Recently, I saw someone on Twitter exposing a case where 50 ETH was stolen from the OKX Web3 wallet. According to him, he used a mnemonic phrase or private key generated by the MetaMask wallet, which he saved by hand. For years, everything was fine until recently, when he was robbed during a significant update of the OKX software wallet. He suspects it was due to a wallet vulnerability and is seeking justice. He also recalled the past black history of the Huobi wallet being implanted with backdoors by developers, and many responders below reported that their wallets were stolen as well, with no results in seeking justice.
This incident has had quite an impact, even prompting Xu Mingxing to personally respond. Notably, according to industry security personnel, one detail emerged: the victim had saved the mnemonic phrase in a notepad on a connected computer, albeit with the order scrambled. This is a critical and fatal oversight; once targeted, the difficulty of pinpoint decryption is not high. The OKX side also mentioned that monitoring reports indicated the victim imported the mnemonic phrase through copy-paste, while the victim insisted that he entered it manually, each side shirking responsibility.
Web3 wallets are easily stolen, which has always been a pain point for on-chain players. Not only are there potential vulnerabilities in the wallets themselves, but also various phishing authorization threats, and the storage of mnemonic phrases and private keys. Any mistake in these processes can easily lead to theft incidents.
Relatively speaking, in cases where the amount of funds is not particularly large, placing them in a leading exchange is actually safer. Although there are occasional incidents of theft or funds being frozen, overall, keeping funds in leading exchanges is more reassuring. Even if an exchange account is stolen, it is easier to clarify responsibility. Stolen Web3 wallets result in a muddled situation, with mutual shirking of responsibility, making it hard to produce a complete and credible evidence chain for justice. Influencers are slightly better off; they can use their influence to raise topics, and sometimes project parties, under pressure from public opinion, privately compensate to resolve issues. Ordinary users, however, are left unheard, suffering silently from the pain of having their wallets stolen.
This incident has had quite an impact, even prompting Xu Mingxing to personally respond. Notably, according to industry security personnel, one detail emerged: the victim had saved the mnemonic phrase in a notepad on a connected computer, albeit with the order scrambled. This is a critical and fatal oversight; once targeted, the difficulty of pinpoint decryption is not high. The OKX side also mentioned that monitoring reports indicated the victim imported the mnemonic phrase through copy-paste, while the victim insisted that he entered it manually, each side shirking responsibility.
Web3 wallets are easily stolen, which has always been a pain point for on-chain players. Not only are there potential vulnerabilities in the wallets themselves, but also various phishing authorization threats, and the storage of mnemonic phrases and private keys. Any mistake in these processes can easily lead to theft incidents.
Relatively speaking, in cases where the amount of funds is not particularly large, placing them in a leading exchange is actually safer. Although there are occasional incidents of theft or funds being frozen, overall, keeping funds in leading exchanges is more reassuring. Even if an exchange account is stolen, it is easier to clarify responsibility. Stolen Web3 wallets result in a muddled situation, with mutual shirking of responsibility, making it hard to produce a complete and credible evidence chain for justice. Influencers are slightly better off; they can use their influence to raise topics, and sometimes project parties, under pressure from public opinion, privately compensate to resolve issues. Ordinary users, however, are left unheard, suffering silently from the pain of having their wallets stolen.