On the other end of the phone, Brother Zhang, who does foreign trade, had a changed tone: "All the coins I had to make the down payment are gone..."

My heart sank when I saw the transaction records he sent over—dozens of "Transfer Success" notifications, glaring red. Over the years in the crypto space, I've seen contracts go to zero and people get wrecked chasing altcoins, but cases like Brother Zhang's, where you "wake up and find your wallet empty," often have problems in the most inconspicuous places.

You might not believe it when I say this – this kind of pit could be buried in your phone right now.

The cause of the incident is quite simple: Last month, Brother Zhang went on a business trip and asked his wife to help transfer some money for emergencies. Finding it troublesome to write down the mnemonic phrase? She directly took a photo and sent it via WeChat. This move stirred up a hornet's nest—WeChat chat records are automatically backed up, the phone's photo album is synced to the cloud, and his three-year-old domestic phone still has the manufacturer's cloud service enabled... It's equivalent to writing the safe's password on the supermarket notice board, at the entrance of the community, and in the family's mailbox.

The more ruthless comes later.

More than half a year ago, Zhang installed a rogue browser extension to access a certain "exclusive insider information." This thing had secretly activated clipboard monitoring permissions in the background long ago—once his wife sent out that screenshot, 12 words were silently taken by the extension, and the hacker logged in from a remote location without batting an eye, instantly clearing over three million U and mainstream coins.

There's another detail that's even more amazing: Brother Zhang's WiFi password hasn't been changed since he moved, and the router's backend is still set to the factory settings "admin/admin." Do you think an attack requires physical intrusion?