LootBot-Linked Wallet Drain Hits 3,825 Addresses Across 9 Chains, Steals $620K 

Points of Focus

• At least 3,825 wallets linked to LootBot were drained across nine chains after activity began on Sept. 7, according to onchain investigator SomaXBT. 
• Of 554 onchain-identifiable LootBot payers, 280, or 50.5%, were drained by the same address.
• The multichain sweeps point to possible private-key exposure, while the source of the compromise remains unconfirmed.

More than 3,825 wallets linked to LootBot were drained across nine blockchain networks after a sweeping operation began on Sept. 7, with roughly $620,000 moved by the time investigators issued a warning two days later.

Onchain investigator SomaXBT said the activity began at 13:18 UTC on Sept. 7 and traced the funds to address 0x4e5df8422271690327c0348845b639196ab0081e. The researcher estimated that about 252 ETH had been taken and said 1,967 affected wallets were swept on at least two networks.

LootBot-linked wallets were swept across multiple chains

SomaXBT also examined a narrower group of identifiable LootBot users. Of 554 addresses that had paid LootBot onchain, 280, or 50.5%, were drained by the same address.

The reported activity moved through networks in batches, beginning with Ethereum and zkSync Era before progressing to Linea, Base and Scroll. SomaXBT observed the drainer scanning Scroll at roughly 27 wallets per minute.

Affected wallets frequently lost almost their entire balances, with small native-token amounts left behind for gas. Transfers of native assets across several chains without prior token approvals led SomaXBT to point to possible private-key compromise as the likely mechanism. 

The source of that exposure remains unresolved. SomaXBT said the LootBot deployer showed no onchain connection to the draining address and raised a third-party breach as one possible explanation. The researcher said the issue had been reported to the LootBot team and founder.

LootBot stores encrypted keys for generated wallets

LootBot describes itself as an automated airdrop and multichain wallet tool. Its wallet documentation explains how users create wallets, fund them and automate activity across supported networks. 

The security documentation says private keys generated through the service are stored in encrypted form using Advanced Encryption Standard, or AES. The documentation does not explain how the keys associated with the affected wallets may have become accessible.

LootBot later expanded its automation through an Intent Terminal supporting scheduled swaps, bridging, liquidity provision and multichain transaction tracking. 

The incident follows a series of security events involving stolen credentials and rapid cross-chain fund movement. A Coldcard-linked attacker recently moved stolen Bitcoin through THORChain and CoinJoin, and a crypto developer lost $170,000 after installing a malicious application. Earlier this week, Liquid Network paused after roughly 4,000 BTC was withdrawn from its federation wallet, before about 3,400 BTC was later returned following a software fix. 

SomaXBT advised anyone who had used LootBot to move remaining funds. The loss total could increase as additional addresses and networks are checked, and the breach vector remains under investigation.