ignore the rumors going around about Piteas. if there had been an issue on our side, it would not have affected just one person, it would have affected everyone. we checked the system end to end and found neither a leak nor any unauthorized access.
based on the post-mortem work we’ve done so far, and during this process we also stayed in direct contact with the victim to gather every detail, we can confirm that the user was directly targeted. the reason is simple: the signed transaction was pre-crafted and contains a wrap function that cannot be generated by the UI. on the app, wrap operations are executed by the wPLS contract, not by the router. this is also not the kind of malformed call that could have come from the API, and even if it had, the UI-side validation would still have rejected it.
the attacker is using a vanity address. address patterns similar to the victim’s are usually part of mass attack methods, so this looks less like a one-off handcrafted attack and more like the byproduct of some spreading malware logic. beyond the device or the vpn being compromised, we don’t see another realistic scenario. and even the vpn angle looks weak, because doing this over TLS v1.3 is basically impossible, though we still can’t fully rule out some other kind of network-side issue.
so at this point, our view is that malware on the victim’s device may have altered the response data of the request coming from the API directly inside the browser. in other words, the attacker may have embedded a script into the browser that waited for the right transaction flow and then replaced it with a fixed malicious call, likely with some form of self-delete behavior as well.
we are doing everything we can to protect users. for more than a year now, despite barely generating enough revenue to cover expenses and despite all market conditions, we have continued to work here for the ecosystem. so please do not give attention to the usual paid voices who are known for tweeting for money and are now, once again, trying to smear Piteas for money too.
even so, our team will still do its best to support the affected user however we can.
unfortunately, attacks on web3 touchpoints have increased a lot lately, and now users are being exploited through fake txs designed to target them directly. whether it’s Piteas or PulseX, Pulsechain or Ethereum, it doesn’t really matter which app or chain you’re on, because they send you pre-crafted calls based on the chain where your funds are and the app you use, then try to catch you with a blind sign.
we urge everyone to stay careful and protect themselves from becoming the target of these growing attacks.
our feeling is that DPRK may no longer be targeting just protocols, but users too. make sure your devices and your network or VPN are secure. stay safe.