Public Wi-Fi and a Phone Call: How They Became the Perfect Trap to Steal $5000 in Crypto Assets?
An individual lost approximately $5,000 in cryptocurrency assets after connecting to a public hotel Wi-Fi network during a vacation. The attack began when the victim was overheard discussing crypto and using a Phantom wallet in a public area, making them a target.
While browsing on the unsecured Wi-Fi, the attacker executed a man-in-the-middle attack, injecting malicious code into a seemingly legitimate webpage. The victim was using Jupiter Exchange to swap tokens when a fraudulent transaction approval request was triggered, disguised as a normal operation. Instead of a direct fund transfer, the request asked for “authorization” or “session approval,” granting the attacker permission to act on the wallet.
The victim approved, believing it was part of the Jupiter transaction. The attacker waited until the victim left the hotel to drain the wallet of SOL, tokens, and NFTs.
Key mistakes included: using public Wi-Fi instead of a mobile hotspot, discussing crypto in public, and approving a transaction without thorough verification. The wallet was a secondary hot wallet, not the main storage, preventing greater losses. The incident highlights the risks of public networks and the importance of transaction scrutiny.
比推01/09 14:32
