AI scanned 5,900 machines for hackers and emptied wallets in 5 seconds
A security researcher exposed a cryptocurrency theft gang this morning. They used AI coding assistants like Claude Code as their muscle, targeting Solana validator nodes and MEV bot servers to steal private keys and drain wallets.
The gang gave the AI two roles: one to find targets and one to attack. The target finder gathered around 5,900 IPs from public node data, GitHub, and npm, then checked each one for databases, Docker, RPC, and SSH endpoints without passwords.
In one confirmed attack, they first accessed a ClickHouse database with no password, then exploited a misconfigured system service to gain root privileges. They found the private keys and, in about 5 seconds, drained every wallet with a balance of more than 0.02 $SOL .
The attackers’ Solana address was also made public. Based on a rough estimate from on-chain records, about 114 SOL has flowed in and out of it since November 6, worth around $9,500 at the current price of roughly $83. The largest transaction was about 81.5 SOL, received at 13:31 Beijing time on November 11 and transferred out just five minutes later. The current balance is zero. It’s not yet clear whether all this money came from victims.
The amount isn’t huge; what’s frightening is how low the barrier to entry is. If you run nodes or bots, don’t keep private keys on machines connected to the public internet, and shut down services without passwords as soon as possible.
Beginners should read more and do less. If you buy crypto, only buy $BTC .
A security researcher exposed a cryptocurrency theft gang this morning. They used AI coding assistants like Claude Code as their muscle, targeting Solana validator nodes and MEV bot servers to steal private keys and drain wallets.
The gang gave the AI two roles: one to find targets and one to attack. The target finder gathered around 5,900 IPs from public node data, GitHub, and npm, then checked each one for databases, Docker, RPC, and SSH endpoints without passwords.
In one confirmed attack, they first accessed a ClickHouse database with no password, then exploited a misconfigured system service to gain root privileges. They found the private keys and, in about 5 seconds, drained every wallet with a balance of more than 0.02 $SOL .
The attackers’ Solana address was also made public. Based on a rough estimate from on-chain records, about 114 SOL has flowed in and out of it since November 6, worth around $9,500 at the current price of roughly $83. The largest transaction was about 81.5 SOL, received at 13:31 Beijing time on November 11 and transferred out just five minutes later. The current balance is zero. It’s not yet clear whether all this money came from victims.
The amount isn’t huge; what’s frightening is how low the barrier to entry is. If you run nodes or bots, don’t keep private keys on machines connected to the public internet, and shut down services without passwords as soon as possible.
Beginners should read more and do less. If you buy crypto, only buy $BTC .
