Cryptocurrency trader who goes by The Smart Ape has shared with his 66,700 followers the story of how his wallet was drained thanks to a single approval on Solana's Jupiter DEX. Meanwhile, some of the story's details left the crypto community confused.
Crypto wallet user says his Phantom was hijacked via hotel Wi-Fi
In the recent holiday week, cryptocurrency and NFT investor The Smart Ape had his Solana Phantom wallet drained for $5,000, he shared in an X article with his 66,000+ followers. He suspects a hotel Wi-Fi flaw to be the attack vector that made the theft possible.
According to the post, the investor was spending the holiday in a premium hotel and utilized the venue's public Wi-Fi network only protected by a captive page, with no passwords.
Then, he had a call with a friend about Bitcoin (BTC) and general market conditions, which he suspects was overheard by a malefactor. The victim even leaked the fact that he was actively using a Phantom wallet. After that, while browsing the internet, he opened a website with malicious code.
While swapping assets on Jupiter, a top-tier Solana DEX, the trader was asked to approve the operation with his Phantom wallet. The nature of the approval seemed to be regular, while vague:
I didn’t sign a transaction that moved my funds that day, I signed something that granted permission. That’s why the drain happened a few days later. The malicious code didn’t ask me to send SOL, that would have been too obvious. Instead, it asked me to “Authorize access,” “Approve account,” or “Confirm session.”
Community raises questions
Thanks to the fact that the wallet was not the main storage of The Smart Ape, the losses only total $5,000 in equivalent.
To prevent what he describes as a "man-in-the-middle" attack, the investor recommends all his followers to avoid discussing cryptocurrency involvement in public places and to use a mobile phone as a hotspot instead of public Wi-Fi networks.
Meanwhile, some followers are sure that this design of attack is impossible. To make it work, they said, the hotel network should use HTTP connection without encryption.
The entire story looks like engagement farming to some skeptics, while others think that the funds might have been stolen in another way. Also, many observers noticed that no VPN was used while working with crypto.
As covered by U.Today previously, as a result of the December Trust Wallet incident, $7 million was stolen due to malicious code injected into a legitimate Chrome browser plugin.
Vladislav Sopov
Caroline Amosun
Godfrey Benjamin
Tomiwabold Olajide