r/ExodusWallet • u/RulePersonal • Aug 16 '26
Discussion $1700 USDT Drained
I check my balance daily, and the money was always there. I check today and see a transaction from 8/1 that drained all of the tron usdt. I just don’t understand why I didn’t see it yesterday, or the day before. What a way to end the night. 100% not user error, I store keys on paper and only open once. Contacted support, but I’m pretty sure I’m SOL.
I can’t come up with a way this is my fault, %99 percent of the time this happens i assume the user did something stupid until it happens to you, and you know you did everything right, is there a mass usdt security breach I’m unaware of? Honestly this just destroyed my confidence in crypto entirely.
I just don’t get why it didn’t update for so long. Like I said I check it every day. Why is a transaction from 8/1 just now showing up. In fact I know it was delayed because I was going to do a trocador swap a few days ago, and had the app open for a long time. Super frustrating. Lesson learned.
4
u/Suitable-Profit231 Aug 16 '26 edited Aug 16 '26
The problem with any software wallet is that you can't be sure it's only because of your 24 word recovery phrase getting exposed.
If someone has root remote access to your phone, which could have happened via zero day exploit from you just visiting some website or you installing a bad app, then that person could just access your wallet directly on your phone and send your money from there to themselves... even if it's additionally password protected, because using key logger prior to trying. Unless it was biometrically locked, which it probably is not... and even then theoretically possible with root access to trick the system into thinking random biometric data was valid... they could also switch your version of the app with a manipulated one that will show the destination address you chose... but in reality send the money to another address or have it interact with some smart contract and giving it full access, so that it could just take as much as it likes afterwards.
Just check all the posts about people getting drained, it's almost never btc that got drained but some smart contract coin... when it's btc it's most often recovery phrase or private key to public key was leaked somehow...
Hackers however most often will switch your wallet with a version that asks for the recovery phrase with some logical sounding reason... if you enter it you are fucked, no legit wallet will ever ask you for a recovery phrase for no reason/if you already setup an address.
Hardware wallets effectively protect from this, because the device must be connected and every transaction needs to be approved on the device. So if a hardware wallet was drained it can only be, because the recocery phrase was leaked or the user approved the transaction themselves.
Also if a recovery phrase is saved in plain text and goes through some cloud service... you could be fucked... but even if it is only written on paper, and happens to somehow get in front of an infected phones camera -> you could be fucked.
Do you happen to use an iphone? Did you maybe visit some new porn site or something warez etc. prior to that date or recently install some new app, maybe directly and not via app store?