A devastated crypto trader has revealed how he lost $650,000 (£499,000) at the hands of scammers who hacked into his iCloud account.
Domenic Iacovone had a load of valuable cryptocurrencies and NFTs saved in digital wallet app MetaMask before cyber-thieves managed to bleed him dry.
Writing on Twitter, he said it all began with a phone call he thought was from Apple.
Apparently, he suspected it might be fraud at first so ignored it.
But when the caller ID showed up as Apple and saw it was an Apple number, he decided to call it back.
The fraudster on the other end of the phone said his account had been compromised and asked for a code that was sent to his phone.
But “two seconds later my entire MetaMask was wiped”.
He claims hackers pulled it off by getting hold of his secret 12-word “seed phrase” which is important to get into the crypto wallet and must not be shared with anyone.
Little did he know, MetaMask stores a seed phrase file on iCloud automatically from his iPhone.
So scammers must have gone in and swiped it, before emptying his account.
“Don’t tell us to never store our seed phrase digitally and then do it behind our backs,” Iacovone said.
“If 90 percent of the people knew this I would bet none of them would have the app or iCloud on.”
MetaMask backlash
MetaMask has not commented on the incident but did tweet out advice to users amid the fury.
“If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault,” the firm warned.
“If your password isn’t strong enough, and someone phishes your iCloud credentials, this can mean stolen funds.
“You can disable iCloud backups for MetaMask specifically by turning off the toggle here: Settings > Profile > iCloud > Manage Storage > Backups.
“If you want to avoid iCloud surprising you with unrequested backups in the future, you can turn off this feature at: Settings > Apple ID/iCloud > iCloud > iCloud Backup.”
This article originally appeared in The Sun and was reproduced here with permission.