Coindroplet Hack

A phishing attack led to a loss of 23,095,489 USD in stETH and rETH tokens on Sep 06, 2023.

Coindroplet.io is a phishing website that targets users with fake airdrops. On Sep 06, 2023, a victim fell prey to the phishing attack, signing a malicious transaction that called the increaseAllowance() function. The attacker then executed two transactions, transferring 9,579.21 stETH and 4,850.98 rETH to their address.

The stolen funds were swapped to native ETH and DAI, then transferred through several EOA addresses, with part of the funds being deposited into TornadoCash. The attacker's address is associated with multiple websites, including coindroplet.io and coindroplet.net.

Attacker Address:

https://etherscan.io/address/0x4c10a462…120ab1

Victim Address:

https://etherscan.io/address/0x13e382df…94179e

Funds Holder as of Sep 11, 2023:

https://etherscan.io/address/0x4f2f02ee…12f322

https://etherscan.io/address/0x7023505e…787e49

https://etherscan.io/address/0x71c8482e…5a790e

Malicious Transaction:

https://etherscan.io/tx/0xbb4fe89c…d4de53

Funds Transfer Transactions:

https://etherscan.io/tx/0xcbe7b32e…f77913

https://etherscan.io/tx/0xb91d7b14…9b920f

TornadoCash Deposit Transaction:

https://etherscan.io/tx/0xba94b21b…62f9e9