4

I know this question sounds very strange !

I think the best way to protect myself is to understand the risk. I've heard many times that we can have our wallets drained if connected to a malicious app.

As a developer, what i don't understand is how can they drain my wallet even if i don't sign anything? How come only connecting the wallet is enough to take every assets in it ?

2
  • 1
    "drain my wallet even if i don't sign anything" -- this cannot happen unless the wallet itself is compromised. Example incident: solana.com/news/8-2-2022-application-wallet-incident
    – Serban
    Sep 13, 2023 at 9:32
  • yes that was my thought too, but i'm seeing many people on twitter saying that they connected their wallet to a malicious website and got immediately drained, it means that they have signed a transaction in between, right ?
    – Effe2
    Sep 13, 2023 at 9:58

3 Answers 3

4

It's not necessarily the wallet connect that can be the drainer. The website could have an exploit that let's a malicious attacker execute unintended code on your machine, or worse, get remote control of your system.

If the attacker can achieve this, its possible they can move your assets.

Also if you saved your seed phrase in a file or screenshot, its possible it can be found and used against you.

Stay safe!

2

Most wallet attacks do ask you to sign transactions:

  • Changing the account owner on your account
  • Delegating a portion of your funds for future spending (by the attacker)
  • Making you sign a durable nonce for a future transaction for an on-chain program that seems legitimate, and then changing the on chain program to take your tokens

Some newer wallets don't show warnings for these transactions when they have other instructions (eg, sending you some SOL) or when you're being asked to sign multiple transactions at once.

Some wallet attacks don't ask you to sign things at all:

  • People and websites that pretend to help you, then ask for your seedphrase
  • An app that launches a popup that looks like your wallet, but is in fact the app's UI and asks you to inout your seed phrase

These generally don't work effectively as the more clever attacks above.

1
  • thanks. Yes for the seedphrase, seems obvious !
    – Effe2
    Jan 13 at 22:43
0

I've looked into many of these cases where people go on Twitter saying that they connected their wallet to a malicious website and got immediately drained.

In every case once you dig into the details, you'll find they signed something. It was not the case of just connecting a wallet and being immediately drained. You would be surprised how many victims confuse the two especially when it's common for sites to ask users to sign a message with their wallet to log in which many victims conflate with connecting their wallet.

This is why it's so problematic from a security standpoint for dapps to ask users to log in by signing a message with their private key. It conditions users into thinking it's normal to sign things within the first few seconds of landing on a new site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.