596 Dormant ETH Wallets Drained of $800,000

Hundreds of dormant Ethereum mainnet wallets, many inactive for four to eight years, were drained of approximately $800,000 worth of cryptocurrency around April 30, with funds funneled to a single address investigators have labeled Fake_Phishing2831105.

On-chain analysts, including WazzCrypto and Specter, first flagged the incident after users reported unauthorized outflows from wallets untouched since as early as 2019. More than 500 wallets were affected, according to transaction data tracked on Etherscan, which shows 596 incoming transfers to the destination address. The attacker swept over 260 ETH, along with other assets, totaling losses near 800,000 at current values. From the tagged address, 324.741 ETH was bridged via THORChain Router v4.1.1 to the Bitcoin network, where portions were swapped into bitcoin and Monero for obfuscation. Roughly 66,000 in assets remained in EVM-compatible wallets, with some funds deposited to exchanges.

Unlike recent DeFi protocol hacks, this incident involved no smart contract vulnerabilities, token approvals, or signatures. Investigators point to direct private key compromises, with common theories including weak entropy from legacy wallet...