Ongoing Attack Drains Over $107,000 From EVM Wallets

Edgen Crypto·Jan 02 2026, 00:36

Share to

Share to

Copy link

Key Takeaways

An ongoing security breach has affected hundreds of wallets on various EVM-compatible chains, leading to cumulative losses exceeding $107,000. The exploit, identified by on-chain investigator ZachXBT, involves draining small sums from numerous accounts, with the root cause still unknown, creating uncertainty across the ecosystem.

Widespread Exploit: An unidentified attack is actively draining funds from hundreds of wallets across multiple EVM-compatible blockchain networks.
Accumulating Losses: Total funds stolen have already surpassed $107,000, with attackers keeping individual wallet losses below $2,000 to likely avoid immediate detection.
Unknown Cause: The specific vulnerability or method used by the attacker has not yet been identified, raising concerns about a potential larger, systemic security flaw.

Attack Siphons Over $107,000 From Hundreds of Wallets

An ongoing, widespread attack is draining cryptocurrency from hundreds of wallets across multiple Ethereum Virtual Machine (EVM) compatible chains. On-chain investigator ZachXBT first reported the incident, noting that total losses have surpassed $107,000 and continue to climb. The attacker is employing a “low and slow” strategy, siphoning relatively small amounts—typically under $2,000—from each compromised wallet. This method appears designed to fly under the radar of automated security alerts that trigger on large, single transactions, allowing the cumulative theft to grow significantly without immediate alarm.

Unknown Vulnerability Threatens Broader EVM Ecosystem

The most concerning aspect of the attack is that its root cause remains unidentified. The wide distribution of affected wallets suggests the vulnerability may not be isolated user error but could stem from a flaw in a widely used dApp, browser extension, or wallet software. This uncertainty creates a significant risk for the broader EVM ecosystem, as a compromised smart contract or infrastructure component could lead to far greater losses. Until the exploit vector is pinpointed and patched, a cloud of insecurity hangs over users and protocols operating on EVM-compatible chains, potentially eroding user trust and suppressing on-chain activity.