TopGoal

Wallet Stolen

Estimated loss

—

VERDICT —OUT OF SCOPE

Root cause is private-key / signer compromise — the on-chain contract behaved exactly as written. No pre-deployment source audit or bytecode review reaches the key-custody perimeter; this is operational-security territory (HSM/MPC hygiene, key rotation, hot-wallet isolation). Bytecode would show nothing wrong.

▰ METHOD

PRIVATE KEY

PRIVATE-KEY

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

Hot wallets operated by TopGoal were attacked and compromised. In this hack, only the hot wallet operated by TopGoal, which manages the distribution of TopPrize rewards, was affected. All user assets including NFTs and TMTs are safe. The hackers transferred a total of 4,809,984 TMT from the TopGoal-operated hot wallet to the address 0x7F0D082D08874A57110c73a8853967e7C19D1a6e. The hackers then exchanged all those TMTs from PancakeSwap for over 2,600 BNB and used Tornado to transfer the BNB out of the address. Attack method (per SlowMist): Wallet Stolen. Reported loss: 4,809,984 TMT.

Primary source

https://medium.com/@TopGoal_NFT/latest-update-and-solution-of-todays-hacking-event-e18774b6e69a ↗

Sourced from

slowmist

Technical record