A crypto user known as The Smart Ape said he lost about $5,000 from a hot wallet after spending three days in a hotel, not because he clicked a phishing link, but because he made a series of “stupid mistakes,” including using an open WiFi network, taking a phone call in the lobby and approving what looked like a routine wallet request.
The incident, analyzed by security firm Hacken for Cointelegraph, shows how attackers can combine network‑level tricks with social cues and wallet UX blind spots to drain funds days after a victim signs a seemingly benign message.
How hotel WiFi became a threat
According to the victim’s account, the attack began when he connected his laptop to the hotel’s open WiFi, a captive portal with no password, and started “working as usual, nothing risky, just scanning Discord and X, and checking balances.”
What he didn’t know was that on open networks, all guests effectively share the same local environment.
Dmytro Yasmanovych, cybersecurity compliance lead at Hacken, told Cointelegraph, “Attackers can exploit Address Resolution Protocol (ARP) spoofing, Domain Name System (DNS) manipulation, or rogue access points to inject malicious JavaScript into otherwise legitimate websites. Even if the DeFi front end itself is trusted, the execution context may no longer be.”
Related: Pectra lets hackers drain wallets with just an offchain signature
When talking crypto paints a target
The attacker quickly found out the user was “involved in crypto” after overhearing him discuss his holdings on a phone call in the hotel lobby. That information narrowed the target and hinted at the likely wallet stack (in this case, Phantom on Solana, which was not itself compromised as a wallet provider).
Physical‑world exposure of your crypto profile is a long‑standing risk. Bitcoin engineer and security expert Jameson Lopp has repeatedly argued that openly talking about crypto or flaunting wealth is one of the riskiest things you can do.
“Cyber attacks do not start at the keyboard,” Yasmanovych warned. “They often start with observation. Public conversations about crypto holdings can act as reconnaissance, helping attackers choose the right tools, wallets, and timing.”
How a single approval drained the wallet
The key moment happened when the user signed what he thought was a normal transaction. While swapping on a legitimate decentralized finance (DeFi) front end, the injected code replaced or piggy‑backed a wallet request that asked for permission rather than a token transfer.
Yasmanovych noted that this pattern fits a broader and increasingly common class of attacks known as approval abuse. “The attacker doesn’t steal keys or drain funds immediately. Instead, they obtain standing permissions, then wait, sometimes days or weeks, before executing the actual transfer.”
Related: Trust Wallet’s $7M hack shows where crypto-friendly SMEs may be vulnerable
By the time the victim noticed, the wallet had been emptied of Solana (SOL) and other tokens.
“At that point, the attacker had everything he needed. He waited until I left the hotel to transfer my SOL, move my tokens, and send my NFTs to another address.”
The victim’s wallet was a secondary hot wallet, so the damage was limited, but the sequence shines a light on how little is required to swipe users’ funds: one untrusted network, one moment of inattention and one signed approval.
Yasmanovych recommended treating all public networks as hostile when traveling. Avoid open WiFi for wallet interactions, use a mobile hotspot or reputable VPN, and only transact from hardened, up‑to‑date devices with minimal browser attack surface.
Users should also segment funds across wallets, treat every onchain approval as a high‑risk event to be regularly reviewed and revoked, and maintain strong physical operational security by never discussing holdings or wallet details in public.
