Coindroplet Hack

A phishing attack led to a loss of 23,095,489 USD in stETH and rETH tokens on Sep 06, 2023.

Coindroplet.io is a phishing website that targets users with fake airdrops. On Sep 06, 2023, a victim fell prey to the phishing attack, signing a malicious transaction that called the increaseAllowance() function. The attacker then executed two transactions, transferring 9,579.21 stETH and 4,850.98 rETH to their address.

The stolen funds were swapped to native ETH and DAI, then transferred through several EOA addresses, with part of the funds being deposited into TornadoCash. The attacker's address is associated with multiple websites, including coindroplet.io and coindroplet.net.

Attacker Address:

Address 0x4c10…0ab1

Victim Address:

Address 0x13e3…179e

Funds Holder as of Sep 11, 2023:

Address 0x4f2f…f322

Address 0x7023…7e49

Address 0x71c8…790e

Malicious Transaction:

Tx 0xbb4f…de53

Funds Transfer Transactions:

Tx 0xcbe7…7913

Tx 0xb91d…920f

TornadoCash Deposit Transaction:

Tx 0xba94…f9e9