This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan.
SomaXBT: Address Drains LootBot Paying Users, Transfers ~245 ETH
N
News EditorOn September 8, on-chain investigator SomaXBT posted an alert about an address 0x4e5... that is actively draining wallets belonging to paying users of LootBot, an automated interaction bot. The attacker has already transferred roughly 245 ETH, valued at approximately $600,000. SomaXBT's data shows that out of 554 identifiable LootBot payers, about 280 (50.5%) have been emptied by the same address. The attack is being carried out on a chain-by-chain basis: it first targeted Ethereum and zkSync Era, then Linea and Base, and at the time of the post, the attacker was scanning Scroll at a rate of about 27 wallets per minute. The drainer appears to take nearly all balances, leaving only enough for gas, indicating it is not a fixed subscription fee theft. SomaXBT has notified LootBot's team and founder but has not yet received a response.
On-chain investigator SomaXBT sounded the alarm on September 8, revealing that an address 0x4e5df8422271690327c0348845b639196ab0081e is actively draining wallets linked to paying users of LootBot. The wallet has already moved roughly 245 ETH, worth about $600,000, across multiple chains.
SomaXBT's analysis shows a strong overlap between the target wallets and LootBot's paying user base. Of the 554 identifiable on-chain payers, approximately 280 — over half — have been emptied by the same address. The attacker appears to be operating methodically, scanning chains one by one.
The campaign started with Ethereum and zkSync Era, then moved to Linea and Base. At the time of SomaXBT's post, the attacker was scanning Scroll at a rate of roughly 27 wallets per minute. Spot checks suggest the drainer takes nearly all available ETH, leaving only enough for gas fees, rather than imposing a fixed subscription deduction.
SomaXBT said it has reached out to LootBot's official team and founder, but has not received a response as of writing.
1400
Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.