2024

Test

when

April

Security

<p>A crypto investor, going by the moniker Sell When Over, turned to Twitter to break down an alarming ordeal where a hacker siphoned off $800k from his crypto wallets within a mere 46-hour timeframe. The main problem seems to revolve around a potential <a href="https://www.cryptopolitan.com/bybit-integrates-google-pay-allows-pay-integration-across-35-currencies/" data-type="post" data-id="509244" rel="noopener noreferrer nofollow">Google</a> Chrome exploit, facilitated possibly through delayed updates or undetected malware, leading to the unauthorized installation of malicious extensions.<a href="https://x.com/sell9000/status/1777158691214569636" rel="noopener noreferrer nofollow" target="_blank"> </a></p>
<h2 class="wp-block-heading" id="the-unraveling-of-security-layers">The Unraveling of Security Layers</h2>
<p>Sell When Over recounted how he deferred a Chrome update only to be nudged into it by a subsequent Windows update. Post-restart, Chrome’s alterations were immediate: Vanished tabs and reset extension logins. This anomaly forced him to re-import his wallet seeds—a process he meticulously carried out from a secondary, uncompromised device.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Just realized I got $500k drained from multiple wallet apps 46 hours ago<br><br>Think I got extension attacked, with two suspicious extensions that appeared on my chrome browser<br><br>does not feel good fam<br><br>still investigating</p>— Sell When Over | 9000.sei (@sell9000) <a href="https://twitter.com/sell9000/status/1777158691214569636?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">April 8, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>However, it was the discovery of two peculiar extensions, “Sync Test Beta” and “Simple Game,” coupled with an unsolicited activation of auto-Korean translation, that hinted at a deeper compromise. Intriguingly, one specific wallet app, spared the re-import process, remained unaffected, pinpointing the breach’s origin to a singular compromised PC.</p>
<p>Further digging into these extensions revealed alarming functionalities. “Sync Test Beta,” a vividly colored extension, was identified as a keylogger, secretly transmitting data to an external PHP script. On the other hand, “Simple Game” seemed to monitor browser tab activities. Sell When Over lamented the hindsight wisdom of a complete PC wipe at the slightest anomaly, especially when such peculiarities coincide with significant updates like Chrome’s UI overhaul.</p>
<h2 class="wp-block-heading" id="a-costly-lesson-in-digital-vigilance">A Costly Lesson in Digital Vigilance</h2>
<p>As the thread expanded, Sell When Over unveiled a critical security lapse—a Google login breach linked to an obscure Windows device, possibly spoofing a familiar device name to bypass early detection. This breach was traced back to a VPS hosted by Kaopu Cloud, notorious within hacker circles for its role in various cyber misdemeanors. Despite having two-factor authentication (2FA) enabled, the attacker navigated around it, leaving the exact breach method—ranging from OAuth phishing to cross-site scripting—a matter of speculation.</p>
<figure class="wp-block-image size-full"><img fetchpriority="high" decoding="async" width="673" height="332" src="https://www.cryptopolitan.com/wp-content/uploads/2024/04/image-23.png" alt="" class="wp-image-509483" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/04/image-23.png 673w, https://www.cryptopolitan.com/wp-content/uploads/2024/04/image-23-300x148.png 300w" sizes="(max-width: 673px) 100vw, 673px">
</figure>
<p>The incident served as a brutal wake-up call, with Sell When Over sharing several key takeaways:</p>
<ol>
 <li>Disappointment in Bitdefender’s failure to detect any threats, contrasting Malwarebytes’ effectiveness.</li>
 <li>A warning against complacency in security, regardless of the amount of crypto handled.</li>
 <li>A stern advice against entering seed phrases under any guise, advocating for a fresh system setup instead.</li>
 <li>Abandoning Chrome for more secure browsers like Brave.</li>
 <li>The importance of device segregation, especially for crypto transactions.</li>
 <li>Regular monitoring of Google Activity alerts.</li>
 <li>Recommendations to disable extension syncing, especially on devices designated for crypto.</li>
 <li>An acknowledgment of 2FA’s limitations.</li>
 <li>The necessity for routine security audits and procedural updates to ward off latent threats.</li>
</ol>
<p>Amidst financial loss, Sell When Over clarified that his hardware wallet remained secure, dismissing any speculation around tax evasion motives behind this revelation. Despite a portion of the stolen funds beginning to be laundered, a hopeful $150k bounty was offered for their return, alongside considerations for a bounty-based forensic investigation.</p>
<p>The saga concluded on a note of continued vigilance, especially against the backdrop of Google’s questionable decision to thread security alerts—a move that potentially masked the intrusion.</p>

Crypto investor gets $800k drained from his wallets in 46 hours

Table of Contents

Cryptopolitan_News

Other articles published on Apr 11, 2024

Analyst’s Bold XRP Outlook: Ripple's Strategy Amidst Volatility and Market Scrutiny

Dogwifhat (WIF) Investors Bark at New A.I Driven Token as It Surges 500% In Weeks, Currently Comp...

Bitcoin Bulls Unite: Cathie Wood’s $2.3 Million Forecast Gains Support from Robert Kiyosaki

Bitfinex introduces tokenized debt for El Salvador’s first Hampton by Hilton Hotel

Bitcoin, Ethereum And XRP Price Prediction For Q2 2024!

Nektar Network Unveiled to Elevate Ethereum’s Trust Layer and Combat Centralization (11 Apr)

Join our free newsletter for daily crypto updates!