Hackers Pilfer $380,000 in Bitcoin from Ordinal Rugs Founder

The founder of the Ordinal Rugs project fell victim to a phishing attack, resulting in the theft of 1.47 BTC (~$102,500) and bitcoin “inscriptions” worth 4 BTC (~$278,000) from his hot wallet.

Wallet Drained, A Port-Mortem…

Earlier today I fell victim to a wallet drainer on one of my personal hot wallets, losing 1.47 BTC plus around ~4 BTC worth of ordinals ($300k+ USD)

In the ten years I’ve spent in crypto, this is the first time I’ve lost a sizable amount… pic.twitter.com/nhsBDmrWWV

— Archon ⚡️ (@bitarchon) March 26, 2024

“In my ten years in the crypto industry, this is the first time I’ve lost a significant amount of money due to hacking/scamming (not to mention a wallet drain),” said the platform’s head, known as Archon.

The breach began with a message sent to members of the Bitcoin Rock Discord server, advertising a giveaway of popular Runestones ordinals. The link in the post led to a fake Magic Eden NFT marketplace site.

When Archon connected his wallet to the site and signed a transaction, the hacker was able to steal his coins and “inscriptions.” He admitted to being careless, forgetting basic security rules.

“The affected wallet was intended only for issuing [bitcoin-NFTs], but over time I became careless and left more ordinals there, as well as funds for buying and exchanging,” he noted.

According to him, during the phishing distribution, the attackers tagged all participants using the @all command, though only server administrators had the rights to do so.

Archon discovered a new way to manipulate pings in the channel, using what is called “markdown flow.” He concluded that even large and well-protected servers are at risk of attack.

“This is an extremely painful lesson. There is truly nothing worse than the moment you realize your wallet has been drained. Be vigilant when it comes to connecting to giveaways or minting tokens,” reminded the founder of Ordinal Rugs.

In conclusion, Archon noted that the project’s wallets were not affected. He also thanked some community members for redeeming two stolen “inscriptions,” which were subsequently returned to him.

Earlier, analysts at Pocket Universe warned of global crypto phishing on Discord. They stated that criminals have learned to embed malicious links directly into messages for disguise.

Back in March, unknown individuals hacked the blockchain account of The Open Network on X and posted a fake airdrop announcement.

In the same month, X accounts of several crypto industry influencers were compromised to promote the scam token PACKY. The hacker gained access through the IFTTT (If This then That) automatic posting service.