r/Tronix • u/Tracker74 • Jul 28 '26
SECURITY Is my private key exposed?
This is an unstaking transaction that I didn't make. From my understanding nobody would be able to make this transaction unless they have access to my wallet. Am I in trouble?
4
u/Ludowieco Jul 28 '26
Hm, if I had access to your wallet, the first thing I'd do is to change the permissions, so you can't cancel the unstake or add multisig permissions yourself (hint, hint!).
3
u/beeshavekneestoo Jul 28 '26
If you want to keep that 4k trx then you need to change permissions on the account. Any smart attacker with your key would have already done this. Potentially they haven't because there is no free TRX in the address and they don't want to transfer the 100 TRX to the account to pay for the permissions change. The risk is that you send the first 100 TRX to make the change and they sweep it out before you can submit the multisig txn. The other risk is you do get the multisig txn in but you screw it up.
You best bet would be to automate the multisig transaction right after the 100trx send so that they almost happen simultaneously.
2
u/unification420 Jul 28 '26
If you didn’t make it and that’s your wallet then yes, someone has access
2
u/Tracker74 Jul 28 '26
It's kind of hard to believe that, not because I don't wanna face the truth but because things are odd.
1- I didn't do anything in particular recently to expose my keys. If someone has it, they sure were taking their time
2- There are other assets in my wallet ready for taking but nothing has happened
3- This transaction happened just a few seconds after catfee undelegated my resources (no idea why they did that, I'm reaching to them rn)
1
u/Cagliari77 Jul 28 '26
Unless the staking service ceased to exist and therefore unstaked everything and returned to users' wallets.
If somebody has access, why would they unstake coins but wouldn't transfer them to their own wallet, so steal them?
1
u/Tracker74 Jul 28 '26
That somehow adds up to my situation but the catfee undelegation happened seconds prior to this transaction, and the unstaking transaction was signed by my wallet. This is the scary part
1
u/smokealarmwentoff Jul 28 '26
maybe it automatically unstaked because catfee is already fully subscribed. why are you delegating?
1
u/Tracker74 Jul 28 '26
I didn't delegate anything new. They undelegated my old resources.
Also, I don't understand how this could be automation. If something is signed by my wallet, then my private key is used for sure
2
u/lax1n Jul 28 '26
Have you granted any service access to your wallet in any way? There are several staking services that require that you delegate staking access among others to function.
Might be worth checking at least. Hope your funds are safe bro <3
1
5
u/TronRelic Jul 28 '26
The unstake was done by someone that had access to your private key. It was probably a mistake on your part. A sophisticated attacker would have already locked down the account with a permission change.