a hack destroyed @Enter_Elysium today.
i traced it on-chain. it wasn't elysium. it wasn't @Boxa_Elysium or @TheKleos_ . it was one telegram bot holding everyone's keys.
what happened (utc)
> 11:53: the drain starts. 20 wallets concerned, 22 tokens dumped: kleos, blob, sendu, knuts, agora…
> 11:57: a fresh wallet (0x39f6…2d15b) sweeps 10 of them in 2 seconds
> 13:04: last wallet emptied
> 13:11: 1,028 hype (~$87k) stored in a second fresh wallet
> 13:20: first tweet mentioning the hack
20 wallets, ~$90k. and the same keys got swept on hyperevm and base too.
why it's the bot
> @ElysiumBuy_Bot's source code is public on github
> custodial: up to 20 wallets per user, every key encrypted with one master key on one server
> its rpcs: elysp, with boxa and kleos as backups. that's why boxa and kleos got blamed first
> but an rpc only relays signed txs. it can't sign one. whoever did this had the private keys
the bot's code signs with 1.3x the gas estimate, so a hype transfer goes out at 27,300 gas. the drain's went out at exactly 21,000. someone had the raw keys and their own script.
the collateral damage
> $kleos: -42% in 39 minutes. the drainer was 74% of all kleos sold in that window.
> $sendu: the drainer's sells alone did -46%. $knuts -41%. $blob -15%
> 779 of the 1,060 hype stolen came from dumping victims' bags into thin pools. holders who did nothing paid for it too
where the money is
> 1,028.46 hype in 0x9395…7883. nonce 0. hasn't moved since 13:11 utc
used @ElysiumBuy_Bot? move what's left now and never reuse those keys, on any chain.
