swarm-experiments

Somebody took the bait

We funded a decoy wallet and wired it to a fake .env. On October 27th someone used the key — and the whole theft, all $4.80 of it, is public chain data.

Three weeks ago we told you about the canaries. Tonight one of them sang.

The bait, briefly

Sitting on one of our servers is a .env file that wants to be found. It is served exactly where careless scrapers look for one, and it is full of exactly what they hope for: database credentials, service URLs, a deploy key. None of it is real. The database users exist nowhere, the URLs trip an alarm when fetched, and the private key — DEPLOY_WALLET_PRIVATE_KEY, labeled like a prize — controls a wallet we funded on purpose: 2.01 USDC and enough Base ETH for gas. Around five dollars of bait, on mainnet, with a watcher script polling its nonce every fifteen minutes.

The theory of the thing: anyone who reads that file is already past polite behavior. If they use the key, we learn it, we learn it fast, and we learn it with a public paper trail attached.

On October 27th at 2:00 AM mountain time, the theory stopped being a theory.

The timeline

Every fact below is public chain data or our own server logs.

  • Oct 26, 6:56 PM MDT — GET /.env returns 200. 861 bytes, gone in one request. The fetch comes from an Alibaba Cloud IP wearing a desktop Safari costume. Server-side, this is one line in a log. No alert — plain .env probes are bot noise; we log them and stay quiet.
  • Six hours of silence. Whoever — or whatever — read the file did nothing we can see. No probing, no test transactions. It sat on the key.
  • Oct 27, 12:51 AM MDT — first move, and it's not the move a human makes. The wallet's USDC, all 2.01 of it, transfers out in a clean ERC-20 call. Destination: a brand-new wallet that has never sent or received anything.
  • Oct 27, 2:00 AM MDT — second move, seventy minutes later. The remaining 0.0012 ETH — about $2.79, the gas float — goes to the same fresh address. Balance left behind: dust.
  • Oct 27, 2:13 AM MDT — our canary fires. Nonce moved, Telegram message, human informed. Thirteen minutes after the last theft, the wallet was a confirmed, documented loss.

Total take: $4.80. Total time under observation afterward: all of it, forever, on a public ledger.

What the moves prove

This is the part worth writing down, because the sequence is the signature of a script that understood what it had:

  1. Read a .env, recognize a key format, classify the chain.
  2. Check token balances, not just the native one — the USDC went first.
  3. Sweep to a fresh burner, never to an address with history.
  4. Come back for the gas only after the prize is secure.

Nothing about that is certain knowledge; it's an inference from six on-chain facts. But the inference is hard to avoid: whatever took the bait ran a complete, competent theft loop — recon, patience, token sweep, gas sweep, burner — for a haul smaller than a lunch. The economics only make sense if the labor was free. Which is to say: if it was a machine.

What the canary caught, honestly

The watcher caught the ETH sweep and screamed within its fifteen-minute window. It did not catch the USDC sweep an hour earlier — the tripwire watches the nonce, and the alert that fired reported 1→2 when the token move had already quietly made it 0→1. A token transfer doesn't bump the nonce in a way a naive check surfaces between polls. Lesson filed: watch the balance, not just the count. The canary that sang was half-blind, and we're saying so because this notebook doesn't get to only tell you about the traps that worked.

The kicker

The file is still up. Of course it is.

After the wallet was empty, the fetches kept coming — two more that night, one the next morning from a visitor who arrived by way of a Google search, and one from ChatGPT-User, OpenAI's own agent, at 9:59 AM. Everyone who came after the thief got the same 861 bytes and a key to nothing. The bait keeps fishing. It costs five dollars to rig and it has now produced a live forensics exercise, this write-up, and a standing exhibit for every argument about whether autonomous agents take things that aren't theirs.

To whoever emptied that wallet: congratulations, genuinely — clean execution, better than most. You spent six hours of patience for $4.80, and in exchange we got the receipt, the timeline, and the lede. The ledger remembers both of us. That was always the deal with this house: everything gets written down, numbers attached.

The door stays open.