Discord

Domain

Phantom

A crypto user known as The Smart Ape said he lost about $5,000 from a hot wallet after spending three days in a hotel, not because he clicked a phishing link, but because he made a series of “stupid mistakes,” including using an open WiFi network, taking a phone call in the lobby and approving what looked like a routine wallet request.&nbsp;
The incident, analyzed by security firm Hacken for Cointelegraph, shows how attackers can combine network‑level tricks with social cues and wallet UX blind spots to drain funds days after a victim signs a seemingly benign message.
<h2 id="how-hotel-wifi-became-a-threat">How hotel WiFi became a threat</h2>
<a href="https://x.com/the_smart_ape/status/2009196943193370968?" rel="noopener noreferrer nofollow" target="_blank">According</a> to the victim’s account, the attack began when he connected his laptop to the hotel’s open WiFi, a captive portal with no password, and started “working as usual, nothing risky, just scanning Discord and X, and checking balances.”
<figure>
 <img alt="Cryptocurrencies, Cybersecurity, Hacks" src="https://s3.cointelegraph.com/uploads/2026-01/019ba232-033a-7ae3-9042-d2815cd4e673.png" title="">
 <figcaption style="text-align: center;">
 How Hotel WiFi Wiped a Wallet. Source: <a href="https://x.com/the_smart_ape/status/2009196943193370968?" rel="noopener noreferrer nofollow" target="_blank">The Smart Ape</a>
 </figcaption>
</figure>
What he didn’t know was that on open networks, all guests effectively share the same local environment.
Dmytro Yasmanovych, cybersecurity compliance lead at Hacken, told Cointelegraph, “Attackers can exploit Address Resolution Protocol (ARP) spoofing, Domain Name System (DNS) manipulation, or rogue access points to inject malicious JavaScript into otherwise legitimate websites. Even if the DeFi front end itself is trusted, the execution context may no longer be.”
Related: P<a href="https://cointelegraph.com/news/pectra-wallet-exploit-offchain-signature-risk" rel="noopener noreferrer nofollow" target="_self">ectra lets hackers drain wallets with just an offchain signature</a>
<h2 id="when-talking-crypto-paints-a-target">When talking crypto paints a target</h2>
The attacker quickly found out the user was “involved in crypto” after overhearing him discuss his holdings on a phone call in the hotel lobby. That information narrowed the target and hinted at the likely wallet stack (in this case, <a href="https://cointelegraph.com/news/what-is-a-phantom-wallet-how-to-set-up-and-use-it" rel="noopener noreferrer nofollow" target="_self">Phantom</a> on Solana, which was not itself compromised as a wallet provider).
Physical‑world exposure of your crypto profile is a long‑standing risk. Bitcoin engineer and security expert <a href="https://cointelegraph.com/news/panic-wallets-crypto-physical-security" rel="noopener noreferrer nofollow">Jameson Lopp has repeatedly argued</a> that openly talking about crypto or flaunting wealth is one of the riskiest things you can do.&nbsp;
“Cyber attacks do not start at the keyboard,” Yasmanovych warned. “They often start with observation. Public conversations about crypto holdings can act as reconnaissance, helping attackers choose the right tools, wallets, and timing.”
<h2 id="how-a-single-approval-drained-the-wallet">How a single approval drained the wallet</h2>
The key moment happened when the user signed what he thought was a normal transaction. While swapping on a legitimate <a href="https://cointelegraph.com/learn/articles/defi-a-comprehensive-guide-to-decentralized-finance" rel="noopener noreferrer nofollow" target="_self">decentralized finance (DeFi)</a> front end, the injected code replaced or piggy‑backed a wallet request that asked for permission rather than a token transfer.
Yasmanovych noted that this pattern fits a broader and increasingly common class of attacks known as approval abuse. “The attacker doesn’t steal keys or drain funds immediately. Instead, they obtain standing permissions, then wait, sometimes days or weeks, before executing the actual transfer.”
Related: <a href="https://cointelegraph.com/news/trust-wallet-s-7m-hack-shows-where-crypto-friendly-smes-may-be-vulnerable" rel="noopener noreferrer nofollow" target="_self">Trust Wallet’s $7M hack shows where crypto-friendly SMEs may be vulnerable</a>
By the time the victim noticed, the wallet had been emptied of Solana (<a href="/solana-price-index" rel="noopener noreferrer">SOL</a>) and other tokens.
<blockquote>
 “At that point, the attacker had everything he needed. He waited until I left the hotel to transfer my SOL, move my tokens, and send my NFTs to another address.”
</blockquote>
The victim’s wallet was a secondary hot wallet, so the damage was limited, but the sequence shines a light on how little is required to swipe users’ funds: one untrusted network, one moment of inattention and one signed approval.
Yasmanovych recommended treating all public networks as hostile when traveling. Avoid open WiFi for wallet interactions, use a mobile hotspot or reputable <a href="https://cointelegraph.com/news/how-to-use-a-vpn-for-online-security-and-privacy" rel="noopener noreferrer nofollow" target="_self">VPN</a>, and only transact from hardened, up‑to‑date devices with minimal browser attack surface.
Users should also segment funds across wallets, treat every onchain approval as a high‑risk event to be regularly reviewed and revoked, and maintain strong physical operational security by never discussing holdings or wallet details in public.

The hidden risk of public WiFi: How a single approval wiped a crypto wallet

Table of Contents

Cointelegraph

Other articles published on Jan 9, 2026

Join our free newsletter for daily crypto updates!