It was sometime between 2:00-3:00 AM...

on February 27th, this tale begins as most crypto-horror tales do; I was awoken by the sound no holder wants to hear, a notification from my phone from one of my crypto wallets when I was clearly sleeping; Specifically my Ethereum one. I brought up my app and saw a transfer for all of the Ethereum on it to an external address I didn't recognize! I raced to my computer, my heart thumping in my chest because I had around $250 on this wallet, with ~$200 of it locked up in DeFi and I knew that in the world of cryptocurrency seconds matter. When I logged into MyEtherWallet my heart sank to see my balance for Ethereum had definitely been reduced to 0 ETH...

But wait! What's this? Looking at my tokens I saw my aDAI, aUSDT, and cDAI were still intact! As well as the DAI I had on dy/dX! How could whomever transferred my have missed a bulk of my assets on this account? I quickly created a new address on my Tails instance so I could be sure it was secure, and transferred a small amount of ETH from Coinbase to the compromised address. The race was on! Working quickly I extracted my DAI from dY/dX and sent it to the new address, afterwards I sent the aDAI, aUSDT, and cDAI directly to the new account (the power of DeFi protocols!). After confirming that the assets were secure, I transferred the remaining Ethereum to the new address as well, leaving the old account completely dry and me with my remaining assets SAFU! I had gotten lucky, as it seemed that the culprit was no longer actively monitoring the address after claiming my Ethereum as his own; so I had been able to lock down everything easily...

How did this happen?

The wallet that was compromised was fairly new, so I knew exactly how the recovery phrase had gotten compromised. On Reddit a few days prior I had seen a post for .01 ETH for trying out a browser similar to the Brave browser I use already. On my unsecure computer I created an address for this and supplied it to the browser and got nothing. I had already ran the archive through VirusTotal and nothing was found, as well as each file within and nothing was found. Subsequent scans with ClamAV and Windows Defender turned up nothing, but I found a folder in "%APPDATA$/../Local/" called vc_windows, and even though VirusTotal didn't register it, it was running on my PC even after uninstalling the software. I reformatted my computer and called it a day. Downloading that malicious software on to my computer wasn't my mistake however...

When I decided to get into DeFi I decided to split my balance between a few accounts for safety; On the day I wanted to drop in another $250 I was in a hurry and like an idiot decided to use an already existing wallet; specifically the one I'd tried to receive that .01 ETH with. I transferred the $250 worth of ETH, invested it where I wanted it and went to sleep. Reusing a wallet I'd created after unintentionally installing malware was my BIG mistake. Luckily however the culprit didn't get away with much, not that it would have hurt me had that been the case; but a $50 lesson is MUCH more desirable than a $250 lesson.

How did he/she miss your tokens?

On Metamask when you initially import your address you have to manually add the aDAI and aUSDT tokens and the dY/dX funds are transferred to their smart contract. My best guess is that the culprit didn't see these tokens and thus failed to transfer them in their rush to extract the ETH quickly. Another possibility is they may have also been completely unfamiliar with DeFi and for them it was unclear how they would go about extracting the aDAI, aUSDT, and cDAI back into a currency they felt they could profit on. The latter to me seems to make more sense since a look at the transaction log of the account my ETH was transferred to they seem to take everything on the accounts they get a hold of; and if that's the case...I find that uniquely hilarious, because it truly means that my ass was saved by having them locked up in DeFi!

Conclusion

I hope you guys enjoyed my tale, remember to practice good opsec; go get a 32 GB USB and load it up with Tails Linux, and do all of your crypto currency stuff on there if possible. Definitely do NOT use wallets you created on a machine that is unsecure. I know a majority of you might be screaming "Hardware Wallet!", and the irony of this all is that mine will be here tomorrow. I had ordered it the day prior to this all happening. Be safe out there guys!