{"id":47936,"date":"2025-08-13T18:30:11","date_gmt":"2025-08-13T15:30:11","guid":{"rendered":"https:\/\/coinengineer.net\/blog\/?p=47936"},"modified":"2025-08-13T18:16:22","modified_gmt":"2025-08-13T15:16:22","slug":"ethereum-developers-wallet-drained-what-happened","status":"publish","type":"post","link":"https:\/\/coinengineer.net\/blog\/ethereum-developers-wallet-drained-what-happened\/","title":{"rendered":"Ethereum Developer’s Wallet Drained! What Happened?"},"content":{"rendered":"

Ethereum<\/strong> <\/a>core developer Zak Cole<\/strong> lost access to his funds after a fake artificial intelligence extension stole his private key. This incident once again highlights how sophisticated wallet drainer<\/strong> attacks in the crypto space have become.<\/p>\n

\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n

  • Threat From a Malicious Extension<\/a><\/li>
  • Wallet Drainers on the Rise<\/a><\/li>
  • Attacks Can Now Be Rented<\/a><\/li><\/ul><\/nav><\/div>\n

    <\/span>Threat From a Malicious Extension<\/span><\/h3>\n

    Cole explained that he had installed a Cursor AI<\/strong> extension named \u201ccontractshark.solidity-lang,\u201d which appeared trustworthy with a professional icon, detailed description, and over 54,000 downloads. However, the extension read his .env<\/strong> file and transmitted the private key to the attacker\u2019s server. This gave the attacker three days of access to his hot wallet before draining the funds on Sunday.<\/p>\n

    \u201cIn over 10 years, I have never lost a single wei to hackers. Then I rushed to deliver a contract last week, and this happened,\u201d Cole said. He noted that the loss was limited to only a few hundred dollars worth of Ether<\/strong>, as he keeps his main holdings on hardware wallets and uses small, project-specific hot wallets for testing.<\/p>\n

    \n

    I've been in crypto for over 10 years and I\u2019ve Never been hacked. Perfect OpSec record.<\/p>\n

    Yesterday, my wallet was drained by a malicious @cursor_ai<\/a> extension for the first time.<\/p>\n

    If it can happen to me, it can happen to you. Here\u2019s a full breakdown. \ud83e\uddf5\ud83d\udc47<\/p>\n

    — zak.eth (@0xzak) August 12, 2025<\/a><\/p><\/blockquote>\n