It’s the next day (the 21st of May) and I continue to research more about the hacker

Before I begin to explain, here is the wallet link, which we are going to analyze. It’s the same wallet we referred to in the previous part (a.k.a the ‘the origin wallet’)

I did some graph analysis & here's the result.

Layer 1: scammer's address

Layer 2: From his to some other wallets

Layer 3: From those wallets to some other wallets

Note: Wallets in layer 2 are sorted in descending order based on the amount sent from layer 1 to 2

It is evidently clear that wallets in the top half of layer 2 are more important and the bottom half is clearly used for distraction.

There is one wallet in layer 3, which contains 518 $ETH (over $1 Million) (on 21st May). I think now you guys understand how big it is. Not big enough to come in news but still significant.

Currently, this wallet has 28.7 Eth only but it’s very active and has over 81,000 txns.

In 1st wallet of layer 2, the total amount transferred to other wallets (including Okex exchange) was 558 $ETH (as of 21st May)

But as of today, even this wallet is almost empty. The majority of the funds were transferred to Okex exchange.

And In the 2nd wallet of layer 2, The total amount transferred to the other wallets (including Okex exchange) was 437 $ETH (as of 21st May)

But as of today (29th Sept), the balance is almost 0 but the amount which is being transferred to Okex is just insane.

To me, wallets like these and other wallets in layer 2 (The top half) look more like connector wallets with significant importance.

The hacker ends up collecting lots of small amounts from layer 3 wallets and slowly collects all the funds to major wallets like these and sends them to okex to withdraw.

This scam is happening for a long time now. we as a community need to take steps to ensure that no more people fall for these kinds of scams.

There are 3 ways to avoid something like this to happen in the future.

1. Never ever connect your wallet to unknown or shady websites

2. If you did connect in the past, then revoke the permission by using “revoke.cash” website. If you want to do it on different chains, then you can also do it manually in your wallet.

3. Configure your wallet to be a multisig wallet. By doing this all transactions will need to be signed by two or more wallets to approve, this makes it really difficult for your funds to get stolen.

By this, I’d like to conclude this article. I hope you liked it, if yes then make sure to share it with all your friends and subscribe to this blog for more such articles.

To continue,

On the same day (20th May) that I got to know about the hack which happened on 11th May, another hack happened but on the BSC chain, and because of this hack I got to know about the previous hack.

In this hack as well, I lost in a similar way as the previous one. I transferred 0.058 BNB from Mexc to my wallet on 20th May at 9:23 Am.

Note: All the screenshots are from the 20th of May, except for those where I mention today’s date.

Just 6 seconds later another transaction happened from my wallet automatically, where it sent 0.019 BNB and Paid the rest as gas fees.

Now it becomes obvious that this was a hack txn because of the gas fee. No one in his right mind would pay such a huge gas fee.

And this is a common theme among all the hack txn, where all these txn’s has an exceptionally high gas fee. It is more obvious in BSC or polygon or other chains with low gas fees.

This made me curious about the hacker and I did a little digging, which you can do as well if you’re interested. This is his wallet

Here’s a screenshot I took on 20th May, after seeing this my doubts were confirmed. From his latest txn's almost all were received and only one was withdrawn and that too with a significant amount & he only left 0.7 in this account, more like he's waiting to withdraw. (which happened to be true)

But this is what it looks like today (29th Sept). Maybe he abandoned this wallet for the time being. (let’s call this ‘the origin wallet’ for simplicity's sake)

Then I looked at the wallet to whom he transferred (highlighted in green on the 20th of May image) Within seconds he withdrew everything to some other wallet.

The next wallet seems to be one of his major wallets. By now you might have guessed it, he has multiple wallets. Actually, he doesn’t just have a couple of wallets, but a crazy network. You see them in the next part of the story.

This wallet is also the same as 1st one, almost all the amount is received & one significant amount is withdrawn to some other wallet.

Which is this one, (one of his main wallets) and has total funds worth 16.71 $BNB (5080 USDT)

Here is the link to both these wallets: 1st one & 2nd one

Update: As of 29th Sept

The 1st is still almost active and has 44 BNB

The 2nd wallet is done for. He deposited some more money from the 1st wallet and then withdrew everything to Binance.

While researching, I found 2 more wallets that are linked to the 1st wallet. The 3rd one is just getting started so it has only 3.65 BNB. But the 4th is old so it has 24.12 BNB

Here is the link to those: 3rd wallet and 4th wallet

Spoiler: The next part is gonna be freaking insane, so make sure to read that.

I’d like to conclude this article by requesting you guys to please share it with all your crypto friends. Its already a bad time to be where the markets arent that good, on top of which I don’t want anyone to lose money to these scammers.

Thank you so much for reading till the end. If you like such articles, please subscribe to this blog to get regular updates.

And God I was naive thinking that “yay, I got free money” but who knew it would cost me all my funds.

On 23rd May, The amount I got from the rekt airdrop got rekt (more like got stolen)

Let’s go a little back to understand what exactly happened in those 2 odd weeks.

On 20th May, the hacker sent me 0.1 evmos

And just 24 seconds later, 20.29 USDC were sent from my wallet to his. All this happened without me knowing/doing anything.

While researching this guy, I noticed that,

1. He withdrew everything from this wallet: Eth = 0

2. From the latest tx's - 1st and 3rd were withdrawals to some other account

3. He only did 160 transactions in this account

Then I looked at that account to which he withdrew.

1. In this account also there were no funds, he withdrew everything to an account named "Bitzlato"

2. There were only 55 transactions in this account.

Here's the thing. Bitzlato is a P2P Exchange and it had over 558 $ETH (worth over $1.1 million) on 20th May.

But things are different now, Today (29 Sept) it’s almost doomed👇🏻

I dunno what exactly happened with the exchange, but this guy is razor sharp.

This is his address on all the different chains and his Ens Domain is “Litoff.eth”

Even though I watched a video on how to save myself from these scammers and took the necessary precautions, even then it happened.

To me, it looks like a work of a smart contract, for obvious reasons. Because he can't be sitting in front of the computer and wait for the next exploit.

I’ve shared this information to spread awareness since these kinds of hacks are not that big to be covered in media or news.

In the following parts of this story, you’ll get to know the seriousness of this hack.

Thank you so much for reading so far. If you like this article, please subscribe to this blog to get regular updates.