šØ Hundreds of EVM wallets drained in mysterious attack šØ
An ongoing, still-unpatched exploit has siphoned >$8.1 million from 1,240+ Ethereum-compatible wallets since 27 Dec 2024, according to CoinTelegraph data. Victims report unauthorized ETH & token transfers despite most seeds being stored offline, prompting fears of a fundamental entropy flaw in a widely-used wallet-generation library.
šKey points
š¹ Attack vector (preliminary): On-chain pattern shows single-shot drain tx the moment funds hit a fresh address; no prior approvals, no phishing signatures, no malware on victimsā devices.
š¹ Scope: Chains hit: Ethereum, BNB Chain, Polygon, Arbitrum, Base; all share the same derivation path (m/44'/60'/0'/0) and were created between 2021-2023.
š¹ Suspected root cause: Security researchers zeroing in on āProfanityā vanity-address tool v1.0āv1.17; it truncated the random seed to 32-bit entropy, allowing brute-force key regeneration.
š¹ Drainer flow: Attacker appears to pre-compute every Profanity-derived private key, monitor mempool for first inbound transfer, then sweep within <3 blocks.
š¹ Current losses: 1,243 addresses drained; largest single hit 1,870 ETH (~$4.6 M); total $8.1 M and climbing every hour.
šWhy it matters
š¹ Trust erosion: If a wallet-creation libraryānot user behaviorāis at fault, any ācoldā wallet generated 2021-2023 could be a ticking bomb, undermining self-custody confidence.
š¹ Liquidity shock: Victims are institutions (OTC desks, DAO treasuries, mining pools); forced selling of staked positions to re-collateralise could pressure DeFi markets.
š¹ Insurance gap: Most custody policies exclude āalgorithmic key compromise,ā leaving holders unreimbursed and accelerating demand for hardware-only generation.
š¹ Regulatory trigger: Incident lands days before EU DORA and U.S. GENIUS Act technical standards; expect mandates for third-party wallet-audit trails.
šØWatch-outs
š¹ Ongoing drain: Attacker bot is still live; anyone who ever used Profanity or tools that relied on it should move funds immediately to a newly generated seed (hardware wallet, 24-word).
š¹ Copy-cat risk: Proof-of-concept code now public; second wave of low-sophistication actors scanning for weak addresses could double the loss tally.
š¹ Chain-agnostic threat: Same derivation logic works for any EVM chain; Avalanche, Fantom, zkSync users are equally exposed.
šÆBottom line: The exploit is a stark reminder that random-number generation is the single point of failure in self-custody. Until a formal patch is released and weak keys are rotated, every EVM wallet minted 2021-2023 should be considered suspect. Move assets to hardware-generated addresses now; the brute-force window is open and the clock is ticking.
https://cointelegraph.com/news/hundreds-evm-wallets-drained-mysterious-attack