A hacker has stolen over $10 million in Ethereum from the wallets of refined crypto users since December 2022, leaving experts puzzled as to how the attack was carried out. According to Taylor Monahan, ex CEO and founder of Ethereum wallet supervisor MyCrypto, the hacker has targeted users who prioritize security and have not fallen for obvious phishing scams. Monahan, who is now with ConsenSys-owned MetaMask, said the attack had hit wallets across 11+ chains and not just MetaMask users, media reports said.
The attack seems to have involved a compromise of users’ hidden recovery phrases, with the hackers accessing private keys that allow access to crypto wallets. Monahan believes that the raid targeted wallets designed from 2014-2022, with hackers methodically exhausting the keys as they parse them from a treasure trove of data. However, she admitted this was only a guess, and the source of the compromise has not yet been determined.
The security team behind MetaMask believes the hack was due to the unintentionally insecure storage of recovery phrases. They advised users to store private keys offline, and not on any internet-enabled device. They also recommended that users create new wallets if they can’t remember being 100% diligent with key storage.
The attack highlights the importance of robust security measures for crypto users, particularly for those with significant holdings. As the crypto industry matures, it’s likely that attackers will become more sophisticated and harder to detect. Therefore, users must take every precaution to protect their assets, including using secure wallets and following best practices for key storage.
