A crypto investor recently shared their story of how one absent-minded click may have cost them their life savings amounting to around $120,000. While cryptocurrency has certainly started to enter the mainstream, this unfortunate tale is a reminder that it can still be a Wild West out there.
In a thread posted two months ago, Redditor PowerofTheGods explained how they had been investing in cryptocurrency since 2016, considering themselves fairly knowledgeable about the tech and ideas involved in this field.
They stored 80 percent of their investments in a physical “cold” wallet and the remaining 20 percent in four Metamask digital “hot” wallets.
One day, they used Metamask to access the wallets for a balance status check and everything appeared normal. However, upon checking once again later that night, they noticed that every wallet was drained.
They found the Hacker's ETH address via the transactions and saw how the wallets were wiped in a matter of minutes around about the time he checked his balance. They insist they were never prompted to approve any of the transactions.
"I mainly write this post to warn others. Even if you think you are safe, you might still be at risk. I guess with these advanced hackers now, all it takes is one wrong click. This was my life savings aside from a few emergency funds in my traditional bank. I don't think I will ever financially, emotionally, or mentally recover from this. It has affected my life tremendously," they wrote.
The Reddit user isn’t totally sure how this happened, but they suspect they simply clicked a malicious link, allowing in a Trojan horse virus that took control of their browser while the ledger was unlocked. This could explain how the online “hot” wallets were wiped – but how would the hacker have accessed the offline “cold” wallet, which is effectively like a physical USB stick?
Both hot and cold wallets store your private keys – like passwords that grant access to your crypto. If someone else obtains your private keys, they can steal your crypto.
There is also a “seed phrase”, also called a seed recovery phrase or recovery seed, which is a human-readable representation of a private key. It consists of a series of 12, 18, or 24 words generated by your cryptocurrency wallet that stores all the information needed to recover cryptocurrency funds.
The company that runs the hot wallet stores your private keys on its servers, so hackers may be able to get hold of your private keys through this. Cold wallets are more secure because the private keys are stored offline. Someone with a cold wallet can keep their seed phrase on a piece of paper and use it to derive their private keys in the event they need to recover their cryptocurrency.
PowerofTheGods says they kept their seed phrase on a piece of paper, locked in a secure safe that no one else has access to, leaving them unsure how the hacker got access and wiped their funds.
A few other Redditors weighed in on the dilemma, concluding that the person must have set up their cold wallet using the seed phrase from their hot wallet and simply forgotten. Once the hacker had access to the hot wallets, they were able to get their hands on the cold one.
The moral of the story is to remain hyper-vigilant for scammers and never open any hyperlinks or attachments that look suspicious. If you’re dealing with large amounts of cryptocurrency, then it’s always best to opt for an offline cold wallet. Provided you ensure the seed phrase is unique and hidden, there is no way of extracting your seed phrase from the cold wallet.
Of course, just make sure you don’t lose your seed phrase or the physical wallet, like this unlucky guy did…
