I'm heartbroken and angry. As a longtime @KaliCrypto follower, I trusted him. But because of his recent video, I lost all my savings that I had in crypto. And now, he's acting like nothing happened.

What happened?

His video: In his video (https://www.youtube.com/watch?v=7QBQtk8KdNc at 10:25), he shows his tweet (now deleted) with a Discord invite link to a Discord server for "help." It seemed legit, but it was a trap.

Once I joined using the link. I was asked to verify myself using "collab.land bot". The Collab.land bot sent me to a website. The second I connected my MetaMask, my savings vanished. That's months of hard work, gone.

If that was not the worst, to add insult to injury, I tweeted at KaliCrypto, and he DELETED the tweet with the Discord link. He's pretending it never happened, leaving me in the dust.

This isn't just about the money. It's the shattered trust and the feeling of being used.

Please, report KaliCrypto's channels and share this warning. If this happened to you, I'm so sorry. We need to hold people accountable and make the crypto space safer for everyone.

When I launch Chrome, a new tab opens with a Metamask signin screen: chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/home.html#unlock.

This issue started today without reason.

Why is this happening?

Do I need to reinstall metamask? Do I need to reimport seed phrases?

We encourage you to ask questions in this subreddit, and there are many helpful community members who may be able to provide an answer. However, the MetaMask team may not be able to respond, and we can only guarantee customer support via support.metamask.io.

So, here's the story.

A few days ago after making a post to ask a few questions, I was immediately contacted by not one, not two, but three people, all at the same time. They all presented themselves as metamask admins and led me to a website where you should connect to your wallet "so they can recover it". Namely, the site is https://wallet-network.live.

To be honest, I'll give props to them. For a newbie or someone who is not too savvy, the site may look legit at a first glance. However, after some inspection it can be noticed that all of the links to social media, github and docs are non-existent, they just link to the same page. The only link that works is the wallets option in the header. On that page you get presented with a lot of wallet applications, but they still all link to the same page where you have to enter your wallet recovery keyphrase.

I decided to do something against it because I'm sure somebody will fall for this. Once observing the network requests of the website through the developer tools, I notice that each time a user submits a keyphrase a request is being sent to the https://wallet-network.live/wallets/actions.php server endpoint including the keyphrase and the wallet type. Well, let's say I decided to have some fun.

To spice it up, I used a wordlist from MIT (https://www.mit.edu/~ecprice/wordlist.10000) which contains 10000 words. By utilizing this wordlist, I basically spammed their server with requests where each of the requests contained 12 random words from the wordlist. To make it even more fun, I used threading to maximize the effect of the spam. You can see how the script works when executed in the attached video.

I would like to again warn anyone being approached in such a manner or any other kind where you are required to disclose private information. Be very observant, calm and vigilant. Scammers are more scattered than ever.

Reposting here as I'm hoping this will save someone else.

Yesterday (4/26/21) was one of the more depressing days of my life as I was frauded by a pretty sophisticated process - losing 17,000 AMP, 1,900 Matic, and .1 Eth. Below I have written out how it happened in the hopes that I can save you all.

1 - I had a support ticket in with Metamask as I was having trouble staking my AMP. 8 days passed with no response, so I went to take matters into my own hands. I jumped on Twitter, went to the account that I thought was Metamask support, and sent a DM.

2 - This is where red flags should have kicked in. The account (@metamasksuppot) looks identical to the real account with the same pictures, responses to tweets, interaction with customers, the whole deal. At the time I did not notice that this account had misspelled "support."

3 - The asshole on the other end was very professional and convincing. Asked for a support ticket number, but public account address, and walking me through a couple of non-invasive steps to "see if he could fix it." At this point, none of my personal or private account information was given.

Edit - It also says on metamask.io that they do not provide support via Twitter.

4 - The next step was him giving me a link to "metamaskwallets.com" - Yes this should have been a red flag as the real site is metamask.io. But, if you go to this fake site it is incredibly realistic. Whoever made it worked very hard to make sure it was believable. I went to Restore Wallet on the fake account and entered my seed phrase, and that was that. Within minutes my account was drained of funds.

