thegasmancom.eth

@ivaavimusic Sent you 1/4 of my total crypto cos I'm poor and you need to know there's good in the world. @Lennart_up your turn? 😏

Last 10 days were really difficult for me as one of my main wallets got drained. It was quite sophisticated and almost felt like a targeted attack. I was following my regular routine, nothing special, just casual chart analysis on TV, Dexscreener and my dev work on windsurf. Suddenly, a mac pop up appeared asking for my system password for an update and ofcourse I didn’t put any password in the pop-up as it looked phishy to me. I instantly checked my wallet which was connected to the browser and all my funds were there, so I thought I’m good as I've not put my password in the pop up. And without wasting a single second I started checking all the system processes but everything seemed normal and all running processes were default @Apple system processes. I dig a bit deeper and found an oascript running, I grep’d its pid and killed it which instantly closed the update pop up. I thought I’m safe now but later I found out that a LaunchAgent was constantly running an another script again and again in the back under an official apple process name, which was then sending all the data to a hosted server in Amsterdam, Netherlands (could be a VM so doesn't matter) I started to check logs as fast as I could and found out this script with name “lovemrtrump”, it was a long multi page script and at this moment I was almost certain that its a malware attack to steal my data. I quickly opened my uniswap wallet to send my funds to a safe wallet but it was already too late. I saw all my hard earned money being sent to an another wallet. I just froze in disbelief. It wasn’t just about the money, but also all my sleepless nights, sacrifices, and the sense of security slipping away right before my eyes. I was shaking and tried to look for the remaining funds but it was all gone. They knew everything where I have kept and staked my funds, and instantly unstaked and sent it all to a fresh wallet. I found out what happened, but couldn't find out how they entered my system. It was not a local network attack. All my accounts are 2FA / 3FA secured. I didn't download any Unauthorised app. I don't click random links or ads. I don't open emails from unknown sources or click links attached in the emails. And it was a brand new just 2 months old mac (bought from Apple store) I thoroughly checked every single link I visited in the days before the hack and there was nothing unusual. I call it targeted because the hacker(s) did quite some research before taking control of my wallet as they knew where are my funds staked/kept. Plus, I could not find the source of injection. The only possibilities I can think of are either a by-pass malware download or a new type of CAPTCHA scam, where users solve a normal CAPTCHA and malware is downloaded onto their system. Or it could be because of a vulnerability which was recently found in the chrome browser on @apple devices. But I am not sure of exactly how they entered my mac and got system level access. Hackers removed most of the traces so I couldn't do much. Plus I needed to move on, so I saved all the logs in a drive and did a factory reset of my mac. I tried for a week straight with no sleep but I could not find the source of injection, which is actually the worst part. Approximate fund loss across @Base, @ethereum and @HyperliquidX : 5200 USDC 1.26 ETH $400 worth of $TURBO $400 worth of $Andy on ETH ~500k TRUST ~1k $VIRTUAL Vader, AiXBT, and other Virtual Agents worth ~1k USD ~670k ROOM As you know I am a trader and I use funds frequently, so I kept them in my hot wallet. I could have done better tho, I should have transferred my stables and ETH to my Hardware wallet and tbh, I was about to. I should have used a separate device for crypto with VPN. I should have connected a hardware wallet with my browser wallet. I am not rinsed but its a significant loss for me. This was the reason for me not being active for all these days, thanks for all the people who stood by me in my hard times. In the end, all we can do is, move on, keep working harder and learn from our mistakes. Take it as a reminder, and take all the security steps right now on an immediate basis. Compromised Wallet: 0xe7096dAf78c15bF0889230a328e3482930F3c936 Hacker's Wallet: 0xA7247BD94d87C138806A98806F3BF6f8A1e8c593 I traced back and found out that all the tokens were swapped for ETH, bridged to ETH mainnet and then distributed among 3 wallets: 0xE2cfcC4dBB937dc4439d174fB3093aFE25eE64c5 0xeb437b3791D4A34f39A263AF6D826820721150f9 0xF6893e5d2Ad5d4bDcEfaafe8d5ce17fFf593B54E