According to PANews news on May 19, the security community Dilation Effect tweeted: "Recently, some people have reported that their wallets have been stolen inexplicably (coins and NFTs have been emptied). The common feature is that they use iPhones, and there are no random links and no help. The memorized words were saved in the mobile phone album or cloud service, and were only copied on paper. These users were puzzled. After a lot of research and analysis, an attack scenario that was rarely noticed was discovered, and in some cases It was successfully reproduced on the Wallet App. There are country or region restrictions on downloading Apps from the App Store. For example, accounts in mainland China cannot download some Apps. Many users will buy (Taobao) or use American Apple IDs shared online. Because of the backup mechanism of the iPhone The mobile App data will be backed up to the cloud. An attacker can use the same Apple ID as yours to restore your wallet App data on his mobile phone. In addition, the local access password of the wallet is not set very complicated, and the attacker can easily crack it. Then transfer your assets away. After tracking the stolen funds on the chain, we found that there is a mature criminal gang behind it, and the total stolen funds of the victim users have exceeded 10 million US dollars."
Dilation Effect reminds, 1. If you use an iPhone and have installed the wallet app, if you have purchased or used an Apple ID provided by others, please stop using it immediately and transfer your wallet assets immediately. 2. This attack scenario has been successfully reproduced on some popular wallet apps on the market. We call on all major wallet manufacturers to pay attention to and troubleshoot this problem, actively optimize it, and issue reminders to users.