Crypto Wallet Drained by ThirdWeb Contract: A Tale of Digital Misadventure! 🎩💸

by

In a twist of fate worthy of a Soviet-era farce, Jill Gunter, co-founder of Espresso, found her crypto wallet emptied by a Thirdweb contract vulnerability. The theft, which unfolded like a poorly choreographed ballet, saw $30k vanish into the ether on Dec. 9 via Railgun-because nothing says “privacy” like a privacy protocol.

  • Jill, a 10-year crypto veteran (read: someone who still believes in the dream), reported her USDC stablecoin stolen mid-presentation on cryptocurrency privacy. Because nothing screams “security” like discussing it while your funds flee. 🎭
  • The culprit? A legacy Thirdweb contract, a relic of digital antiquity, allowing access to funds with unlimited token approvals. One might call it a “feature,” but Jill calls it a “hazard.” 🤡
  • Adding insult to injury: a 2023 open-source flaw affected 500+ contracts and was exploited 25 times. Thirdweb’s response? A blog post declaring the contract “decommissioned”-a word they’ll define in their next quarterly report. 📚

Gunter’s saga began as she prepared for a Washington, D.C. event, only to discover her jrg.eth address had been raided by shadowy forces. The funds, transferred to 0xF215, were flagged by a contract interaction with 0x81d5-a bridge contract she’d used for a $5 transfer. Thirdweb, ever the helpful neighbor, informed her of a vulnerability discovered in April. “Unlimited token permissions” now mean “unlimited grief,” apparently. 😅

Thirdweb’s April 2025 response? Label the contract “compromised” on Etherscan. Meanwhile, security researcher Pascal Caversaccio criticized their disclosure strategy, noting it gave hackers a “heads up” like a pirate’s Jolly Roger. ScamSniffer reported 500+ contracts affected, with 25 exploited. One wonders if anyone at Thirdweb plays chess… or just checkers. 🃏

Gunter, ever the optimist, pledged to donate recovered funds to SEAL Security Alliance. A noble gesture, assuming the funds return. Until then, she’s content to let the blockchain’s “trustless” nature work its magic. 🤷♂️

Read More

2025-12-13 04:05