I was hacked 2,500$ from hot wallets

This week, I was hacked and lost a total of $2,500 worth of tokens from 2 Metamask accounts from the same seed wallet. The stolen assets included over 0.5 ETH and several altcoins across Ethereum, Base, and Arbitrum networks.

The attack happened last Sunday at around 18:40 GMT+7 (28/9/2025) while I was outside. I even tried messaging the hacker, asking them to return at least part of the funds, but received no response.

Until now, I still don’t know how they gained access to my wallet and stole all my coins. I’m sharing this post to warn the community and to ask for help investigating the incident.

Please help me send an on-chain message to ask the hacker to return part of my tokens. This means a lot to me, and I promise to airdrop 50% to everyone who helps if the hacker returns the funds.

Context

My device: Macbook Air M1

My internet: home WIFI

My EOA: 0x3e7400f14176acb2266fec930a6aa52096fb77c1

Hacking transaction: https://basescan.org/tx/0x3bedf8f781b24658ecdb95a88f0848e19c92ac12b0a29c8783b1dc1a383b778b

Hacker EOA: 0x99cb7312fd78efd55332184f28ec0de91d9fece7

My interacted applications: Metamask, Debank and Binance

Details

28/9 15:45 - I swapped 1000 USDT deposit on Binance

28/9 15:26 - 15:56: My history browser

28/9 18:41 - while I was outside, the hacker transferred out 0.5 ETH from my wallet https://debank.com/profile/0x99cb7312fd78efd55332184f28ec0de91d9fece7

29/9 - After checking my portfolio, I realized I had been hacked. The attacker had withdrawn all my tokens from two accounts — a total loss of about $2,500.

0:30 - 30/9 - I tried messaging the hacker, asking them to return my stolen coins, but there’s been no reply.

31/9 - I started investigating and discovered several related accounts that had sent tokens to and from the hacker’s address.

Add-on information:

The time between the hacking incident and my last transaction was quite long, so I’ve ruled out phishing as the cause.

The hacker was able to access both of my accounts that were created using the same seed phrase within the same Chrome profile.

The other account on my second Chrome profile is still safe.

I’ve identified some information that may be linked to the hacker’s account. If you are a victim as well or have any knowledge about this individual, please reach out to me to assist with the investigation.

I won’t mention their names, but you can easily find the people who have interacted with the hacker’s account below: https://debank.com/profile/0x99cb7312fd78efd55332184f28ec0de91d9fece7

The final message

To hacker:

Hey guy, I still believe in kindness in life. This amount represents my hard work over a long time. I sincerely hope you can return the tokens you took. God bless you!

To community:

Hello everyone, today I was hacked — tomorrow it could be you. Please keep your tokens on a CEX or in a cold wallet. Use your hot wallet only for trading. Stay safe out there.

If you have a list of incoming or outgoing addresses linked to the hacker’s account, please contact me. I would also appreciate assistance from security experts who can help investigate this incident.

I warmly ask the community to help me spam the hacker to return my tokens, and I promise to relocate 50% to the community when I receive my tokens back.

To anyone considering targeting wallets: please remember there are real people behind every address. Returning a portion of stolen funds — even 50% — can deeply help victims and their family ones.

STAY SAFE AND PLEASE BE KIND !