Qihoo 360 researchers traced the theft to March, when a first intrusion siphoned 4 ETH from nodes that left port 8545 exposed. The same method resurfaced months later and escalated to a twenty-million-dollar loss.

Attackers scanned the public network for Geth or Parity nodes that bound the JSON-RPC service to 0.0.0.0:8545 without firewall rules; they sent eth_sendTransaction calls to unlocked accounts and redirected balances to wallets under their control.

The Ethereum Foundation warned about the risk in 2018. Core developers repeated the guidance in release notes, blog posts along with pull-request comments – disable personal API, lock every account, bind the port to 127.0.0.1, or close the port completely.

360 Netlab logged the March incident yet many operators never patched. Default images on cloud marketplaces still launch with the port open. Home stakers follow outdated tutorials that omit the flag –http.addr 127.0.0.1. The client prints no warning at startup. As a result, opportunistic scripts continue to harvest funds. Operators who upgrade to Geth 1.10.9 or later gain automatic account locking and a startup banner that lists exposed services. Until every reachable node applies the fix, the attack surface remains.

Digital tokens exhibit extreme price swings. Purchasers risk total loss. The text above conveys observed facts, not investment advice. Consult a licensed adviser before any allocation. The author held BTC but also XRP at publication time.