Relayer sent all my eth to an address i dont recognize

Support Defender
1

Was trying to stop a thief ...which it doesnt work anyways but it also drained my eth to an unknown address...not helpful

:computer: Environment

:memo:Details

:1234: Code to reproduce

2

Hi @Sauly_Aries -

Relayers require as to address on every transaction. Are you saying that the Relayer sent ETH to a different to address than you (or someone else with Authorization to use this Relayer) provided?

If so, please provide more details so we can research this issue

3

i cant find the address anywhere and it seems a lot of eth goes there
0xc7464dbcA260A8faF033460622B23467Df5AEA42

my compromised wallet is:
0x119460eCc4C538a02307e5D4f687BB83eDdC5cf9
doesnt match any address i loaded as a contract or any wallet i own

4

Screenshot_20230227_144931
Screenshot_20230227_1449311629×1356 146 KB

these are my contracts

5

so when performing transactions lets say i want to interact with a contract that i need to enter data then perform a transaction like approval should it show the relayer or my compromised wallet as the one approved?

6

Screenshot_20230227_145610
Screenshot_20230227_1456101629×1356 233 KB

ok like how would i use this function knowing that someone is taking every bit of eth as soon as i send it ... ive tried bundling ...whew those docs arent very helpful either to someone in process of learning is do i need to install the client in order to do things from compromised wallet?

7

sorry i have a lot of questions

here are the transactions this is the relayer address

8

ok like how would i use this function knowing that someone is taking every bit of eth as soon as i send it

Am I understanding correctly that the ETH is taken from a contract after it is sent from the Relayer to the contract? If so, it sounds to me like there is a security vulnerability in this contract and I would not send any more ETH there until you have identified the vulnerability and upgraded the contract to address it.

9

I did not enter this contract ...

10

which do you speak of those were separate questions sorry im a bit erratic

11

I'm sorry Sauly, I'm having trouble understanding the situation. If there has been a transaction sent from this Relayer to an address you did not authorize, your account has been compromised and I would recommend revoking all API keys, changing your password, and removing collaborators.