The ledger remembers everything. On February 20, 2025, Scam Sniffer flagged a wallet drain: two addresses belonging to the same entity lost $25 million in under 15 minutes. The assets included DAI, WBTC, aUSDC, LDO, sUSDe, and ETH. The attacker converted everything to DAI and ETH within one hour, dispersing the funds across multiple addresses. The victim was familiar. This same wallet had lost $24 million in a phishing attack in 2023—and then received 90% of those funds back after the attacker returned them. The data shows a pattern. The question is not whether the victim will recover this time, but whether the industry is learning the right lessons.
Context: The 2023 Phishing Event and the False Signal
In May 2023, the same wallet was drained of 4,851 rETH and 9,579 stETH via a phishing approval. The attacker tricked the victim into signing a token approval transaction, granting the attacker control over the staked assets. The attacker then returned roughly 90% of the funds, reportedly under pressure from on-chain tracking and potential legal action. The market interpreted this as a rare positive outcome: blockchain security tools worked, and ethical hackers returned stolen assets. The narrative was self-correcting.
But the data tells a different story. The victim’s key management practices remained unchanged. The wallet continued to hold a diversified portfolio of DeFi assets, and the private key—or seed phrase—was stored in a manner that remained vulnerable. The 2023 incident should have been a warning. Instead, it became a psychological anchor: if an attack can be reversed, why invest in cold storage or multi-signature wallets?
Core: The On-Chain Evidence Chain
Scam Sniffer’s report provides the raw data. Two addresses were drained simultaneously. The attack vector is diagnosed as private key leakage, not phishing approval. This distinction is critical. A phishing approval requires the victim to sign a transaction. A private key leak gives the attacker full control without any further user interaction. The attack speed confirms this: both wallets were emptied in 15 minutes. The attacker then used a series of automated swaps to convert WBTC, LDO, sUSDe, and aUSDC into DAI and ETH. The entire wash cycle completed in under one hour.
Based on my experience analyzing the 2022 Terra/Luna collapse, where I traced $3.2 billion in outflows, the speed of conversion is a definitive signal of a professional operation. The attacker did not manually trade each asset. They used a bot or a script that executed a pre-planned liquidation path. The choice to convert to DAI and ETH is strategic: DAI is a decentralized stablecoin with deep liquidity on Uniswap and Curve, while ETH is the base asset for most DeFi and can be bridged or mixed with relative anonymity.
The victim’s asset composition also reveals their profile. Holding aUSDC indicates active participation in Aave lending. LDO suggests staking through Lido. sUSDe is a relatively new synthetic dollar from Ethena. This is not a novice. This is a power user who understands yield farming, leverage, and cross-protocol strategies. Yet they relied on a single private key for custody. The 2023 attack should have triggered a migration to a hardware wallet or a multi-signature setup. The data shows it did not.
I can infer the most likely private key exposure path. The victim had a history of phishing susceptibility in 2023. That suggests they are a target for social engineering and malware. A clipboard hijacker, a keylogger, or a compromised browser extension could have captured the seed phrase. Alternatively, the key may have been stored in a cloud service that was breached. The attacker may have been monitoring the wallet for months, waiting for the optimal moment to strike. The 15-minute drain window suggests they had access to the private key all along but chose to execute when the portfolio was at its peak value.
Contrarian: Correlation vs. Causation—The 2023 Return Was a Trait, Not a Guarantee
The market’s quiet assumption is that the 2023 return will repeat. The data does not support that. The 2023 attacker was likely a group that faced tracking pressure and decided to return funds to avoid legal consequences. The 2025 attacker behaves differently. They did not use a phishing approval, which requires the victim to be online and interact. They used a private key, which means they already had full access. They did not wait for negotiation. They immediately converted and dispersed. This is a profit-maximizing entity, not a political activist or a white-hat hacker.
Furthermore, the 2023 and 2025 attacks may not be the same actor. The attack vectors are different, and the timing is separated by two years. If it were the same group, they would have already had access to the private key from the first attack. The fact that they used phishing in 2023 suggests they did not have the key then. The 2025 attacker likely obtained the key through a separate compromise—perhaps a malware infection that occurred after 2023. The victim’s security posture did not improve; it regressed.
There is a dangerous narrative circulating: “On-chain tracking works, so self-custody is safe.” The data shows that tracking works for phishing approvals, where the attacker’s address is visible and can be pressured. For private key leaks, the attacker has no need to interact with the victim. They can move funds through mixers, cross-chain bridges, and centralized exchanges with KYC gaps. The 2023 return was a correlation—a specific set of circumstances that allowed recovery. The 2025 attack is a causation of poor key management. The two are not linked.
Takeaway: The Next-Week Signal
Over the next seven days, I will be monitoring the attacker’s addresses for any LDO or sUSDe sell-offs. If the attacker holds those tokens, they may be waiting for higher liquidity. If they dump them, it will create short-term price pressure on LDO and sUSDe. The key signal is whether the funds enter a centralized exchange. If they do, we may see a freeze request. If they disappear into a cross-chain bridge, recovery is unlikely.
The broader signal is for the industry: the victim’s story is a case study in the failure of security education. The 2023 return created a false sense of safety. The data shows that the only reliable defense is eliminating private key exposure entirely. Account abstraction, multi-party computation wallets, and hardware wallets are not optional for high-value holders. The ledger remembers everything, but it cannot protect you from yourself.
Follow the gas, not the gossip. Data > Narrative. The ledger remembers everything.
