Not the wallet. The staking fee pipes.
MetaMask says unauthorized access to staking infrastructure diverted about 0.385 ETH in rewards. Validators are exited. User wallets and staked principal look untouched — but the diversion address is public.
Addresses in the next reply.
MetaMask staking fee-recipient diversion (incident Sep 28, 2026; Nov 5 update)
~0.385 ETH rewards diverted; Tornado Cash-funded recipient
0x98B9231de84334c1d48BA0b72CF13f92484924A3
metamask.com/news/user-updat…
protos.com/metamask-unstakes…
96 wallets. Seventy minutes. Same signature: the victim's own key.
Definitive's growth lead watched an old hot wallet empty, then mapped a drain wave he ties to noble.base.eth. Relay blocked the attacker. Railway link still a hunch.
Addresses in the next reply.
Railway-linked hot-wallet drains (Nov 5, 2026)
96 Ethereum wallets drained ~70 min from 16:11 UTC; seed/key theft pattern
Operator (ETH/Base):
0x7028174ED69A237DE0791101b5b85D1E6Db35887
Funder / noble.base.eth (Base):
0x2405Cf271723901e0020D59c2405f239151c9221
Relay: operator wallet blocked
teapawt.org/theczarlos/status/2118…
basescan.org/address/0x2405C…
about 10 minutes ago one of my old hot wallets was drained
this looks like an industrial-scale attack by noble.base.eth (using 0x7028174ED69A237DE0791101b5b85D1E6Db35887)
my current hunch is that this is linked to the @Railway exploit
1% to 4% a day. Max return 500%. Plans from $50 to $50,000.
That's the Facebook pitch for a platform called MEXCOL, complete with screenshots of "completed" BTC withdrawals.
The withdrawal addresses in those proofs are masked. The daily yield isn't.
Details in the next reply.
MEXCOL, Facebook (Nov 4-5, 2026)
Site: mexcol[.]co
Plans: BROZONE / GOLD / PLATINUM
Daily ROI 1.0-4.0%, Direct Income 5-8%, max return 500% (min US$50)
Promoters posting masked BTC withdraw "proofs" (bc1…*****)
No company, CNPJ or complete deposit address found
One tap in Safari. Then the whole wallet is gone.
Bitquery traced ≥$4.06M USDT emptied from 365 TRON wallets in a month, plus 8 other chains. The trail points to iPhone seed theft via booby-trapped pages (DarkSword-style kits), not app flaws.
Addresses in the next reply.
iPhone DarkSword / Safari seed-theft drains (Oct 5–Nov 4, 2026)
≥$4.06M USDT from 365 TRON wallets; ≥$103K more on 8 other chains (Bitquery)
Fee wallet (TRON):
TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk
Collectors (TRON):
TNJPXRWEptdSzbC1pYGp8suyTao4qddJe6
TEDjNzXWsTrRcHmRnGPPqGRmqCmrA1vvGZ
TXgDHFfNia3PmJKM5u5U35ePDku7TUV6Xo
TEdbrs5teWWyzAtP639fRAX2yKNPCSMqJe
JustLend route:
TWUPpTF63yevhZ55eoN6CbDodZzgp856n4
TZ7soEw5nn5mvC9k5pNszB74261Hjotfbf
bitquery.io/investigations/i…
Buy BNB cheap on Google. Sell it on another site for 9% more. Repeat.
About ten Instagram accounts posted that exact reel in two days. Same script, same numbers, same "exchange."
When a price gap that big exists on one site only, the gap is the trap.
Details in the next reply.
Wavemox fake arbitrage, Instagram ES network (Nov 4-5, 2026)
Site: wavemox[.]com
Pitch: buy BNB on Google, sell on Wavemox for '9% profit per cycle'
Same pattern as Oimox (+8% Binance->Oimox). No company, CNPJ or deposit address found
instagram.com/reel/DfTRhO2IA…
IG accounts in the network:
@atlantazazi @igsara966 @goattyyyo @hormaywed @gsrgsruu
@rhil.eee @gmwbmwonly @hous_ewave @ysmpqges @lozaonly
IG accounts in the network:
@atlantazazi @igsara966 @goattyyyo @hormaywed @gsrgsruu
@rhil.eee @gmwbmwonly @hous_ewave @ysmpqges @lozaonly
The fake price is the hook: deposits go in, withdrawals don't come out. The domain is on our blocklist.
Buy SOL on Binance. Sell it on another exchange for 8% more. Repeat.
Five Instagram accounts posted that exact reel in two days. Same script, same numbers, same "exchange."
When a price gap that big exists on one site only, the gap is the trap.
Details in the next reply.
Oimox fake arbitrage, Brazil (Instagram, Nov 2-3)
Site: oimox[.]com
Pitch: buy SOL/ETH on Binance, sell on Oimox for '+8% per trade'
Accounts: @otta.wex @bat.gedr @goose.edr @dolp.hinddd @otter_dex
No company, CNPJ or license found
instagram.com/reel/DfPghR0PI…