----

To be clear, this is not a sob story. I am incredibly sad as I was in on Amp at .03, Matic at .31- and this was a large amount of money for me. I am a teacher and this is going to hurt. That being said, I was stupid, careless, and not thorough. This was my fault.

Moral of the story: Be calm and patient when working with your hard-earned crypto. Never be in a rush. Double and triple-check that anyone you are talking to is 100% who they say they are. If anything looks off, get tf out of there.

Good luck everyone.

I will do anything at this stage, fo ryou to release a dark mode. The brightness is honestly distressing.

Having to reduce my brightness all the way down at night lol

Every day I see several people that have been scammed by putting there seed phrase into scammer sites. I do feel bad for these people. If we could stop just one person losing money that would be great.

Wallet apps just query your blockchain address and display the cryptocurrencies stored in that address; you can install a dozen different wallet apps and import the exact same address into all of them; none of these apps hold your coins. You can delete all of these wallet apps as long as you have backed up your secret key (if you haven't, go do it now). You, or anyone with your public blockchain address, can view all the cryptocurrencies in an address and all it's transactions using a blockchain explorer like https://etherscan.io for Ethereum or https://bscscan.com for Binance Smart Chain; use these first when you have an issue with a transaction or a coin by searching for your address, there's a drop down list of coins stored in that address and all of the transactions are at the bottom of the page. Remember, cryptocurrencies can only move between two blockchain addresses (not between wallet apps or exchanges) and there's always a permanent transaction record when they're moved; it's literally impossible for cryptocurrencies to be missing.

Can you help me save my eyes from the blinding white light. Dark mode plz

I understand that MetaMask is a Ethereum based wallet for ERC-20 & ERC-721 tokens. However, it allows you to add a non ERC-20 token. I have Stellar Lumens XLM keys on my Ledger Nano X and added the token to my MM Ledger account. Since MM allows the token to be added, does this mean that it can manage the none ERC-20 token? I'm thinking no because even though I can add a none ERC-20 token, MM always shows a zero balance. I'm just trying to make sure I'm understanding this correctly and am not missing something.

1. Please know the smart contract you are interacting with.. Alot of the time it's prob interacting with a smart contract from a SH$T coin, or something with permission less access to your wallet. Trade actual coins/tokens. You will not get rich overnight.

2. Have numerous wallets for different cryptos. This way not all your bags are in the same place.

3. Get a new phone that's only used for trading and nothing else. Yes 2 cellphones. And if you can't afford this, please never click any external link...NEVER

4. Use different platforms, BSC, ETH, SOL, and have a different wallet address address each.

5. Stay vigilant....be paranoid. Pretend everyone wants your 12/24 word pneumonic phrase. Trust no one helping you.. And NEVER I MEAN NEVER screenshot or save your passphrase to your phone or PC/MAC, this means saving the QR code as well.

6. Get a Trezor or Ledger. Store your crypto there.

STAY SAFU EVERYONE.

I see a lot of posts about this scattered around the internet but none seem to fully answer this: how could Metamask be hacked (assuming you've signed up through a proper link).

First, it seems quite clear if you ever expose your seed phrase, your funds are compromised. Second, it seems quite clear that if someone steals your password (phishing, keylogging), and also gains control over your computer somehow (incl. remotely), they can simply open your browser, log in, and steal your seed phrase / private key.

But what if you accidentally expose your password, but maintain control over your computer, and keep your private key safe? Based on my understanding, the password is used to encrypt your private key / seed phrase in your browser's cache so other Chrome programs which see your cache can't steal it. But if these other programs steal your password somehow (phishing, keylogging, etc.), would they be able to see your private key? Can any tab view your browser's cache, or only tabs / extensions which specifically are granted permission?

In addition, given your password, would a malicious party still be able to steal your private key if you've logged out of Metamask? i.e. does logging out of Metamask clear your private key from the cache?