if you ever used @TradeWiz_Bot back in 2024, your wallet is compromised, burn it right now
just got drained for $220+ by a sweeper bot because i made the dumb mistake of reusing an old wallet
here is the exact breakdown:
back in 2024-25, i used tradewiz for copytrading on solana, fast forward to 5-6 days ago, i connected that same old phantom wallet to phoenixtrade to trade perps
i deposited $200 and kept $5 sol for fees, leaving $190 in the dex and $10 in the wallet. $220+ sitting inside @PhoenixTrade
then it started:
- yesterday i noticed the $5 sol i kept for gas was completely gone
- today i sent $1 sol to test, and it got swept instantly
- a sweeper bot had my private key from the old bot leak and was draining any sol the second it touched my wallet
the hacker couldn't touch the funds inside phoenixtrade directly because it was locked in the dapp contract
i used a @Zun2025 's antidrain to sponsor gas fees from an external wallet and managed to rescue the leftover $9
then came the withdrawal: i withdrew the $220 usdc from phoenixtrade back to the wallet so i could move it to safety, the hacker saw the $9 move, waited, and manually swept the entire 221.77 usdc the moment it hit
i missed saving it by literally 1 minute
check your phantom, find any old wallets connected to tradewiz or old tg bots
let me explain you new/old type of scam happening in p2p
what actually happens under the hood when someone asks you to "verify" your wallet
someone says you to pay usdt from their website for the aml verification, which directs you to an external site like bscdt(.)live claiming you need to complete a "crypto/wallet validation" or verification check
they instruct you to open it inside trust wallet / metamask or any web3 wallet
the page looks like a standard verification or connection prompt
nothing visually appears dangerous
no transfer amount is shown
and no funds leave your wallet immediately
then your wallet prompts you to sign a transaction
but what you are actually signing is not a validation
the transaction hash:
0x5b74021db9df3be4e4b8d3e1fd2007861f7d4277994ce057b457a6d0301dd149
which calls the official bsc usdt contract 0x55d398326f99059ff775485246999027b3197955
method 0x095ea7b3:
approve(
spender: 0xd670f8d8158f3f1d6a53ec8c005b49f2774aff26,
amount: 1,000,000 usdt
)
you didn't validate anything
you just granted a malicious contract permission to spend up to 1,000,000 of your usdt
from that moment onward, the attacker's automated bot is watching your balance
just seconds later, an operator bot (0x65ab72059aab9d8564160c5a70733fb123ac4560) triggered the drain transaction:
trx:
0x826bd1667bd35ea4113a175d33da4ac6bf4b8036b167cf21c555e36d210d28ce
the bot paid the gas and called function 0xbf9836a6 on the drainer contract 0xd670...aff26
the victim wallet never signed this second transaction
and inside that single transaction, two things happened atomically:
1. the contract called usdt.transferfrom pulling 808.823 usdt directly from the victim wallet
(reducing allowance to exactly 999,191.177 usdt)
2. in the exact same execution frame, it immediately forwarded the entire 808.823 usdt to a treasury wallet:
0xdfdaddc193455305f7fb79a353dc0bf19587074c
the drainer contract ends with a 0 usdt balance so it never looks like it's holding stolen money
and here is the dirtiest part:
after the funds were already siphoned, the fake website showed:
"assets on hold – 808.823 usdt"
and demanded an additional 404 usdt to "release" them
pure advance-fee extortion
there is no on-chain hold, escrow, or lock
the funds were already transferred and gone the second the tx confirmed
the "validation" was never about verifying your wallet
it was designed to steal spending permission
maybe i'll tell the backstory too, how this scam happened with our community member
stay safe : )