IMTOKEN

DESCRIPTION OF EVENTS

imToken is a widely used non-custodial digital wallet that has served over 20 million users across more than 150 countries since its inception in 2016. The platform provides secure and intuitive wallet services, enabling users to manage their digital assets independently. imToken is designed for ease of use and security, offering support for a wide variety of tokens and blockchain networks, including Bitcoin, Ethereum, TRON, and more. With over 50 supported networks and compatibility with EVM chains and Layer 2 solutions, the wallet offers broad accessibility and scalability.

The wallet includes a range of powerful features, such as multi-coin support, a built-in DApp browser, staking services, and integration with the imKey hardware wallet for enhanced offline security. The imKey Pro, available for purchase, provides offline key storage and signing for improved protection against online threats. imToken also supports a staking feature that allows users to earn rewards, and the imToken Card expands financial utility within the crypto space. The platform collaborates with prominent blockchain projects like Ethereum, Polkadot, Cosmos, and zkSync, highlighting its deep integration within the Web3 ecosystem.

imToken maintains active community engagement through platforms like Discord, offering users a space to learn and discuss Web3 developments. The company provides dedicated customer support via email and channels for feedback and business cooperation. Although imToken is not regulated or licensed in any jurisdiction, including Singapore, it is transparent about its status and operations. Regular blog updates, like the analysis of Ethereum's Fusaka upgrade, help users stay informed about the latest blockchain developments and scaling innovations.

While the imToken hardware wallet and imKey are widely used hardware wallets, using any seed phrase which was set up by another individual will allow your funds to be drained from your wallet by that individual.

The victim used a wallet which was set up by a third party seller. Thus the third party seller retained a copy of the seed phrase and was able to drain their bitcoin from their wallet.

Theft Wallet Address (Bitcoin): bc1p8da5jzennj9uyxa3qlym39gywl7297f3k6t9dz3rrl7s8ek57seq5japk0 Theft Transaction Hash: 5851632cb3207a75b105503abddc20ea33408d52205515852c3ee160d583d992

Loss total was 4.35 BTC. The exact amount from the blockchain is 4.35035902 BTC. This equates to a total value of roughly $512k.

The situation was noticed 2 days later by the victim. They consulted with their friend to get help, and the friend has engaged others to perform further tracing of the funds.

The funds appear to have been split up and transferred across multiple chains.

There is no evidence that any funds have yet been recovered.

Investigation is ongoing. It may be possible to identify the perpetrator and recovery the funds, depending on their operational security.

Explore This Case Further On Our Wiki

imToken is a popular non-custodial digital wallet used by over 20 million people across 150+ countries, offering secure access to a wide range of blockchain networks including Bitcoin, Ethereum, and TRON. A victim lost 4.35 BTC (approximately $512,000) after using an imToken hardware wallet that was set up by a third-party seller who secretly kept a copy of the seed phrase. Two days later, the victim discovered the theft when the funds were drained to a known wallet address. The stolen bitcoin was then split and transferred across multiple chains, complicating recovery efforts. An investigation is ongoing to trace the funds and potentially identify the perpetrator, though no funds have been recovered so far.

SlowMist - "Yet again, another case of stolen funds due to purchasing a hardware wallet through unofficial channels. The victim used a wallet pre-initialized by the scammer — meaning the attacker had full access to the seed phrase from the start. As a result, 4.35 $BTC was stolen." - Twitter/X (Jul 29)
Little Di - "Spent 618 yuan on JD to buy a cold wallet, a friend suffered a painful lesson of losing 4 million+ within 6 hours. Writing this to remind everyone: Don’t take wallet asset security lightly anymore." - Twitter/X (Jul 29)
@0xdizai Twitter (Jul 29)
@0xdizai Twitter (Jul 29)
@0xdizai Twitter (Jul 29)
Address: bc1p8da5jzennj9uyxa3qlym39gywl7297f3k6t9dz3rrl7s8ek57seq5japk0 (Jul 29)
imToken Homepage (Jul 29)

More case studies

WOO X Targeted Development
Environment Phishing Attack Theft

SuperRare updateMerkleRoot
Backwards Permission Check Logic