A new security incident in the cryptocurrency ecosystem is causing particular concern within the community, as over 500 dormant Ethereum wallets were suddenly emptied of assets, resulting in an estimated loss of around $800,000. Information reported by the cryptocurrency news platform CryptoSlate suggests this could be a sign of an attack targeting older wallets that have been in existence for years and whose owners no longer monitor them regularly.
According to on-chain data, over 260 ETH – equivalent to approximately $600,000 – were transferred to an address flagged as fraudulent on Etherscan with the identifier “Fake_Phishing2831105”. This address then transferred another 324,741 ETH through the THORChain Router v4.1.1 routing system, showing clear signs of money laundering or asset swapping aimed at erasing evidence.
Notably, the majority of affected wallets belong to the "Longing-dormant wallets" category – meaning wallets that have been inactive for a long time, possibly for many years. Blockchain security experts believe there are several possible reasons for this mass attack. One of the most frequently mentioned scenarios is that the private key or Seed Phrase of these old wallets may have been leaked long ago, possibly due to users storing them on email, the cloud, or personal computers that are no longer secure. Additionally, outdated wallet tools, obsolete key managers, or previously leaked backup files on the internet could also be sources of data that hackers could exploit.
In recent years, "hidden wallet sweeps" have become increasingly common, coinciding with the trend of hackers using AI and leaked data to scan large numbers of old keys. Some of the latest security reports in 2026 show that many datasets containing leaked private keys from 2017–2020 are still being offered for sale on underground forums. As ETH prices rise again, these seemingly forgotten wallets are becoming attractive targets.
