Slow Fog Cosine: GMGN Hacker drained user funds through honeypot withdrawal method, profiting over $700,000.

Odaily News Slow Fog's余弦 published on the X platform stating: “After reviewing dozens of stolen intelligence reports related to GMGN submitted to us, a commonality: the users' Private Keys have not been leaked, but SOL and BNB have all been purchased into a honeypot (which can only be bought and not sold). The Hacker mainly siphons off user funds by withdrawing the pools from the honeypot, profiting over 700,000 USD. The cause of this situation (not a Private Key leak) is likely due to a more advanced phishing method. Since GMGN has already fixed the related issues, reproduction is not easy, and it is speculated to be related to the GMGN account model. Users access phishing websites, and the phishing site obtains the login signature information of the user's GMGN account model, such as the accesstoken and refreshtoken values, taking over the user's account permissions. However, without the user's 2FA, it is impossible to directly export the Private Key or withdraw coins. Therefore, they implement a “counter-trade” attack on user funds through the honeypot, indirectly stealing user assets.”