# "post-mortem" (exploit OR hack) — X 热门讨论 (2026-09-28 17:29 UTC)
## @sndcapp (Syndicate) · 09-28 14:25 · ♥23 ↻1 💬6 🚨 If you ever funded a Farcaster in-app wallet, read this. Some users are reporting drained wallets 👇
First, honesty: this is an early on-chain theory, not a confirmed hack.
Farcaster or Privy haven't said anything, and the scale isn't verified.
But the pattern one researcher traced is worth knowing, because the safe move costs you nothing.
Here's what's being reported:
🟢 The drains are signed by the wallet's own key. No malicious contract, no approval exploit, no phishing link. From the outside, it looks like the owner just pressed "swap."
🟢 Funds get bridged out through Relay to a Solana address, carrying the normal "farcaster" tag and the same fee a real in-app swap pays. On-chain, it looks completely legit.
🟢 Small balances get merged first, then everything funnels toward a collector address and cashes out to exchanges.
Why this matters more than a normal scam:
Farcaster's in-app wallets are embedded wallets created through a provider (Privy). A lot of users never saw a seed phrase at setup – the key is split across secure shards and accessed through login.
That's not classic self-custody. So "not your keys, not your crypto" hits different when you may have never fully held the keys.
Important caveat, so nobody spreads panic:
Nobody has proven where the leak is. It could be compromised keys on the user side (a phished login, an infected device, an old export), not the provider's infrastructure. Privy has stated its key infrastructure stores no full keys. Treat the cause as unknown until there's an official post-mortem.
What to do right now:
🟢 If you've got funds in a Farcaster in-app wallet, move them to a wallet whose keys you fully control. This is hygiene, not panic.
🟢 Don't wait for the official write-up to protect your own balance.
🟢 And never trust a "recovery" link or a DM telling you to reconnect to "restore" funds – that's how the second wave of victims gets made.
The lesson that keeps repeating: if you don't fully hold the keys, you don't fully hold the crypto.
Stay sharp, move your funds, and always DYOR 💚 https://x.com/sndcapp/status/2104578277776007525