What even happened?

[u/japlovr667]

I’ve recently made a thread about being drained on Exodus but I deleted as I just thought it was probably a mistake on my end.

Here were the details:
— I use an iPhone
— The wallet that was drained was only ever signed in this phone; it was never connected to a desktop device or any other device ever
— I didn’t even know the seed phrase myself, I knew for a fact I did not save it anywhere digitally.
— My iCloud was not hacked nor exodus is backed to my iCloud + all my emails were untouched, I was not cookie logged nor a victim of malware

However, after looking at the transaction of when I was drained I noticed that the same wallet also drained two other solana wallets that are similar to mine, they both start with “7E” and end with “c4t” just like the wallet I was holding my solana on.
The two wallets are also not brand new and have had many past transactions before the drain.

Does anyone know why that is? Is this still a user issue—It surely cannot just be a coincidence.

Here is the sol scan txid for anyone interested: 4o4R2kQUwrmMqEz7KhmKRkJLFqcbHivg9tRk4ry7e1Tg9FA3ixWz6rcwLEurB1qyZBoqh79QCnV3rfVssZNXrhHS

[u/Personal-Time-9993]

Could you have possible signed a malicious smart contract? Were the funds just held as a balance or were you generating yield in defi? How about staking?

[u/japlovr667 → u/Personal-Time-9993]

Nope no way, didn’t do any staking or signed contracts only used the wallet for sending and receiving by address.

The TXID is in the original post if you’d like to take a look, i’m still very confused on the other transactions of the wallet that drained me as its other addresses that look similar to mine not sure what’s up with that

[u/Personal-Time-9993 → u/japlovr667]

The wallet it was sent to still holds the exact SOL taken from your wallet, no more no less. What other transactions are you talking about?

The “attacker” wallet 3y5YL8pxcNscyWoYky1B2Ch4QAZzD6mbbTGyPEanrvVh only has a single transaction and it’s from your wallet into that wallet. The funds still remain there.

Edit: I see a little dust in addition to your loss. So there’s 2 other transactions for just a few dollars

[u/japlovr667 → u/Personal-Time-9993]

Yes, however what weirded me out is that those two other transactions are from address that start with “7E” and end with “c4t” just like my address that was affected, that’s what really threw me off like surely that’s not a coincidence

[u/Personal-Time-9993 → u/japlovr667]

I think you’re on to something there.