To the hacker who attacked me on Sep 1:
I haven't had any income for 3 years. the $170k you transferred out is all my savings — the money supports me write my code 16+hrs per day for chasing my dream.
I have to move on, I need to provide for my family and keep chasing my dream. I would appreciate it if you could return some of it, for the rest, you won.
for the timeline:
1. 6am UTC, you withdrew my funds from @Morpho
2. 9am UTC, you exchanged them into ETH on @base and into BTC, I had a 3-hour window, but I didn't get my alerts about the activities of my account, that is my fault
3. 9am UTC — same time, you hacked all my twitter accounts.
I still have no clue how I got hacked. over the past few months, 3 apps were installed on my mac: one from a well-known company, one a well designed OSS project and one developed by my previous colleague's kids. I chose to trust all three.
so it's very likely you came in through the supply chain? but even the ACP I was using these days was the official version and pinned. with @claudeai's help, it suggested you may have used osascript + System Events to do the phish for my passwd, then take my @googlechrome sessions.
I was heavily developing my desktop app, that is so sad, but you reminded me that the sandbox env for agents is more important than I thought, which leads me to focus more on this part in @crabtalk_ai , thanks for that point.