Old Ethereum Wallets Drained in Coordinated Attack, Losses Pass $800K

TL;DR

Hundreds of inactive Ethereum wallets have been drained in a coordinated attack, with losses exceeding $800,000. The campaign is linked to specific attacker addresses targeting wallets inactive for seven years or more.

Key points

Hundreds of Ethereum wallets were drained
Attack linked to specific addresses
Losses exceed $800,000
Targeted wallets inactive for seven years
First alert raised by Capitulation.eth

This week, hundreds of Ethereum wallets, many of them inactive for seven years or more, were drained in what on-chain observers dubbed a live draining campaign associated with the same attacker addresses.

According to some, losses have already passed $800,000.

What Happened and What We Know So Far

One victim, posting under the handle Capitulation.eth, was the first to sound the alarm, saying that funds had left their wallet without authorization and noting that others were being “zeroed out” as well.

This was confirmed by crypto analyst Wazz, who shared on-chain data showing a single address sweeping wallets that had last moved funds as far back as 2019.

Another analyst, Specter, put the victim count in the hundreds and estimated total losses above $800,000. According to them, the attacker deposited 2 ETH to an exchange, likely converted to Monero, and separately bridged 324 ETH, worth around $734,000, to the Bitcoin network via Thorchain.

What is striking about the attack is the age of the wallets involved. Specter noted that most affected wallets were created between four and eight years ago, with very few exceptions.

Community researchers largely agree that this is not a smart contract vulnerability or a token approval exploit. Developer Fitna was direct about it:

“Old secret keys and seed phrases leaked years ago from bad wallet apps, weak randomness, stolen backups, LastPass, cloud leaks, or old 2017/18 software. Hacker is now draining leftover ETH.”

Cryptographer Mikerah offered a similar read, suggesting the pattern points to an older key generation process that used weak entropy, adding that the scenario is “really scary to think about.”

Developer Rahul Saxena used the incident to urge users to check wallets for old token approvals and pointed to revoke.cash as a tool to remove them, though Fitna and others stressed that approval scams are separate from what appears to be happening here.