Table of contents
Open Table of contents
Introduction
A recent article described a user whose crypto wallet was compromised while using public Wi-Fi on vacation. The account highlights the risks of public Wi-Fi and the importance of protecting assets when using cryptocurrency. Drawing on this case, this article shares practical lessons and ways to use software tools to help keep digital assets safe.
1. What Happened
The following is adapted from a first-person account published by The Smart Ape.
A Vacation Goes Wrong
A few days ago, I went on vacation with my family and stayed at a hotel. I thought I could get some work done while enjoying a change of pace. After connecting to the hotel’s public Wi-Fi, I checked my crypto balances, followed the markets, and traded on a few platforms. A few days later, however, I discovered that funds had been transferred out of my wallet. I had lost about $5,000.
Discovering the Loss
What shocked me was that I had not clicked any suspicious links or done anything unusual. After investigating, I concluded that I had overlooked a seemingly harmless approval request while using my crypto wallet on public Wi-Fi, which ultimately led to the theft.
2. How the Attack Reportedly Worked
The Risks of Public Wi-Fi
According to the original author, public Wi-Fi networks pose significant security risks. Without suitable protection, devices on the same network may be exposed to eavesdropping or attacks. The author believes the attacker carried out a man-in-the-middle attack, intercepting and altering communications between the user and the internet.
Revealing Crypto-Related Information
In my case, the attacker did not obtain information through a phishing link. Instead, they learned from a conversation I had with a friend that I used Phantom Wallet, and singled me out. This made me realize that even a casual conversation can reveal information about my crypto assets that I should keep private.
Injecting Malicious Code
That day, while I was swapping tokens on Jupiter Exchange, malicious code was quietly injected into a request and disguised as an approval prompt. When I approved it, I was actually giving the attacker control over my wallet.
3. The Incident in Summary
The author connected to public Wi-Fi to work while staying at a hotel and mentioned using a crypto wallet during a conversation. According to his account of the subsequent investigation, he believed an attacker had used a man-in-the-middle attack to inject malicious code while he was using Jupiter Exchange, prompting him to sign a seemingly harmless access approval. A few days later, the attacker used that authorization to transfer tokens and NFTs out of the wallet, causing a loss of approximately $5,000.
- The author’s explanation of the exposure: Inadequately protected public Wi-Fi may have allowed devices to be monitored, while the conversation revealed that he used Phantom Wallet and held crypto assets.
- The attack method described by the author: A man-in-the-middle attack altered the webpage and inserted a malicious approval request, which he accepted without examining it carefully.
- Key mistakes: Using hotel public Wi-Fi, discussing crypto holdings in public, and not carefully checking the wallet’s approval prompt.
- The loss: A secondary hot wallet, rather than the main wallet, was compromised, but the loss still amounted to $5,000.
- Security lessons: Avoid using public Wi-Fi to manage crypto assets, be cautious about discussing crypto in public, and review every wallet request carefully before signing.
4. Using a VPN
A VPN encrypts communications between your device and the VPN server, reducing the risk of eavesdropping, data theft, and traffic tampering on public Wi-Fi.
- Encrypted communications: A VPN encrypts data between your device and its server, reducing exposure to eavesdropping and data theft on public Wi-Fi.
- Masking your IP address: Websites see the VPN server’s IP address rather than the public IP of your current connection, providing some additional privacy.
- Reducing interception risks: A VPN can reduce the risk of someone on the local network listening to or tampering with traffic. It cannot review wallet approvals or stop you from accepting a malicious request.
Had the author used a trustworthy VPN, communications between his device and the VPN server would have been encrypted, reducing the risks of eavesdropping, theft, and traffic tampering on public Wi-Fi. Whether that would have prevented the loss would still depend on the device, the website, the wallet request, and how carefully the signing details were checked. Choosing a reputable VPN service matters: an untrustworthy provider can introduce new privacy and security risks of its own.
5. Using Rabby Wallet
Rabby Wallet offers several warnings and tools to help users recognize similar risks:
- Reviewing requests: For each transaction, Rabby presents a prompt that requires the user to explicitly approve or reject it. Even if a webpage has been tampered with, Rabby still requires review and confirmation. If it detects a potential risk, it disables the signing button and displays a warning. The user must first address that warning, for example by reviewing the risk details or dismissing it, before proceeding.
- Managing approvals: Rabby provides an interface for viewing and revoking unnecessary approvals, reducing future exposure.
- Transaction simulation: Before confirmation, Rabby simulates a transaction and shows the expected balance changes. This helps users understand what signing would do and spot malicious or mistaken transactions.
- Approval alerts: If a user approves a contract associated with risky or malicious behavior, Rabby issues an alert prompting them to revoke its approval to protect their funds.
- Finding assets and withdrawal options: Rabby and DeBank can help users discover onchain balances and available contract interactions. A user in the linked post had been unable to withdraw approximately 85,740 USDC through their usual interface following the Multichain incident. They later found a
withdrawbutton in Rabby and successfully withdrew the funds. Rabby and DeBank helped the user find and execute an available withdrawal; the ability to recover the funds depended on the progress of Multichain’s liquidation and the contract permissions in place at the time.
Had the author used Rabby Wallet, its prompts might have encouraged closer scrutiny of the approval request, helping him identify the malicious request and avoid the loss. He might also have received an alert prompting him to revoke the malicious contract’s approval.
6. Using Bitwarden
As a password manager, Bitwarden can help users store and protect important information:
- Generating strong passwords: Bitwarden generates strong, complex passwords to help protect against brute-force attacks and the risks of weak or reused passwords.
- Two-factor authentication (2FA): Bitwarden can integrate TOTP (time-based one-time passwords), adding another layer of protection to wallet and exchange accounts.
- Encrypted storage for private keys and seed phrases: Bitwarden can store wallet private keys and seed phrases in encrypted form, rather than leaving this sensitive information in insecure locations.
- Reducing credential phishing: Bitwarden can store and use passkeys. A passkey is a form of authentication based on public-key cryptography, with the user verifying themselves through biometrics or a device PIN. In wallets or account systems that support passkeys, the credential works only with the legitimate domain it is bound to, not an impostor domain, reducing the risk of credential phishing.
For a wallet or account system that supports passkeys, this domain binding reduces the risk of authenticating on an impostor website. The credential works only with its legitimate domain. A passkey does not, however, determine whether an onchain transaction or approval request is malicious. Users still need to carefully review what the wallet asks them to sign.
7. Conclusion
The wallet theft described in this article is a reminder to stay vigilant when handling crypto assets. Tools such as VPNs, Rabby Wallet, and Bitwarden can substantially improve protection and help prevent a small oversight from becoming a costly mistake. Good security habits matter more than simply owning a hardware wallet. I hope everyone can build a strong foundation for keeping their assets safe.