On October 31, 2024, I lost almost all my crypto. 1,088 BNB from an exchange. Tokens from MetaMask, TrustWallet, OKX. Months of airdrop karma — gone.

I thought the story was over. Just an expensive lesson learned.

I was wrong.

On March 9, 2026 — nearly a year and a half later — I opened OpenSea and saw someone else's account on my laptop. Profile "olddragon." Who the hell is this? Nine connected wallets. One of them — mine.

The hacker couldn't resist coming back for more. And possibly exposed his entire network.

But before I tell you how I found him — I have to admit: in this story, I tried my best to make every possible mistake. And I succeeded.

October 30, 2024. Evening. Pattaya, Thailand.

I was working on my laptop when Google Chrome suddenly crashed. All tabs closed. Browser refused to open properly.

I thought — just a glitch. Getting late anyway, I'm tired. Shut everything down and went to sleep.

At 23:47:51 that same evening, 1,088 BNB was withdrawn from my OKX account to address 0xA2a883ee4E3E31282615Bc6cE09DF32baE72aFF4.

I was asleep.

Between 03:55 and 03:58 on the night of October 31, my MetaMask and TrustWallet were drained. ETH, BNB, MATIC, OP, USDC, and others. Transaction after transaction. Every token of any value — gone overnight.

I was asleep.

Woke up. Sat at my laptop. Opened my wallets and couldn't believe my eyes.

Zeros. Zeros everywhere.

MetaMask — empty. Trust Wallet — empty. OKX — empty.

It's a peculiar feeling. Staring at the screen, realizing everything you worked for just... vanished. Not "something went wrong." Not "network error." Just — zero. Even my self-esteem dropped to match.

Huobi survived. Partially. When I logged in, all assets had been converted to BNB. The attacker was inside. Ready to withdraw. Tried his best, but something went wrong for him. SMS confirmation on a separate number stopped the transaction.

One layer of protection worked. One of the many I hadn't bothered to set up.

And the most painful part — it wasn't the money.

It was months of airdrop karma. Gitcoin Passport. All that stuff. Dozens of projects I'd participated in. Time. Effort. Hope.

All measurable in opportunities already lost.

I made almost every mistake possible in crypto. Here's the complete list — for those who want to follow my path:

✓ Mistake #1: Entered seed phrase on a website

Yes. I did it! Some site with a big prize, I'm a super airdrop hunter, the thrill of the chase, greed. Result: minus $1,000+ in ATOM from Keplr. Instant. Irreversible.

Basic mistake. I knew this stupid rule, but somehow broke it anyway. Quick and dumb. This wasn't related to the account hack. But I did make this idiotic move.

✓ Mistake #2: All eggs in one basket

Google account — the center of everything. Email. Authenticator. Passwords in Chrome — how convenient, right? When it got compromised — everything collapsed at once.

✓ Mistake #3: Physical access

6-8 months before the hack, I had internet problems. Gave my laptop for repair. To someone I didn't know personally. For a whole day.

They installed unlicensed Windows. No antivirus. No protection.

I'm not claiming it was him. But I somehow managed to give physical access to a device with open sessions, wallets, passwords. To someone.

✓ Mistake #4: Google Authenticator only

2FA through Google? Useless if Google itself is compromised.

Huobi survived only because it had SMS on a separate number. Independent channel. The attacker was inside, converted assets — but hit a wall and couldn't withdraw.

✓ Mistake #5: Passwords on computer

Convenient. Deadly.

✓ Mistake #6: Didn't verify transactions

Swapped addresses. Malicious contracts. I signed without looking.

Six out of six. A full house of failures.

But not everything was lost.

Some assets were in staking. Staked coins can't be withdrawn instantly — takes about 20 days to unlock.

When checking my wallets, I saw: someone had already submitted an unstaking request. Our hacker got greedy.

I decided he'd had enough and canceled his request. Immediately created my own.

The race began.

Every day I checked — had he canceled my request? Created a new one? 20 days of this cat-and-mouse game. 20 days of war for my own money.

I set an alarm and got there first. Saved some assets.

But the hacker intercepted some coins too. It was a war with varying success. Victories alternating with defeats.

Main lesson: in this game, you can fight back. Even when everything seems lost.

November 5, 2024, I wrote to OKX:

"On the night of 31.10, funds were stolen from my exchange account."

Correspondence began. Identity verification. Screenshots. Proof. Blocks. Unblocks. Weeks of endless back-and-forth with zero results.

Support wasn't at fault. Blockchain works as designed: transactions are irreversible. That's its strength. That's its cruelty. And exactly why it's valuable.

All that correspondence — just to regain access to emptied accounts.

After the hack, I:

— Reinstalled Windows, did it myself this time, multiple times. — Created new wallets in a different browser. — But kept the old, compromised ones.

Why keep them? Airdrops still came. Sometimes NFTs arrived.

I checked periodically. Sometimes intercepted assets before the hacker. Sometimes — didn't.

A year passed relatively quietly. Learning from mistakes. Thought the story was over.

Deleted Trust Wallet long ago. But kept MetaMask — it was linked to too many projects.

March 2026. Decided to list some airdropped NFTs for sale from the old, compromised wallet.

