A fresh on-chain alert has raised concerns across the crypto space after blockchain investigator ZachXBT reported a coordinated wallet-draining incident affecting hundreds of users across EVM-compatible networks. The warning, shared widely on X, highlights a pattern of small but persistent losses that together have already crossed $107,000 in stolen funds.
What makes this incident stand out is its scale and subtlety. Rather than targeting large balances, the attacker appears to be draining amounts under $2,000 per wallet, allowing the exploit to spread quietly without triggering immediate alarms.
How do crypto wallets get drained
According to ZachXBT’s findings, the affected wallets span several EVM chains, confirming that this is not a single-chain issue. The consistency in transaction size and timing points to a coordinated effort rather than random thefts.
At this stage, the exact cause of the wallet drains has not been identified. No specific wallet provider, protocol, or smart contract vulnerability has been officially blamed. Investigators have only confirmed that funds are being routed to related addresses, suggesting a single actor or group behind the activity.
Why This Attack Pattern Matters
While the dollar amounts per wallet are relatively small, the broader risk lies in the method. By targeting many wallets for limited sums, attackers can bypass user detection and delay response times. This strategy also highlights ongoing security risks for self-custody users interacting across multiple chains.
The incident arrives amid growing scrutiny of wallet security following several high-profile exploits in late 2025, reinforcing concerns around approvals, permissions, and private key exposure within the EVM ecosystem.
A Broader Pattern of Crypto Exploits
This incident arrives amid a broader wave of crypto security breaches. According to blockchain security firm PeckShield, December recorded around 26 major crypto exploits, resulting in approximately $76 million in total losses. While that figure marks a sharp decline from November’s $194 million, it highlights that exploit activity remains persistent even as markets mature.
One of the most notable cases last month involved Trust Wallet, which suffered a security incident tied to a specific version of its browser extension. The breach, which occurred during the Christmas period, led to roughly $7 million in losses. Trust Wallet has since begun compensating affected users and rolled out updates aimed at improving verification and reimbursement processes.
Investigation Still Ongoing
ZachXBT has emphasized that the situation is still developing. As of now, there is no confirmed exploit vector, and users are being urged to remain alert while investigators continue tracking fund movements.
The event serves as another reminder that even routine wallet activity can carry risk in a rapidly evolving threat environment, especially when attackers focus on stealth rather than scale.
FAQs
A wallet drain happens when attackers move funds out without consent, often using compromised approvals, phishing links, or leaked private keys.
Revoke unused approvals, avoid unknown links, use hardware wallets, and regularly review transactions across all connected chains.
They delay detection, affect many users, and expose ongoing security risks in self-custody, even without large single losses.
