XRay

🚨 WARNING: @fomo wallets can be drained through malicious browser bookmarks, even with 2FA enabled. Yesterday a friend of mine had around $36k drained from his FOMO wallet. I wanted to make a post about this because I don't think a lot of people know about this type of exploit. Scammers are creating what look like useful crypto tools, such as wallet trackers, Twitter trackers, smart money trackers, etc. The trick is that they can disguise malicious JavaScript as a bookmark or shortcut for these tools. So when you think you're saving a useful trading tool, you could actually be saving malicious code. They'll get you to drag something into your bookmarks bar or save what looks like a normal shortcut. The problem is that some of these aren't actually normal bookmarks. They're called bookmarklets, and they contain JavaScript that runs directly on whatever website you're using when you click them. If you're logged into something like FOMO, that code can potentially interact with your authenticated session. One possible attack is that the script waits until you've completed 2FA and then abuses the authenticated session to initiate a private key export. Once the attacker has your keys, they can drain your wallet. What's even more concerning is that FOMO/Privy logs can show these actions coming from your own IP, device, and browser session. So from their end, it can look like you were the one who authorized everything, even if you weren't. I want to make something very clear for anyone using browser-based trading wallets: DO NOT save or execute random bookmarklets that people advertise as trading tools. Bookmarking a normal website is fine. The danger is saving and running bookmarks containing executable code, especially ones starting with javascript:. If someone tells you to paste code into a bookmark or drag a random tool into your bookmarks bar, be extremely careful. And don't assume having 2FA enabled makes you immune to this. Just wanted to put this out there because I know a lot of people in the trenches use these kinds of tools every day, and I don't want to see someone else lose their money over something they didn't even realize was dangerous.