For a new project, I created a new OpenSea account, added a link to my website, and on March 9 was checking if it worked.

And saw that my laptop was logged into someone else's account.

What a surprise — profile "olddragon." Created April 2021. Asset value — $84.42.

Connected social media: — Twitter: @lifeisweb10 (luckydragon Flow3 Network, 3,751 followers) — Instagram: @millefleursdalat (Vietnamese hotel Ngàn Hoa Mille Fleurs)

And nine wallets. One of them — mine.

The hacker spotted my NFTs. Got greedy and decided to combine wallets under one account.

Here they are — all addresses from the "olddragon" profile:

1. 0xba67d462b4443edc23efc6414f94c49649fb1385  ← MINE
2. 0x52ce8da76d8dcdce46995ee379b957440b35207a
3. 0x452bc70764abc6cef011a3e322e3ac179340bf54
4. 0x9e684b04176772a38c5f929c65789a29257f1cf7
5. 0x12b21e8131b2a7c8af4b87375385db8ce2fbef27
6. 0x1412e5521143f53031a174fe80cbc5564e76e27d
7. 0x83a2fec47453a0337c9bbd403bddd1b42c2d825f
8. 0x9855a2f98d0bbd41fb0c4c8f21f2cb63901088ab
9. 0x711cfcbba1260332b68e7d600e0673453b1128ed

Either this is the hacker's network — nine stolen wallets under one profile.

Or a network of victims — nine people hacked the same way.

Either way — this is information I didn't have for a year and a half.

March 10, 2026. Yesterday.

I checked activity on my compromised MetaMask.

The latest theft was recent — WCT tokens I received as an airdrop. He swapped them to ETH and sent to address 0x2896e...903D7.

March 11 — today — he's already double-dipping with someone else's WCT.

My supposedly dead wallet is living its own life. Some guy is using my wallet as his own. Receives airdrops on my address. Withdraws to his.

He thinks it's safe. I wouldn't be so sure...

I tested every stupid move, and trust me — if you give them a chance, they'll steal even a dollar. They don't just steal millions.

1. SMS confirmation on a separate number

Google Authenticator is useless if Google is compromised. SMS on an independent number — separate channel. Huobi survived only because of this.

2. Diversify protection, not just assets

Different wallets, different exchanges, different emails, different devices. No single point of failure.

3. Hardware wallet — a necessity

Ledger. Trezor. Anything cold. I foolishly didn't use one and lost almost everything.

4. Physical access = full access

Never give anyone a device with open sessions. No one. Not even for repair. Especially for repair.

5. Passwords — not on the computer

Paper, safe, separate device, your own head, finally. Not where you work.

6. Verify every transaction

Address. Amount. Contract. Every time. Tedious? Yes, but cheaper than losing everything! Definitely.

7. Never enter seed phrase online

No website. No verification. No recovery. Never. Legitimate services don't ask.

I knew this rule but broke it. Instantly lost $1,000+ in seconds.

8. Staking is your friend (sometimes)

20 days to unlock gave me time to counterattack. Some assets saved precisely because of this.

9. Karma, passports, reputation — also assets

Gitcoin Passport. Wallet history. Project participation. Irreplaceable. Protect your crypto identity, not just money.

I could have stayed silent. This isn't exactly a heroic story. It's a story of mistakes, losses, and self-soothing partial victories.

But I'm telling it because I'm building a project meant to protect content creators. And it would be weird to talk about protection while hiding my own experience.

The project is called Cirqus Heresy — The Creator Sovereignty Guild.

We're building infrastructure where: — NFT membership replaces subscriptions (ownership, not rental) — Smart contracts secure deals (escrow without arbitrary decisions) — DAO governance (decisions made by creators) — IPFS storage (content that can't be deleted)

I'm not building this because I'm a security expert. Obviously — I'm not. I tested all the ways to screw up.

But that's exactly why I know what needs protecting. And from what.

I don't know how the investigation will end. Don't know who's behind "olddragon." Don't know if they'll find the hacker. As a trickster and project founder, for me this is just a game for gaining experience and a chance to save someone from mistakes.

And I have: — Nine wallet addresses — OpenSea profile with history — Connected Twitter and Instagram — DeBank profile from bio — A year and a half of transactions — Contact info for the person who had physical access to my laptop

All investigation materials are publicly available:

🔗 github.com/CirqusHeresy/dragon-hunt

PDF dossier, screenshots, addresses, timeline. Everything documented.

Maybe it leads somewhere. Maybe not. Perhaps this article is being read by a future inquisitor, or an architect — co-creators full of ideas who want to join.

But one thing I can definitely do: tell this story so someone doesn't repeat my mistakes.

Or repeats them — if they really want to. I've provided the guide.

To be continued...

If you recognize your wallet among these nine — contact me.

Maybe we're victims of the same hacker. Maybe together we'll learn more.

— 🐦 Twitter: @CirqusH84220 — 📧 Email: vitverse15@gmail.com — 🌐 Project: cirqusheresy.com — 🔗 Materials: github.com/CirqusHeresy/dragon-hunt

Liberatio per electionem — Liberation through choice.

Including the choice to learn from others' mistakes.

And I've already paid for your education.