wallet. No private keys were revealed during the exploit.
We are not the only victims.
While our users are safe from the exploit trickling into their wallets from our systems and smart contracts, we have found at least 3 other victims of this attack from the same hacker.
Timeline
Feb 25, 22:41 UTC — The attacker created a fresh executor wallet and deployed a purpose-built drainer contract. Total setup time: under 4 minutes.
Feb 25, 22:45 UTC — First drain. The attacker submitted the signed authorization on-chain, converted the admin wallet into a proxy, and batch-executed operations: withdrawing 96.18M KNDX and 0.797 ETH. During this time, the community telegram was inundated with dozens of Russian spammers.
TX Hash: 0xf9742ec13ef3f3b7a94f33517079fbfdf015c89e1fd12f54585dd0658d20d7bd
Feb 25, 22:47 UTC — Second drain. An additional 2.266 ETH extracted. Total elapsed attack time: ~6 minutes.
TX Hash: 0x40ca28afe55150c33916485aee1891fcb62dfb225387a4e3efb45fa5e6e9f66f
Feb 26: The team revoked the malicious delegation via Flashbots Protect RPC and secured the wallet. The old authorization signature cannot be replayed.
The Hacker
Our investigation traced the attacker's receiving wallet to a serial phishing operation that has stolen an estimated $150,000+ in a single week across at least five confirmed victims. Every victim was a crypto project deployer or active DeFi participant. Every targeted wallet was dormant or low-activity at the time of attack.
Other victims include:
1. A long-time DeFi user drained of ~$52,600 in QNT, USDT, and other tokens 0x55F27a0760979Edd208155917D42417F8CfAEdE6
The FLEABONE token deployer drained of 0.226 ETH - 0xe785e706048f75454e2c8963c1ce0809da67fded
The Deboard project deployer drained of 0.066 ETH - 0xe23DAdad82873f3a72d41c68205beb0f0acD8A21
Kondux drained of ~$98,000 - 0x41BC231d1e2eB583C24cee022A6CBCE5168c9FD2
A fifth address reportedly lost 7.81 ETH (~$16,100) 0x257866ebFdd2e62A24eCb98E6B4429e97e6d4E5f
Some of the funds are sitting in the address 0x615DeB963Af37783964edE2beC40e025A21A00f0 while the rest (43.92 eth) has been funneled using @RelayProtocol depository from hackers wallet 0xC330d08C988241331376E515a5F5F359DE050c0A
The attacker funded their operation through a KuCoin exchange withdrawal, used intermediary wallets to obscure the trail, deployed identical infrastructure across multiple chains using CREATE2, and laundered stolen tokens through 1inch, 0x Protocol, KyberSwap, and cross-chain bridges to Polygon, Avalanche, Base, and BSC.
EIP-7702 is new, powerful, and not widely understood by most users.
You don't submit a transaction. You only sign a message. There's no gas fee, no on-chain footprint, and no MetaMask "confirm transaction" warning that would normally raise a red flag. The attacker stores the signature off-chain and executes whenever they choose.
Your wallet becomes their wallet. Once the signed authorization is submitted on-chain, the attacker can execute any operation as you by withdrawing staked tokens, transferring funds, or interacting with contracts all from your address.
Existing security habits don't protect you. The Kondux admin wallet had never connected to a third-party dApp besides OpenSea Studio.
What This Means for Kondux
The protocol is secure. No contracts were exploited. No user funds are at risk.
The delegation has been revoked. The malicious authorization has been cleared, and nonce protection in EIP-7702 prevents the old signature from being reused.
We want our community and investors to understand the precise nature of the threat and what it does and does not mean for the safety of the Kondux protocol.
What We're Doing Now
Immediate actions taken: The malicious delegation was revoked within hours. The admin wallet has been secured and migration to fresh infrastructure is underway. All on-chain evidence has been documented and preserved for law enforcement in the event that action can be taken.
Ongoing investigation: We are working to identify the exact vector for how the signature was obtained despite the wallet's extremely limited exposure. The attacker's funding chain traces back to a @kucoincom hot wallet, which means potential KYC records exist. This information has been compiled for law enforcement referral.
Community protection: We are publishing this full forensic analysis so that other projects can recognize and defend against EIP-7702 delegation attacks. If your wallet is dormant and you've deployed a crypto project, you may be a target.
Final Word
We built Kondux to last. This does not change the integrity of our protocol, the commitment of our team, or the strength of our community.
We're sharing this publicly and in full detail but because the crypto ecosystem is only as strong as our willingness to be honest about what happened and help others avoid the same situation.
If you or your project has been affected by a similar attack reach out. We're tracking this attacker's infrastructure and compiling evidence.
- The Kondux Team
English

@Kondux_KNDX Someone stole KNDX?! I cant even sell mine on any exchange...what an idiot.
English

@tylerbowyer It’s wild to watch you just continue to crank out made up boomer slop with your full chest as if anyone under 40 is dumb enough to believe you
English

The attacks on Turning Point, Charlie, Charlie’s wife, his children, his legacy— are supported by those with an agenda and in many cases funded by international sources that loathe Americans, President Trump, conservative ideology percolating amongst young people and by extension activists who defend them.
We are at a critical time in this country where the left has failed so miserably at convincing Americans to get on board for their radical woke stances and now are equipping low-IQ performance media to destroy the country.
This is their Hail Mary to attempt to destroy candidates for President, win midterms and apply their vision for hijacking elections in red states— through ranked choice voting, motor voter mail ballots, expanding ballot manipulation schemes including controlling adjudication, packing the Supreme Court and making DC and Puerto Rico a state. If this happens, America will become unrecognizable and we are one and a half elections away from that.
There is no greater evil than what America is up against right now. Patriots will need to band together, prioritize winning, reject mentally challenged attacks on conservatives, busy themselves with positive things to defeat Democrats at the ballot box— in order to recognize the threat at our doorstep, or else we will live in despotism for a generation.
English
robin lehrke retweetledi

Hit the 10,000x on plinko! #stake #plinko #10000x #postmonthly #gankyou @Everyone #gambling #bigfoltz Want Access to a $600,000 monthly stake.com stake.us LEaderboard > stake.com/?offer=skil&c=… >Stake.us stake.us/?offer=skil&c=…
English

@Googlei25779262 @RealCandaceO No, you just don’t know what you’re talking about either.
English
robin lehrke retweetledi

UCL MATCHDAY MADNESS 🏆🔥
When this slip CASHES...
2 winners get $20 each💸
Like & RT to enter❤️
#UCL #ChampionsLeague #Football #Soccer #FootballX

English
robin lehrke retweetledi

Ten structures have been destroyed and almost 2,700 are threatened. sacbee.com/news/californi…
English



