§ 01The brief
The client connected his wallet to what looked like a known project's airdrop page and signed what he thought was a login message. Within four minutes his ETH and staked tokens were gone.
§ 02What I did
- 1.
Revoked remaining approvals on his other wallets and moved what was left to a fresh wallet.
- 2.
Traced the drained funds through a swap, a cross-chain bridge and into a mixer, and found one deposit to a regulated exchange before the mixer.
- 3.
Filed the CCS report and sent the exchange the tracing report through law enforcement.
§ 03The outcome
The exchange froze $118,000. Most of the funds went through a mixer and could not be followed further, which I told the client in the first report.