Slow Mist Cosine: GMGN hackers swept away user funds through Pixiu disk withdrawal, making more than 700,000 dollars

Slow Mist Cosine posted on the X platform: "After reading the dozens of stolen intelligence related to GMGN submitted to us, the commonality: the user's private key has not been leaked, but SOL BNB has been bought into the Pixiu disk (that is, it can only be bought but not sold). The hackers mainly swept away the user's funds by removing the Pixiu disk from the pool, and the profit exceeded 700,000 US dollars. What can cause this situation (and not the private key leakage) is most likely caused by higher-level fishing methods. Since GMGN has fixed the relevant problems, it is not easy to reproduce, guessing that it is related to the GMGN account mode, the user visits the phishing website, and the phishing website obtains the login signature information of the user's GMGN account mode, such as getting access_token and refresh_token values, and taking over the user account permissions. However, without the user's 2FA, it is impossible to directly export the private key or withdraw coins, so the "knock" attack of the user's funds is realized through the Pixiu disk, and the user's assets are indirectly stolen. "