Several BitKeep crypto wallet users reported that their wallets were emptied over Christmas after hackers triggered transactions that did not require verification.

BitKeep is a decentralized multi-chain Web3 DeFi wallet supporting over 30 blockchains, 76 major networks, 20,000 decentralized applications and over 223,000 assets. It is used by more than eight million people in 168 countries for asset management and transaction processing.

Although the platform did not post an official announcement on its website, it informed the community about the official telegram channel that the incident appears to have impacted users who downloaded an unofficial version of the BitKeep app.

“After a preliminary investigation by the team, it is suspected that some APK package downloads were hijacked by hackers and installed with code planted by hackers,” explains BitKeep’s announcement.

“If your funds are stolen, the app you download or update may be an unknown version (unofficial version) hacked.”

Those who have downloaded the trojanized APK package are recommended to transfer all their funds to the official store after downloading the official apps from Google Play or App Store, create a new wallet address and transfer all their funds there.

The platform warns that all wallet addresses created using the malicious APK should be treated as compromised.

Finally, those who have been victims of hacks are asked to fill in this form for the BitKeep support team to try to offer a timely solution.

BitKeep has not determined how much money was lost from these hacks, but the transaction tracking service PeckShield reported that approximately $8 million in assets have been stolen so far.

Suspicious transactions spotted by PeckShield include $4373 BNB, $5.4M USDT, $196k DAI and $1233.21 ETH.

Given that the attack is still ongoing, with threat actors taking advantage of the holiday season causing delays in hack detection and incident response actions, losses are expected to increase.

In October 2022, BitKeep suffered a loss of approximately $1 million after a hacker exploited a vulnerability in the service that allowed it to perform arbitrary token swaps.

At that time, BitKeep promised to provide full refunds to those affected by the incident. However, given that current attacks result from users being scammed by Trojan APKs, refunds are unlikely.