EVM Wallets Targeted in Coordinated Crypto Attack

Attacker Drains Hundreds of EVM Wallets in “Wide-Net” Crypto Exploit

An attacker has successfully drained funds from numerous crypto wallets across Ethereum Virtual Machine (EVM)–compatible networks. This operation involved withdrawing small amounts from each wallet, a strategy described by on-chain investigator ZachXBT as a “wide-net” approach.

Key Takeaways:

A major attack has drained hundreds of EVM wallets, with losses generally below $2,000 each.
Security firms indicate that the exploit appears to be automated and may involve phishing emails mimicking MetaMask and harmful browser extensions.
This incident emerges amidst a decrease in overall crypto-related exploit losses in December.

Although individual wallet losses were limited, typically less than $2,000, the widespread nature of the incident suggests a well-coordinated effort rather than an isolated hack.

ZachXBT reported that the compromised wallets were spread across multiple EVM chains, implying that the attacker was casting a “wide net” to gather minor amounts on a large scale.

Cybersecurity Experts Warn of Automated Attacks Using Phishing

Cybersecurity firm Hackless reinforced this assessment, warning users that the observed activity appears to be automated. They recommend immediate actions like revoking smart contract approvals and vigilantly monitoring wallet activities.

Initial investigations suggest that phishing elements may have contributed to the attack. Cybersecurity researcher Vladimir S. pointed out that users could have been deceived by emails designed to impersonate official MetaMask communications, leading them to grant permissions or authorize malicious transactions.

Screenshots circulated on social media indicated emails that imitated the official branding closely, a tactic aimed at reducing user skepticism and facilitating compromise.

This wallet drain incident could also be related to a recent event involving Trust Wallet, which reported a $7 million hack on Christmas Day. That breach affected approximately 2,596 wallets and has been linked to a supply-chain attack known as “Sha1-Hulud,” which specifically targeted npm packages used widely by developers in the crypto space.

According to Trust Wallet’s incident report, the breach was made possible when leaked developer secrets from GitHub allowed the attacker to alter the wallet’s browser extension and upload a malicious version to the Chrome Web Store.

Industry experts have pointed to potential insider access in the Trust Wallet case. Blockchain advisor Anndy Lian remarked that the situation seemed “not natural.” Similarly, Binance co-founder and former CEO Changpeng Zhao suggested that the attack likely required in-depth knowledge of the wallet's source code.

Binance, which owns Trust Wallet, stated that the mobile application remained unaffected and committed to compensating users who were impacted.

It has yet to be confirmed whether the two incidents are directly linked; however, the similarities in tactics—including phishing, browser extension exploitation, and using compromised approvals—highlight a consistent risk pattern for EVM users.

Decrease in Crypto Exploit Losses in December

Recent reports indicate that crypto-related losses from hacks and cybersecurity exploits dropped significantly in December, decreasing 60% month-on-month to approximately $76 million.

This decline marks a significant drop from November’s total of $194.2 million, providing a brief respite after several months of intense attack activity within the sector.

According to PeckShield, December witnessed 26 significant crypto exploits, with a few incidents leading to substantial losses. One such case involved a single user who lost $50 million in an address poisoning scam.

In address poisoning attacks, cybercriminals send small transactions from wallet addresses resembling legitimate ones, hoping that victims will mistakenly copy or select the fraudulent address during transfers.

Additionally, last month, U.S. prosecutors charged 23-year-old Ronald Spektor from Brooklyn with stealing around $16 million in cryptocurrency from approximately 100 Coinbase users through alleged phishing and social engineering techniques.