$3,565 in cryptocurrency Drained

On Might 22, 2026, at roughly 02:55 PM UTC, we lost round $three,565 in cryptocurrency after interacting with a phishing website disguised as a wallet verification page.

What made this incident particularly troublesome is that the link got here from someone we had recognized and trusted for years. Due to that trust, we didn’t suspect malicious intent and proceeded with the so-called “verification” process.

Instantly afterward, our wallet funds have been transferred out with out authorization.

After realizing what happened, we started investigating the phishing website ourselves and found malicious JavaScript code embedded in the web page. The code contained wallet addresses and operational particulars related to the transaction circulate. By tracing the transactions on-chain, we discovered multiple linked wallets and patterns suggesting this may be half of a larger organized phishing operation concentrating on crypto users.

A number of the wallet addresses related to the incident:

- Drain vacation spot pockets:

"0x6bF57e5875167d57d4A867dE03f567e39F4894f3"

- First transfer tackle:

"0x8cA60a0874b1a9cf52c9618202a6E9810102a30c"

- Second transfer tackle:

"0x43Fd8Fdbc3B93D5590d63a606198591DbE8ad167"

Related transaction hash:

"0xb9a1a9468bb4c02037a60140eef31b6fdce807dd849427f14aab18694e0c8f01"

Further transaction:

"0x55eff7e5331743ac281a356dab4657ed9e7a85c2364d8c7dab83e4c19a61d8fc"

One other related pockets:

"0x37af1fa26756749f922c78ff1c11c737f1d79126"

We additionally identified malicious code inside the phishing website:

Google Drive proof archive:

https://drive.google.com/file/d/1Q9jcMYKkmB0QHd_s7TJaaAyAE0-OyDXh/view

We are sharing this primarily for awareness and to help others keep away from comparable assaults. Should you receive pockets verification links — even from individuals you realize personally — do not join your pockets or signal transactions until you absolutely verify the source independently.

This publish shouldn't be meant to make legal accusations. We are simply documenting the evidence we found throughout our investigation and inspiring anyone with related info or comparable experiences to return forward.

Please keep protected and double-check the whole lot in crypto.