Old Ethereum Wallets Drained in Coordinated Attack, Losses Pass $800K

by

Old <a href="https://jpygbp.com/eth-usd/">Ethereum</a> Wallets Drained in Coordinated Attack, Losses Pass $800K

This week, hackers drained funds from hundreds of Ethereum wallets, many of which hadn’t been used in seven years or longer. Experts tracking the activity on the blockchain believe this was a coordinated attack carried out by the same individuals.

According to some, losses have already passed $800,000.

What Happened and What We Know So Far

A user named Capitulation.eth first reported that money had been taken from their digital wallet without their permission, and also noticed that other people were experiencing similar losses, with their wallets being emptied.

Crypto analyst Wazz verified this, pointing to on-chain data revealing one address consolidating wallets that hadn’t been active since 2019.

Another expert, Specter, believes the attack affected hundreds of people and caused over $800,000 in losses. They report the attacker first moved 2 ETH to an exchange, probably to convert it into Monero. Separately, the attacker transferred 324 ETH—valued at about $734,000—to the Bitcoin network using Thorchain.

What really stood out to me about this recent attack is how old the compromised wallets were. Apparently, most of them were set up between four and eight years ago – hardly any were newer than that. As someone who’s been in crypto for a while, it makes you think about wallet security and how long you should keep one active.

Most researchers studying this issue agree it’s not a flaw in the smart contract code or a problem with token permissions. The developer, Fitna, stated this clearly.

A hacker is stealing any remaining Ethereum (ETH) from wallets compromised in past data breaches. These breaches happened years ago through sources like insecure wallet apps, weak security practices, stolen backups, the LastPass breach, cloud leaks, or outdated software from 2017 or 2018.

Security expert Mikerah had a similar take, explaining that the pattern suggests an outdated key creation method that didn’t use strong random data. She described the possibility as “truly frightening to consider.”

Following the incident, developer Rahul Saxena advised users to review their digital wallets for outdated token permissions. He recommended revoke.cash as a resource to remove these permissions, but others, including Fitna, clarified that these approval-related scams are different from the current issue.

April Was Already a Terrible Month for DeFi Security

The attack happened at the end of a particularly damaging month for decentralized finance (DeFi), according to analyst Abdul. He called it “the worst month ever” for DeFi security, with around $635 million stolen in 28 separate hacking incidents over 30 days.

The attacks ranged from a large $285 million exploit at Drift on April 1st, to a $5 million+ incident at Wasabi Protocol – which happened on the same day the suspicious wallet activity was first noticed.

The biggest security incident in April was an attack on KelpDAO on the 18th, where hackers stole almost $294 million from the platform’s bridge. They then converted the stolen money into ETH and spread it across the Ethereum and Arbitrum networks.

On April 29th, the Syndicate Network was attacked, resulting in a loss of $330,000. The attacker gained 18.5 million SYND tokens by exploiting a vulnerability in a bridge connecting different blockchains and then sold those tokens, causing the price of SYND to drop by over 37% in a single day.

Read More

2026-05-01 18:45