My encrypted wallet was emptied three days after I connected to the hotel Wi-Fi.

Author: The Smart Ape; Translator: Deep Tide TechFlow

A few days ago, my family and I went to a very nice hotel for our year-end holiday. A day after leaving the hotel, my wallet was completely empty. I was baffled because I hadn't clicked on any phishing links or signed any malicious transactions.

After hours of investigation and with the help of experts, I finally figured out the truth. It was all because of the hotel's Wi-Fi network, a brief phone call, and a series of silly mistakes.

Like most cryptocurrency enthusiasts, I brought my laptop, thinking I could work a little while on vacation with my family. My wife insisted I not work during these three days, and I really should have listened to her.

Like other guests, I connected to the hotel's Wi-Fi network. This network didn't require a password; you could simply log in through a captive portal.

I was working in my hotel room as usual, without doing anything risky: I didn't create a new wallet, click on any strange links, or visit any suspicious decentralized applications (dApps). I simply checked X (Twitter), my balance, Discord, and Telegram, etc.

At one point, I received a call from a friend in the crypto community, and we talked about market conditions, Bitcoin, and other cryptocurrency topics. Unbeknownst to me, someone nearby was eavesdropping on our conversation and realized I was involved in cryptocurrency-related activities. This was my first mistake.

While browsing the web on the hotel Wi-Fi, one website appeared to load normally, but in reality, additional malicious code had been injected behind the scenes. I didn't notice anything unusual at the time. If I had installed some security tools, I could have discovered these issues, but unfortunately, I didn't.

Normally, websites might request your wallet to sign certain actions. Phantom Wallet will pop up a window where you can choose to approve or decline. Generally, you would sign without hesitation because you trust the website and browser. However, I shouldn't have done so that day.

While I was performing a token exchange on the @JupiterExchange platform, malicious code triggered a wallet request, replacing my normal exchange operation. I could have easily detected this malicious request by carefully examining the transaction details, but because I had already completed the exchange on the Jupiter platform, I didn't suspect anything. That day, I didn't sign any transactions to transfer funds; instead, I signed an authorization. This is precisely why my assets were stolen a few days later. The malicious code didn't directly ask me to send SOL (Solana) because that would be too obvious. Instead, it asked me to "authorize access," "approve the account," or "confirm the session." In short, I was essentially giving another address permission to act on my behalf. I approved it because I mistakenly believed it was related to my actions on Jupiter. The message that popped up in my Phantom wallet looked very technical, showing no amount and no prompt for an immediate transfer. And that was exactly what the attacker needed. He waited patiently until I left the hotel before acting. He transferred my SOL, withdrew my tokens, and moved my NFTs to another address.

I never imagined something like this would happen to me. Fortunately, this wasn't my main wallet, but a hot wallet used for specific operations, not for holding assets long-term. Even so, I made a lot of mistakes, and I believe I bear the primary responsibility for them.

First, I should never have connected to the hotel's public Wi-Fi. I should have used my phone's hotspot.

My second mistake was talking about cryptocurrency in the hotel's public area, which likely allowed many people to overhear our conversation. My father had warned me never to let anyone know I was involved in cryptocurrency. We were lucky this time; some people have even been kidnapped or worse because of crypto assets. Another mistake was approving a wallet request without fully checking it. Because I was convinced the request came from Jupiter, I didn't analyze it carefully. In fact, every wallet request should be thoroughly reviewed, even from applications you trust. Requests can be blocked, even if they don't actually come from the application you think they are. Ultimately, I lost approximately $5,000 from a secondary wallet. While this wasn't the worst-case scenario, it was still very frustrating.