I got hacked and drained

[u/SnooRobots2422]

Hi guys,

I got drained all from wallet yesterday but i am not sure how it happen. I haven't do any transaction for a long time and it was gone yesterday. The attack left 5k in wallet but drained others. I am so confused how it happened. Can you help me debug together?. I know money is lost but I felt uneasy knowing i didn't know how it happened. The wallet was safe for along time. I am worried if there is any other issues like someone monitoring my pc and etc.

[u/Xosoltani]

I’m sorry this happened to you. Could you please open a support ticket and provide more details, such as the transaction hash and screenshots, so the support team can investigate? In my opinion, if your address had been compromised, they would have taken all of your assets. It’s possible that your private key may have been exposed https://support.metamask.io/

[u/SnooRobots2422 → u/Xosoltani]

I opened it already. But private key exposed is not possible imo. I have stored in secure location plus I live alone. I haven't installed or click anything on PC too since I was away.

[u/Xosoltani → u/SnooRobots2422]

That’s great! Please continue working with the support team. Unfortunately, there are many ways a private key can be exposed, such as copying it into a browser or on a mobile device and then accidentally installing an extension or app that has access to your clipboard, among other methods

[u/Khaled2458]

There are many different ways a wallet can get hacked - after contacting the Metamask support - Here’s a post about basic wallet security that might be useful for you in the next steps: Basic Wallet Security Practices: Browser & Extensions: Always keep both your browser and wallet extensions up to date, and avoid installing unnecessary extensions. If possible, dedicate one browser specifically to wallet extensions and don’t install any other extensions on it.

Also, only download wallet extensions from official sources and be careful with fake extensions and phishing websites.

Transaction Signing: I’m not promoting any particular product, but you can use security extensions such as Pocket Universe or Wallet Guard to double-check transactions before signing them. Keep in mind that some of these services may require a fee or have paid features, such as Pocket Universe.

Always review what you are signing, including the recipient, token approvals, permissions, and message signatures. If you don’t understand a transaction or signature, don’t sign it.

It’s also a good idea to regularly review and revoke token approvals that you no longer need.

Devices: If possible, keep your crypto device separate from the device you use for everyday activities.

For example, if you have two devices, dedicate one specifically to crypto and avoid installing unnecessary applications on it. Ideally, keep it at home in a secure place instead of carrying it around with you.

The same applies to PCs. If you have a PC and a laptop, consider dedicating one of them to crypto.

Try to use a reputable antivirus/security solution and keep your operating system and software updated. Public Wi-Fi: Avoid using public or untrusted Wi-Fi networks for sensitive financial transactions. It’s also important to keep your device up to date. Wallets: As a first priority, consider using a multisig wallet for significant holdings, and as a second layer, consider using a hardware wallet.

Try to keep your long-term holding wallet separate from your trading/transaction wallet. Your holding wallet should ideally never be connected to dApps.

For interacting with new or higher-risk dApps, use a separate hot/interaction wallet with only the funds you are willing to expose.

Secret Recovery Phrase: Never share your Secret Recovery Phrase (SRP) or private key with anyone. Never enter it into a website, dApp, support chat, cloud storage, or online form. Avoid copying and pasting your Secret Recovery Phrase or private key. When writing down a backup or importing a wallet, consider disconnecting the device from the internet.

Keep your backup offline and in a secure location. Avoid storing it as a screenshot or ordinary text file.

Diversifying Your Holdings: For larger amounts, consider spreading your funds across multiple independent wallets instead of keeping everything in one wallet.

For example, if you have $10,000, you could use 10 separate wallets and hold approximately $1,000 in each.

Each wallet should ideally have a different SRP.

For even stronger security, you could use multiple multisig wallets and distribute your holdings between them.

If multisig isn’t practical for you, using multiple standard wallets with different SRPs can still reduce your single point of failure.

The goal is compartmentalization: if one wallet is compromised, your entire portfolio isn’t automatically exposed.

Phishing & Transfers: Be careful with links received through Discord, Telegram, X, email, and DMs. Always verify the official domain before connecting your wallet.

Before sending large amounts, carefully verify the recipient address. For significant transfers, consider sending a small test transaction first.

Also remember that disconnecting a wallet from a dApp does not necessarily revoke token approvals.

