WHAT IS ACTUALLY GOING ON???

nwothini335(73)

Published in

#waiv

Words

570

Reading

3 min

Listen to this post

~4 min

I was at work today, when I got a message from a hivian. They said their account was hacked. There was an unauthorized transfer that occurred in their account about 4hrs ago. Their hive, hbd and some engine tokens were moved from their account to another account, @leo-audit73.

^{my chat with the person}

I thought she clicked a link, or she gave another account permission to her active key, or probably leaked her keys, but she said she did not. I checked through hivetask to see if she gave any account her posting permission, but then, there was none.

From the information gotten through Peakd profile (stats + KE section), I saw that leo-audit73 was created in October, 2026 by @leosubscriptions. Maybe Leosubscriptions' account creation ticket was used for this purpose.

I dug dip and saw that the hivian that complained to me was not the only person affected.

The accounts below are the ones I was able to go through at the moment.

@drindrin421
@crypto-hokage
@waleedraza
@rashidizy
@daily.life
@betheloji12
@foh123
@hafiz.pepe
@zencoding
@dragan1957
@ugospur
@minigamerbob
@grimgor2025
@stimu
@mophela
@bdhiv
@waleedraza
@completenoobs
@sadrulhasan
@buffalobaby
@nekoglai2415
@theradiodemon
@setpromohive
@azkl
@sizebo112344
@wordspacing
@mike21nash
@babygirl1888
@oluchi94
@therealtalk

There are more accounts, which are below. I was not able to go through these accounts.

@honey-swap, @keychain.swap, @drindrin421, @minigamerbob, @grimgor2025, @stimu, @mophela, @bdhiv, @waleedraza, @completenoobs, @sadrulhasan, @dragan1957, @crypto-hokage, @nekoglai2415, @buffalobaby, @leosubscriptions, @theradiodemon, @setpromohive, @azkl, @sizebo112344, @anikamuntaha, @oluchi94, @tanzil7, @wordspacing, @mike21nash, @waxpwaxpmexchive, @annie3, @mxchive-test, @uid566056830, @bdhivesteemcb, @uid20166111, @keshavgeer, @kenny56, @gentleugo, @richardandmille, @geekontheroad, @vibryx, @leoreferral, @babygirl888, @nzubechi1, @dagger12, @contactmexc, @ayelabowo44, @betheloji12, @hiveamma1, @brenique, @zarababe, @israrbaho, @aladren.dawson, @rayabdulrehman, @pantheontcg, @mxchivechain, @daralicious1, @braingraft, @yanbolludeniz2, @uid66642513, @agneskigighaso21, @uid17514664, @earnwithhive, @omotolani01, @f1lya, @adewaleopeyemi63, @abedla, @biza, @avila.diego2, @skatecedar100, @karendanni, @mexcarb, @mexc-hiveprom, @uid86628188, @pepzerbi, @kristianto.jrm, @juecco, @theonlineluxe, @esthervoice, @thewalltrading, @bdhivesteembug, @instrumentalpain, @sergeyjeyms, @lifehackeraf, @hemmydo20, @livepayout, @qring, @hangerio, @therealtalk, @mexc-walle, @isoc7798, @zion21, @hivelectrician, @adeife1, @completenoobs, @zedbna, @geekontheroad, @awolowolight, @arbitragehive, @foh123, @dorisk, @bdhivesteemchain, @nhelman64, @kgphotos, @infonews, @opeisanartist, @snowdawn94, @krk101, @med-4fun, @bitgethivechain, @djkarlsoriano, @tarinaa, @nathanxt, @agneskigighaso21, @abdalazizalanzi0, @kgphotos, @alicena, @bdhivesteempro, @bdhivesteemapple, @bagelife, @fzm27, @abbafada, @sammmi, @sparkz1, @zerox131224, @bulusjairus, @spicek, @livepayout, @theonlineluxe, @hangerio, @cplaza198, @instrumentalpain, @tammysings, @rashidizy7, @luisana1604, @mxchivecb, @mhmtdn1z, @yanbolludeniz2, @emmycruise27, @khokon70, @reaccioncultural, @didiebaby, @damond02, @deilsonbarbosa, @askartau, @bulusjairus, @huobi-earn, @bumcryptotiger, @hive.testnet, @mepc, @caterpii, @snowdawn94, @uid67278834, @braingraft, @everydaydec, @angelastorace95, @infonews, @ugospur, @luizvitao, @segio, @lagordita2480, @malika765, @naypaing967, @foh123, @marilynruru, @designerpin2, @joseaquia43, @alesaucedo, @leighmine, @daniele5, @uid45122291, @voteblast, @duskflow, @alicena, @izuegbuna, @pinki01, @techtren, @spectrabytes, @tarinaa, @shacks0012, @bingxhive, @lordsabaine, @mxchive-mexc, @kiras12

Things I noticed about the affected persons

Their accounts were created by @leo.voter (leo.voter's account creation ticket), which means that these accounts were created using inleo (I stand to be corrected).
Hive, HBD and Engine tokens were transferred from their account to leo-audit73.
After each transfer, a power down was initiated, and saved HBD was unstaked.
The memo I noticed in these transactions are:

failover sweepi16240
claim sweep
fixup residual sweep
selftest hive e.t.c

The accounts don't undelegate delegated HP.
Some of these accounts are active, while a few are not.

I don't really know what's going on here, but these activities look really fishy to me.
Maybe a scammer, or something, I don't know. I checked through inleo's discord Announcement, but I didn't see any announcement regarding this as at the time of writing this post.

From @leo-audit73, the hive were transferred to @aquanman09. Aquanman09 was created in October, 2026 by leo-audit73.