Rocket Pool's X account has been hacked. They are leading users to a fake website. At this website, users are directed to migrate funds, where they are given an exploit transaction. This exploit transaction transfers all the money from the user's wallet to the attacker. If you signed the exploit transaction while using DeFi Armor, you would be fully protected and not lose any funds.
As of right now, @Rocket_Pool is compromised on X (formerly Twitter) and has not recovered their account. The attackers made posts indicating the Rocket Pool protocol was hacked. They directed users to migrate funds out of Rocket Pool and into the “version 2” contracts.
They have continued reposting the tweets (presumably to make it appear more fresh in people’s feeds). You can see in the above image the tweet is 3 minutes old; that photo was taken hours after the hack began (photo taken at 14:56 EST).
Some additional photos from the twitter feed:
Importantly, the tweet contains a link to migrate your funds to a “safe” place. Underneath this link, Twitter says “From rocketpool.net”. This is a false indication of validity.
If you actually click the link, it takes you to https://rocketpool-migrating.net/. This is clearly not the correct Rocket Pool domain.
The website hosted at https://rocketpool-migrating.net/ is designed to look like the real Rocket Pool migration frontend.
Here’s a screenshot of the fake site:
When you click “Connect Wallet,” the fake Rocket Pool frontend immediately asks you to sign a transaction. This transaction attempts to transfer all of your ETH to the attacker’s wallet.
Here’s a screenshot of the requested transaction:
There are a few interesting things about this transaction:
If you had clicked the confirm button when this came up, you would’ve lost all your ETH in this attack.
DeFi Armor will not allow you to execute a transaction that does not pass the security engine; it will refuse to cosign the transaction. This is a trivial example of the kinds of attacks that the security engine prevents. DeFi Armor detects the interaction with an unknown address and declined to sign before even asking you for a signature.
Stay safe.
Kristian was previously a C++ developer at the intersection of edge computing AI and the space industry. He holds a BSc in Statistics from Columbia (2021).
.png)