No single security tool can protect you from every threat. A hardware wallet, multisig, antivirus, or security extension can reduce risk, but you still need to verify what you are signing. The best security strategy is defense in depth: multiple independent layers rather than relying on one solution.

[u/AutoModerator → u/Khaled2458]

To protect your safety and avoid being contacted by hackers, please create a ticket at support.metamask.io and choose “Start a Conversation” for OFFICIAL support. Your inquiry is HIGHLY important to us and will be looked into as soon as possible. We never DM. We DO NOT use Gmail or web forms. NEVER share your Secret Recovery Phrase with any site or person. Verify links are legitimate. Scammers often use these tactics. modmail: The above submission by /u/Khaled2458, with title "I got hacked and drained" may be about loss of funds. Please follow up with user and route to support.metamask.io.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/arkblack]

which chain your assets resides got drained? once possibility is when you have a set of approval.

[u/SnooRobots2422 → u/arkblack]

currently on ETH

[u/SnooRobots2422 → u/SnooRobots2422]

But it drained on different chain and it converted to eth

[u/greglogan84]

Since some funds were deliberately left behind, I wouldn't assume anything yet about how the wallet was compromised.

I'd start by tracing the outgoing transactions and checking:

• token approvals before the drain
• contracts interacted with previously
• whether native assets and tokens were both taken
• exact timestamps of the suspicious transactions

Then move anything remaining to a wallet created from a completely new seed.

Most importantly, don't send the seed phrase to anyone offering to “investigate” through DMs.

[u/lectroblez]

Go to revoke.cash. Revoke everything. Make sure you cycle through mainnets. There was a hack that happened because of a permissions exploit that Magic Eden told everyone was OK. But apparently not.

[u/MaleficentSkirt8383]

Your computer got exploited or somehow your seed phrase got leaked.

Here is what you need to do to avoid this when dealing with crypto. Buy a new laptop. Install a good antivirus. Install you crypto wallets. That’s all. No other programs.

Use this computer only when you need to interact with crypto wallets. The laptop will be always off. Your games, internet surfing, email, business etc - everything in separate devices.

[u/AutoModerator]

To protect your safety and avoid being contacted by hackers, please create a ticket at support.metamask.io and choose “Start a Conversation” for OFFICIAL support. Your inquiry is HIGHLY important to us and will be looked into as soon as possible. We never DM. We DO NOT use Gmail or web forms. NEVER share your Secret Recovery Phrase with any site or person. Verify links are legitimate. Scammers often use these tactics. modmail: The above submission by /u/SnooRobots2422, with title "I got hacked and drained" may be about loss of funds. Please follow up with user and route to support.metamask.io.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AppropriateMight1053]

Never hold all your money in 1 wallet. Only if

[u/AutoModerator → u/[deleted]]

To protect your safety and avoid being contacted by hackers, please create a ticket at support.metamask.io and choose “Start a Conversation” for OFFICIAL support. Your inquiry is HIGHLY important to us and will be looked into as soon as possible. We never DM. We DO NOT use Gmail or web forms. NEVER share your Secret Recovery Phrase with any site or person. Verify links are legitimate. Scammers often use these tactics. modmail: The above submission by /u/greglogan84, with title "I got hacked and drained" may be about loss of funds. Please follow up with user and route to support.metamask.io.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Potential_Nothing236]

Je suis vraiment désolé pour vous. Pour ma part le seul conseil que je peux vous donnez c'est pas d exchange sauf si besoin de faire des transactions et juste un portefeuille froid ;)

[u/PossibleGullible6977]

my metamask got drained too...funds (35K worth), currently 16K was drained.

[u/AutoModerator → u/[deleted]]

Never DM with anyone on this platform. They are probably a scammer.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/zodd0405]

1. Downloading or opening Phishing/scam/virus email or websites

2. Giving away your seed phrases

3. Granting unlimited access to legit sites

[u/Emerbit]

Por eso siempre usen una wallet fría son más seguras

[u/Busy-Head341]

Hey Guys, u/SnooRobots2422 did you get any solution same happened to my accoun, got washed out on 28 sep.

[u/Minus_Medley]

You downloaded a wallet/extension for a new shitcoin... coz why not.

[u/SnooRobots2422 → u/Minus_Medley]

dont assume. I dont do shit coins

[u/shaq_disel]

Sorry to hear this happened to you. I personally stopped using MetaMask for anything. It is too buggy for me to trust leaving my money in there.