cryptostaker | peanuts

Blockchain Security Engineer

[cryptostaker | peanuts @cryptostaker22]

Some people have asked me how I actually got started on smart contract auditing. Well, I read a book, watched my favourite solidity teacher @ProgrammerSmart , did @OpenZeppelin Ethernaut challenges, and read reports. A🧵:

[Coinbase Support @CoinbaseSupport]

Introducing Frosty, our AI-powered smart contract auditing tool that outperformed every other tool we evaluated. It runs in ~1-2 hours, can be 100x cheaper than a manual audit, and is now part of every smart contract review at Coinbase. Here's how we built it: https://t.co/rrjAQifHIC

[cryptostaker | peanuts @cryptostaker22]

@4lifemen @cantinaxyz @citrea congrats!

[cryptostaker | peanuts @cryptostaker22]

@bailsecurity @Uniswap @areta_io 🔥

[cryptostaker | peanuts @cryptostaker22]

@sudotx If you've downloaded and ran anything without any form of protection, best is to just nuke your laptop and change all your passwords for important accounts.

[cryptostaker | peanuts @cryptostaker22]

Hey everyone,

My Metamask just got hacked for ~13k USD today.

Not sure if my credentials are affected as well, if anyone received something suspicious from me, don't click on any links or entertain them.

My suspicion is on me running npm i and npm run start on a folder I downloaded 10 hours ago, which spun up the localhost.

I didn't realize I was hacked until 10 hours later when I wanted to transfer some money elsewhere.

It seems like my wallet is simultaneously drained from all chains (zksync, base, op, polygon, eth)

My wallet address: 0x7c982E9563C6D6863eB62d65225530791cfDd341

Some malicious addresses: 0xcc9967aefced28d139a333ba15b7f8c60e0ef058

It all started when someone approached me on LinkedIn and asked me if I could do some audit work for him. Seems innocent. He wanted me to check his react app and will give me some solidity code to audit.

I thought that was harmless enough, so I asked him for more documentations.

He gave me a link to a gitlab folder with a react app and javascript. I don't know much about javascript but I know how to run npm i and npm start, so I did just that.

I gave him my opinions on the website (it was really pretty shitty, I should have known something was up on hindsight), but the solidity code was nowhere to be found in the Gitlab link. I thought it was probably in another link, so I asked him for it. He did not reply.

10 hours later, I found out I was hacked. Post-mortem, I read through the javascript files and notice some connections here and there to web3js and Metamask. Still really don't understand what happened in the script.

I really didn't expect to be hacked, especially coming from an auditing industry. What an irony. I thought I was safe enough, didn't download any executables and programs, made sure I kept my seed phrase safe offline, but I guess social engineering attacks finds its way.

Note to all security auditors and everyone else out there: If you have to deploy something to a local server, make sure your Metamask is not connected to your browser. Try to use incognito every time as well. Even better, don't download and run any folders/file, and if you have to, make to log out of all your wallets and don't save anything in the browser.

Also, I probably won't use LinkedIn anytime soon, what a letdown. Better get clients through the web3 connections. I thought I wanted to try something new.

I know the money is probably gone forever and this is a pricey lesson, but if anyone is able to help or if anyone wants to know more information, please reach out to me. Also, I'd appreciate a share, ensure that nobody else fall victim to this type of hack as well.

[cryptostaker | peanuts @cryptostaker22]

@0xterrah Should've been much more strict

[cryptostaker | peanuts @cryptostaker22]

@geekmaros Saddens me to hear that a lot of people went through this, and some even fall prey to the same hack. Hopefully I can create more awareness about this issue.

[cryptostaker | peanuts @cryptostaker22]

@moray5554 I think it was about time I got hacked. Be careful out there! I read somewhere (Ronin bridge hack) that even a simple PDF download can get oneself into massive trouble...

[cryptostaker | peanuts @cryptostaker22]

@raza_btc I went to google about this and apparently npm packages are not safe at all and could induce many attacks. Seems like people are building npm package checkers nowadays.

[cryptostaker | peanuts @cryptostaker22]

@DevDacian Yup, lesson learnt. Reformatted my old laptop and got a new one.

[cryptostaker | peanuts @cryptostaker22]

@0xStonks Heard about this browser link / random links / "downloadable zoom links" for video call, was wary about that but not about this attack.

[cryptostaker | peanuts @cryptostaker22]

@asandroaw That's true, I only saw the malicious code when viewed using editor in hindsight. The code seemed ok online.

[cryptostaker | peanuts @cryptostaker22]

@utkarshd2008 @bluntbrain_web3 Isn't that a pretty low-ball offer if they want to scam you in other ways

[cryptostaker | peanuts @cryptostaker22]

@LordHeb "I am not interested", nice answer. Thanks for the advice

[cryptostaker | peanuts @cryptostaker22]

@0xkodesage Yup, something to learn

[cryptostaker | peanuts @cryptostaker22]

@FIP_Crypto Yeah, already accepted that I can't get the money back to moment it left my wallet without my knowledge, only thing I can do now is to make others aware. Thanks for looking through!

[cryptostaker | peanuts @cryptostaker22]

@RyanLaBouve Please dm me, thanks.

[cryptostaker | peanuts @cryptostaker22]

@actionDeFI windows

[cryptostaker | peanuts @cryptostaker22]

@beskay0x please dm me

[cryptostaker | peanuts @cryptostaker22]

@DhruvVa86396760 Funny enough I'm not even a react+js dev lol, I just wanted to help out as an end-user and provide feedback for the website, but I should have known better. Sad to see that this happens all the time to many people.

[cryptostaker | peanuts @cryptostaker22]

@Harvesto12 Thank you