My Crypto Wallet Was Drained After Three Days on Hotel Wi-Fi

Original Author: The Smart Ape

Original Compilation: TechFlow

A few days ago, I went with my family to a very nice hotel for a year-end holiday. One day after leaving the hotel, my wallet was completely drained. I was utterly confused because I hadn't clicked on any phishing links or signed any malicious transactions.

After hours of investigation and seeking help from experts, I finally understood the truth. It all turned out to be because of the hotel's Wi-Fi network, a brief phone call, and a series of foolish mistakes.

Like most cryptocurrency enthusiasts, I brought my laptop with me, thinking I could squeeze in some work while on a family vacation. My wife repeatedly insisted that I not work during these three days. I really should have listened to her.

Like other guests, I connected to the hotel's Wi-Fi network. This network didn't require a password, just a login via a captive portal.

I worked as usual in the hotel, not doing anything risky: I didn't create new wallets, click on strange links, or visit suspicious decentralized applications (dApps). I just checked X (Twitter), my balances, Discord, Telegram, and the like.

At one point, I received a call from a friend in the crypto space. We chatted about market conditions, Bitcoin, and related cryptocurrency topics. What I didn't know was that someone nearby was eavesdropping on our conversation and realized I was involved with crypto. This was my first mistake. The eavesdropper learned from our talk that I was using a Phantom wallet and that I was a user with a significant holding.

This made me his target.

In public Wi-Fi networks, all devices share the same network, and the visibility between devices is actually higher than you might think. There is almost no real protection between users, which creates an opening for a Man-in-the-Middle Attack. The attacker acts as a middleman, quietly inserting themselves between you and the internet, much like someone secretly reading and altering your mail before it's delivered.

While I was browsing the web on the hotel Wi-Fi, a website appeared to load normally, but in reality, additional malicious code was injected behind the page. I didn't notice anything unusual at the time. If I had installed some security tools, I could have detected these issues, but unfortunately, I hadn't.

Normally, a website might request your wallet to sign certain operations. The Phantom wallet would pop up a window, and you could choose to approve or reject. Generally, you'd sign it confidently because you trust the website and the browser. However, that day I shouldn't have.

Just as I was performing a token swap operation on the @JupiterExchange platform, the malicious code triggered a wallet request that replaced my normal swap operation. I could have discovered it was a malicious request by carefully checking the transaction details, but because I was already performing a swap on Jupiter, I didn't suspect a thing.

That day, I didn't sign any transaction to transfer funds; instead, I signed an authorization. This was precisely the reason my assets were stolen days later.

The malicious code didn't directly ask me to send SOL (Solana), as that would have been too obvious. Instead, it requested me to "authorize access," "approve account," or "confirm session." In simple terms, I essentially gave permission for another address to act on my behalf.

I approved it because I mistakenly thought it was related to my operation on Jupiter. The message that popped up in the Phantom wallet at the time looked very technical, didn't show any amount, and didn't indicate an immediate transfer.

And that was all the attacker needed. He patiently waited until I had left the hotel before taking action. He transferred my SOL away, withdrew my tokens, and moved my NFTs to another address.

I never thought something like this could happen to me. Fortunately, this wasn't my main wallet, but a hot wallet used for specific operations, not for long-term holding of assets. But even so, I made many mistakes, and I believe I bear primary responsibility for this.

First, I should never have connected to the hotel's public Wi-Fi. I should have used my phone's hotspot for internet access.

My second mistake was talking about cryptocurrency in the hotel's public area, where many people could have overheard our conversation. My father once warned me never to let others know you're involved with cryptocurrency. I was lucky this time; some people have faced kidnapping or worse because of their crypto assets.

Another mistake was approving the wallet request without paying full attention. Because I was certain the request came from Jupiter, I didn't analyze it carefully. In fact, every single wallet request should be scrutinized seriously, even on applications you trust. Requests can be intercepted and may not actually come from the app you think.

In the end, I lost about $5,000 from a secondary wallet. While this isn't the worst-case scenario, it's still incredibly frustrating.