Beware of Unencrypted Web session exploit attacks!
Doing Crypto Transactions Using Open Public Wi-Fi Is an Unsafe Practice
The first Web3 news article I read this year was about how an X user, Smart Ape, had his hot wallet drained after performing a crypto transaction using an open public Wi-Fi network. He later shared his experience publicly so others could learn why using open public Wi-Fi for crypto transactions is an unsafe practice.
Public places such as cafés, restaurants, airports, and hotel lobbies often provide free internet access without requiring a password. While convenient, these open networks are unsecured connections.
Since these networks can be accessed easily without a password, users may unknowingly connect to rogue or fake Wi-Fi access points set up by attackers with similar names.
When connected to such fake networks, users can be silently redirected to malicious or incorrect web servers, exposing them to phishing attempts, credential theft, or wallet-related exploits.
It is a sound practice to avoid financial and crypto transactions on open public Wi-Fi networks. If a transaction is unavoidable, users should prefer:
• A mobile hotspot from their phone, or
• A reputable VPN to secure their internet traffic
Crypto travelers don’t do crypto transaction using Public Wifi Connections without VPN! Access internet from your Mobile instead!
Why Users of Open Public Wi-Fi Are Vulnerable
Home and office internet connections are usually protected using WPA/WPA2 security and require a password. These networks encrypt traffic between the user’s device and the router.
Open public Wi-Fi networks, on the other hand, do not provide this protection. As a result, attackers connected to the same network can attempt to intercept or manipulate web traffic while it is in transit.
This creates a high risk of Man-in-the-Middle (MITM) attacks, which is what happened in SmartApe’s case.
MITM Attacks and ARP Spoofing
MITM attacker equipped to intercept web session traffic transmitted between user and Network and vice-versa
One common MITM technique used on open Wi-Fi networks is Address Resolution Protocol (ARP) spoofing.
In this attack, a malicious actor tricks the victim’s device into sending web traffic to the attacker’s machine instead of directly to the router. The attacker positions themselves between the user and the network, silently relaying traffic back and forth.
By doing so, the attacker can:
• Observe user activity
• Modify web responses in transit
• Inject malicious JavaScript into webpages
MITM attackers can also redirect users to fake websites via DNS manipulation, enabling phishing attacks.
How Smart Ape’s Wallet Was Drained
MITM attacker modified the Page Response by inserting his JavaScript into Web Session Browser!
Smart Ape performed a swap on the Jupiter DeFi platform using his Phantom wallet while connected to an open public Wi-Fi network in the lobby of a Hyatt hotel.
The swap transaction executed normally on the blockchain. However, at the Web2 level, the webpage session response sent back to his browser was intercepted by a MITM attacker on the network.
The attacker modified the JavaScript in the webpage response before forwarding it to Smart Ape’s browser. When the page loaded, this injected code triggered Phantom Wallet to request an asset approval with maximum allowance.
Believing it to be part of the normal swap process, SmartApe approved the request. While the swap completed successfully, the approval granted the attacker delegated authority to move assets from the wallet.
After Smart Ape left the hotel, the attacker used this approval to drain the wallet, transferring SOL and NFTs worth approximately $5,000.
Fortunately, Smart Ape had distributed his assets across multiple wallets, limiting the damage.
Additional Security Practices Crypto Users Should Follow
• Review wallet approval requests carefully before signing
• Revoke unused token approvals regularly
• Verify DeFi website URLs and avoid clicking links from emails
• Keep operating systems, browsers, and wallet software updated
• Use hardware wallets for large holdings
• Avoid publicly disclosing crypto holdings
Smart Ape’s experience highlights that crypto theft can happen non-violently and silently. In some cases, attackers have even resorted to physical threats. Security awareness is therefore essential not only for asset protection, but also for personal safety
Closing Note
This is my first Web3-related write-up of the year, and I begin by highlighting a foundational topic: security habits that every crypto user must adopt to protect their assets.
Image and Content Credits -:
- The article banner is made by me using Canva
*- Other explanatory images were taken from Smart Ape’s x Thread *
I originally encountered this Crypto theft story in Tradingview