Trader Says WhatsApp Payload Wiped His Account to $800

Crypto trader Harley Lewis Foote says a WhatsApp payload gave an attacker remote access to his computer, allowing the intruder to close his publicly disclosed Bitcoin (BTC) short near $68,000 and drain nearly all of his funds. He was left with $800, according to his own account of the incident.

Foote said the payload downloaded without any action on his part — no click, no prompt accepted. Once installed, it gave the attacker persistent remote access to his machine. The intrusion reportedly went undetected for five days.

How did the attacker operate?

According to Foote, the attacker spent those five days monitoring his Bitcoin short position rather than moving immediately. The position was publicly known: Foote had disclosed it openly, which meant the attacker could track its status without additional reconnaissance.

The attacker chose the moment to strike. Foote said the position was closed as Bitcoin approached $68,000 — a level at which a leveraged short would have been under severe pressure. Timing the exit at that point suggests the attacker understood both the position and the market context.

Before the main withdrawal, the attacker allegedly tested a $10 transfer to confirm the pipeline worked without triggering alerts. Foote said that small test was designed to avoid detection. It is a common pattern in account-takeover cases: criminals validate access with a trivial amount, then execute the full drain once satisfied.

Where did the funds go?

Foote said the stolen funds moved through Hyperliquid, MetaMask and Tornado Cash. Hyperliquid is the trading venue; MetaMask is the wallet interface; Tornado Cash is the Ethereum-based privacy mixer that obscures transaction trails. The chain of tools left him with $800 from what he describes as nearly all of his funds.

The compromise extended beyond money. Foote said the attacker also accessed his email, his stored passwords, his website and his X account. That breadth matters: email and password access typically enable recovery of other accounts, meaning the initial WhatsApp payload may have cascaded well beyond a single trading position.

Foote's account is his own. He has not, in the material available, published transaction hashes, a forensic report or a law enforcement filing corroborating the sequence of events. The $800 figure, the five-day timeline and the $10 test withdrawal all rest on his statements. Readers should weigh that accordingly.

What does the case illustrate?

The operational lesson is narrow but real. A zero-interaction payload delivered through a mainstream messaging app defeated whatever protections surrounded a trader who was, by his own disclosure, publicly visible with an open leveraged position. Public disclosure of positions is increasingly common among traders building an audience; it also hands attackers a live map of what to steal and when.

For platform operators, the routing through Hyperliquid, MetaMask and Tornado Cash repeats a familiar pattern that compliance teams across major venues already monitor. No platform has commented on this specific incident, and no recovery of funds has been reported.

Takeaway: an attacker who can watch a public position for five days does not need luck — only patience and one unpatched opening.