A security breach on X resulted in the theft of over $2.2 million worth of meme coins on Solana. Blockchain investigator ZachXBT revealed the attack exploited a vulnerability in X’s mobile platform, leading to losses across multiple tokens in what appears to be a sophisticated phishing operation against Wallstreetbets. The attack resulted in the theft of multiple tokens, with the major losses including $1.43 million in PNUT, $400,000 in ZEREBRO, and $130,000 in ALCH tokens. Source: ZachXBT Telergam channel According to ZachXBT’s Telegram announcement, the attackers exploited a previously identified bug in X’s mobile platform. This allowed them to add passkeys to compromised accounts—a vulnerability that remained invisible to original account owners and wasn’t being properly addressed by platform support. The vulnerability affects the platform’s mobile interface, allowing attackers to maintain persistent access even after apparent account recovery attempts. You might also like: MicroStrategy hits $40b in Bitcoin, critics question Saylor’s strategy Wallstreetbets regains access to the account Wallstreetbets has since regained control of their account. He also confirmed that the unauthorized tweets containing malicious links had been posted during the compromise. The account holder revealed they had been battling unauthorized access attempts for approximately one month. The user is also working in conjunction with X’s security team to resolve the continuous security issues. URGENT: I just deleted the following tweet which was NOT written by me. As you my or may not know I've dealing with fraudsters hacking my account for a month. I will NEVER ask you to click a sketchy link and certainly NEVER tell you to buy something (except maybe $XRP ). pic.twitter.com/4hB8gaC1Pn — wallstreetbets (@wallstreetbets) December 8, 2024 In a direct message to the attackers, Wallstreetbets issued a stern warning, claiming knowledge of their identities despite their use of VPN services to mask their activities. “Hiding your logins to my account with a VPN is a laughably weak way to cover your tracks,” the account stated. Wallstreetbets suggested possible legal consequences for the criminal activity. The account holder has also reached out to potentially affected users, requesting them to share details of any losses through direct messages. This information is intended to be forwarded to authorities as part of ongoing investigations into the security breach. Wallstreetbets wasn’t the only major breach on Sunday. Cardano’s X account was also hacked , with details of a phony U.S. Securities and Exchange Commission lawsuit posted before being taken down. Read more: Baby Doge Coin surges over 75% following Elon Musk’s cryptic tweet
