If you use desktop chat apps, turn off “Auto-download” first: A trader says he didn’t click anything, yet an attacker stayed on his computer for 5 days.
Take action first (WhatsApp Desktop): Settings → Chats → Media auto-download, and uncheck photos, audio, videos, and documents. In some Windows versions, go to Settings → Storage → Auto-download. Also turn it off in Telegram Desktop: Settings → Advanced → Automatic media download.
What he said (November 14, 01:06 Beijing time; his original post on X, 510,000 views):
1. The attack came through a file sent via WhatsApp. After it was automatically downloaded, the attacker gained access to or control of the computer.
2. The attacker waited 5 days, watching the short positions he publicly posted on X.
3. Then they closed all the positions and withdrew the funds in a single transaction.
Two points to make clear:
- “I was compromised without clicking anything” is the person’s account. WhatsApp has not confirmed that such a vulnerability exists.
- How much money remained and how the funds were transferred have only been reported secondhand by media, so I won’t include those details here.
The real lesson is that two things combined:
- The chat app automatically downloaded files from strangers onto the computer;
- He showed off his positions publicly, effectively telling the other party “when it would be most worthwhile to strike.”
3 practical steps:
- Don’t install chat apps on the computer you use for trading, or at least turn off auto-download. Don’t open files from strangers on your trading computer.
- Set exchange API permissions to read and trade only, and disable withdrawals. Whitelist withdrawal addresses and set a lock period for new addresses.
- You can share your trades, but do it later, don’t show your entire account, and don’t livestream your positions in real time.
Follow me. [Security Alert] every morning at 6: First, who’s affected and whether you need to act.
#安全警报 #WhatsApp #防盗币 #ComputerSecurity
Take action first (WhatsApp Desktop): Settings → Chats → Media auto-download, and uncheck photos, audio, videos, and documents. In some Windows versions, go to Settings → Storage → Auto-download. Also turn it off in Telegram Desktop: Settings → Advanced → Automatic media download.
What he said (November 14, 01:06 Beijing time; his original post on X, 510,000 views):
1. The attack came through a file sent via WhatsApp. After it was automatically downloaded, the attacker gained access to or control of the computer.
2. The attacker waited 5 days, watching the short positions he publicly posted on X.
3. Then they closed all the positions and withdrew the funds in a single transaction.
Two points to make clear:
- “I was compromised without clicking anything” is the person’s account. WhatsApp has not confirmed that such a vulnerability exists.
- How much money remained and how the funds were transferred have only been reported secondhand by media, so I won’t include those details here.
The real lesson is that two things combined:
- The chat app automatically downloaded files from strangers onto the computer;
- He showed off his positions publicly, effectively telling the other party “when it would be most worthwhile to strike.”
3 practical steps:
- Don’t install chat apps on the computer you use for trading, or at least turn off auto-download. Don’t open files from strangers on your trading computer.
- Set exchange API permissions to read and trade only, and disable withdrawals. Whitelist withdrawal addresses and set a lock period for new addresses.
- You can share your trades, but do it later, don’t show your entire account, and don’t livestream your positions in real time.
Follow me. [Security Alert] every morning at 6: First, who’s affected and whether you need to act.
#安全警报 #WhatsApp #防盗币 #ComputerSecurity
