Original Author:The Smart Ape
Original Compilation: Deep Tide TechFlow
A few days ago, I went with my family to a very nice hotel for the year-end holiday. One day after leaving the hotel, my wallet was completely drained. I couldn't figure out why, as I hadn't clicked on any phishing links or signed any malicious transactions.
After hours of investigation and seeking help from experts, I finally uncovered the truth. It all turned out to be due to the hotel's Wi-Fi network, a brief phone call, and a series of foolish mistakes.
Like most cryptocurrency enthusiasts, I brought my laptop with me, thinking I could squeeze in some work while on vacation with my family. My wife repeatedly insisted that I shouldn't work during these three days—I really should have listened to her.
Like other guests, I connected to the hotel's Wi-Fi network. This network didn't require a password; it only needed to be logged into via a captive portal.
I worked as usual in the hotel without doing anything risky: I didn't create new wallets, click on strange links, or visit suspicious decentralized applications (dApps). I just checked X (Twitter), my balances, Discord, Telegram, etc.
At one point, I received a call from a crypto friend, and we chatted about market trends, Bitcoin, and other cryptocurrency-related topics. But what I didn't know was that someone nearby was eavesdropping on our conversation and realized I was involved in cryptocurrency. This was my first mistake. The other party learned from our conversation that I was using a Phantom wallet and that I was a user with significant holdings.
This made me his target.
In public Wi-Fi networks, all devices share the same network, and the visibility between devices is actually much higher than you might think. There is almost no real protection between users, which creates an opportunity for "Man-in-the-Middle Attacks." The attacker acts like a middleman, quietly inserting themselves between you and the internet, much like someone secretly reading and tampering with your mail before it reaches you.
While I was browsing the web on the hotel Wi-Fi, one website appeared to load normally, but in reality, malicious code was injected behind the page. I didn't notice anything unusual at the time. If I had installed some security tools, I might have detected these issues, but unfortunately, I hadn't.
Normally, websites might request your wallet to sign certain operations. The Phantom wallet would pop up a window, and you could choose to approve or reject. Generally, you would sign without suspicion because you trust the website and the browser. However, I shouldn't have done so that day.
Just as I was performing a token swap on the @JupiterExchange platform, the malicious code triggered a wallet request that replaced my normal swap operation. I could have detected it as a malicious request by carefully checking the transaction details, but since I was already performing a swap on Jupiter, I didn't suspect anything.
That day, I didn't sign any transaction to transfer funds; instead, I signed an authorization. This was the reason my assets were stolen days later.
The malicious code didn't directly ask me to send SOL (Solana), as that would have been too obvious. Instead, it requested me to "authorize access," "approve account," or "confirm session." In simple terms, I was actually giving another address permission to operate on my behalf.
I approved it because I mistakenly thought it was related to my operation on Jupiter. The message that popped up in the Phantom wallet at the time looked very technical, showing no amounts and no prompt for an immediate transfer.
And that was all the attacker needed. He waited patiently until I left the hotel before taking action. He transferred my SOL, withdrew my tokens, and moved my NFTs to another address.
I never thought something like this would happen to me. Fortunately, this wasn't my main wallet but a hot wallet used for specific operations, not for long-term asset holding. But even so, I made many mistakes, and I believe I am primarily responsible for this.
First, I should never have connected to the hotel's public Wi-Fi. I should have used my phone's hotspot for internet access.
My second mistake was talking about cryptocurrency in the hotel's public area, where many people might have overheard our conversation. My father once warned me never to let others know you're involved in cryptocurrency. This time, I was lucky; some people have even faced kidnapping or worse because of their crypto assets.
Another mistake was approving the wallet request without paying full attention. Because I was sure the request came from Jupiter, I didn't analyze it carefully. In fact, every wallet request should be carefully reviewed, even on applications you trust. Requests can be intercepted and may not actually come from the app you think.
In the end, I lost about $5,000 from a secondary wallet. While it wasn't the worst-case scenario, it was still very frustrating.
