What happened
Some users of the multi-chain wallet BitKeep had downloaded a hacked APK version. This allowed the hackers to start draining their addresses. Current losses reached $8M.
Users that were using the hacked version 7.2.9 of the BitKeep’s APK have been losing their funds.
The APK has been hacked due to a vulnerability in the API server used by the wallet app. This allowed the attacker to access the app’s database, which held critical user information such as private keys of their wallets.
Funds have been stolen on BSC, Ethereum, TRON and Polygon.
The attacker addresses:
https://bscscan.com/address/0x36225a27…b279ba
https://etherscan.io/address/0x9f12243d…40f855
Case & protocol details
Market Context at Time of Hack
Audit assessment
Review priorities based on the documented failure pattern in BitKeep (December 2022).
Critical checks
- Verify every sensitive logic path is guarded by appropriate access controls and input validation - see the Phishing Attacks attack class for patterns
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report cointelegraph.com
- report Report twitter.com
- report Report twitter.com
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.