I WOULD REQUEST THE HELP AND ASSISTANCE OF THE CARDANO COMMUNITY AND SMART CONTRACT SECURITY DEVELOPERS, to help trace the specific smart contract that triggered this theft.
Also likely that other cardano investors/USERS/SAVERS got their cardano stolen as from tracing circa 5 Million plus my losses where also routed by same accounts ( If anyone involved in the THEFT, losses, i am collecting names for a class action lawsuit, SUPPORTED BY A FIRST CLASS LEGAL TEAM)
THE HUGE LIFE CHANGING SURPRISE, Go to bed, financially stable, wake up with very little, interesting experience, I HOPE none of you have ever to go through.
No security Phrase/pin number leakage or malware use as confirmed by independent security auditors of PCs and network.
Both Ledger and PC air gapped and turned off at time of theft
How it happened
obscured and deceptive code : with hidden malicious code “blind signing” that, once a user interacts with Defi platform (e.g., by granting token approvals), executes obscured delays commands to drain the user’s assets.
This was not a cloned site,
Malicious smart contract with obscured Plutus Null code to drain a Ledger X/Eternl cold wallet multiple times. The primary mechanism involves tricking the user into signing a malicious obscure transaction that grants the malicious contract permission to transfer assets from their account use of an approve () function (for tokens), which grants the malicious smart contract permission to spend the user’s funds multipole times without ledger signature and or approvals.
|857f1006b5f1a530817ac490b029d03626ca6f1969cb97b85a87cfa335d47349|Withdrawal (700,000.4 ADA)|Similar pattern: Plutus validator script with redeemer; reference script likely null, datum hash present. [[docs.gomaestro.org]
Plutus validator script : This is the smart contract that decides if a transaction is allowed. It checks conditions before letting funds move.
Redeemer : Think of this as the “instruction” given to the contract, like “withdraw funds” or “close account.” It tells the script what action to perform.
Reference script likely null : Normally, transactions can point to a pre-stored script to save space. Here, the full script was included in the transaction instead of referencing one. This means the attacker didn’t rely on an external script—they embedded it directly.
Datum hash present : A datum is extra data stored on-chain that the script uses to validate conditions (like who owns the funds or what rules apply). The hash is just a fingerprint of that data. If the datum matches what the script expects, the transaction passes.
Why this matters for the theft :
The attacker had:
- The correct redeemer (instruction to withdraw).
- The correct datum (data the script expected).
- The script logic allowed the withdrawal without requiring your signature.
So the smart contract validated the transaction as “legit,” even though it was malicious.
Stake deregistration Script purpose = Publish; validator script hash tied to stake credential
- Script purpose = Publish : In Cardano, every script has a purpose. “Publish” means the script was used for a certificate-related action, like registering or deregistering a stake key or pool. It’s not about sending ADA directly; it’s about changing staking status.
- Validator script hash tied to stake credential : The stake key (your staking identity) was controlled by a Plutus validator script instead of a normal signature. This means the smart contract had authority over your staking actions. Whoever could provide the correct redeemer and datum could deregister your stake or withdraw rewards.
Why this matters for the theft :
If your stake key was locked under a script, the attacker didn’t need your wallet signature—they only needed to satisfy the script’s logic. If the script was malicious or too permissive, they could deregister your stake and withdraw funds without your consent.
On 04/09/2025 at 12:59:43 (UTC), addr1q9nykmtau493j5xkmjfjwrtdz9uen4uahplfzjr2jc7p485qdqudrwzfgyzzmx44hyhw7xsh94qx9ac6ppd0877nv4fsjlcqs2: the wallet received 700,000 ADA under transaction hash 857f1006b5f1a53…35d47349. Prior to dispersal, the wallet also received a further 10,995.880131 ADA, bringing the total available balance to approximately 711,000 ADA.
The funds were subsequently broken up and sent out in eight separate transactions:
- 127,000.168963 ADA
- 127,500.168963 ADA
- 61,700.168963 ADA
- 130,000.168963 ADA
- 190,000.170549 ADA
- 63,794.696376 ADA
- 10,000.167730 ADA
- 1,000.169624 ADA
This equates to a combined outflow of 711,995.879131 ADA, which is consistent with the wallet’s total balance at the time (700,000 ADA plus the additional 10,995 ADA).
In summary, the original 700,000 ADA deposit was not sent on in a single transaction but was split across eight outputs totalling just under 712,000 ADA, funded by the 700,000 ADA transfer and an additional ~11,000 ADA received shortly beforehand.
To
Transaction Hash: fc6ceb6385ae9cfabf173ab51ec3323751e9796402e8f3f8491ace0c7301c422
Address: DdzFFzCqrht9e4tV7UFaUiGnbeXCLPXMtEvVwmgMFW8RxbL2rUDcxa7Q8ApYLURWx4J5WX6LcGkZddVrpUaHxVGRVu42KgDeV4PYDBqx
To
Transaction Hash: fc6ceb6385ae9cfabf173ab51ec3323751e9796402e8f3f8491ace0c7301c422
Address: DdzFFzCqrhszAisfe4k7wNnA8Ue4L3AyHVpdeewZkyrfScRqRptz6RxzzVdbvYNscoq7cWyz69sECE2tKwC7gKFiqu5dzLZfTs3ez1xy
UTXO: a9c9cd329a8aca9edae68aed7fbbd35f5651b0ca1ab4299010baa1e5634a6728
The characteristics of this wallet legacy Byron address format, extremely high transaction count, continuous 24/7 flow of ADA, absence of staking delegation, and sweeping/aggregation behaviour are consistent with control by a Virtual Asset Service Provider (VASP), most likely an exchange hot wallet.
While the specific VASP cannot be conclusively identified without confirmation from the service provider, the on-chain indicators strongly support the assessment that this address is part of an exchange cluster rather than a private individual’s wallet.
As can be seen from following the three trails: One of 1,000 ADA and two of 127,500 ADA all flows ultimately terminate in wallets that exhibit the characteristics of VASP controlled accounts, namely extremely high transaction volumes and continuous in/out activity. While this strongly supports the conclusion that the funds have entered custodial infrastructure, it cannot be stated with certainty that all three trails are controlled by the same VASP. It remains possible that they belong to different service providers, although the behavioural indicators are consistent across each.
Both of the large 127,500 ADA transfers ultimately converge into this address, which strongly suggests that it is controlled by a Virtual Asset Service Provider (VASP). At this stage, however, I have not been able to conclusively identify which VASP operates it.
asset tracers have identified the funds as moving to the following exchanges/services:
- Kucoin – 300k ADA
- HTX – 386 ADA
- SimpleSwap – 10k ADA
- ChangeHero – 197 ADA
- HitBTC – 1k ADA
I have re staked the wallet to easy1 and did so to see if my balance reappeared, also had other assets locked to that wallet which since have been removed. just in case the community asked.
If there are any Plutus script security experts, developers out there, i would be interested to talk and discuss an audit of the smart contract that caused this theft