An attack on the Electrum bitcoin wallet has so far netted hackers over 200 bitcoin worth around $750,000. The attack began on December 21, 2018. Though it has victimized some unsuspecting users, it can be avoided.
Electrum is a bitcoin wallet which doesn’t require the user to download the full bitcoin. Instead, servers remotely provide users with the bitcoin and they access it through their wallet. It is one of the most popular bitcoin wallet implementations and forks of it for both versions of bitcoin Cash as well as Litecoin, Dogecoin, and Dash have been created over the years.
Malicious Servers Crucial To Scam Attack
Malicious servers were been added to the Electrum wallet network. When users attempted a bitcoin transaction which reached one of these illegitimate servers the user received a message within the wallet application instructing them to download and install an update. The message led unsuspecting uses to the hacker’s GitHub page.
The resulting download was actually malware disguised as a new version of the Electrum wallet. The installed malware then prompted users to enter their two-factor authentication codes. This allowed the attackers to then use the authentication codes and steal bitcoin by transferring funds to their own bitcoin address.
An Electrum developer posted details of the hack in the last 24 hours on Github sharing the following screenshot of the hackers first false message and link which they had managed to infiltrate into the Electrum user interface:
Electrum has since modified its software and released an update but, said SomberNight:
This is not a true fix, but the more proper fix of using error codes would entail upgrading the whole federated server ecosystem out there…
The Electrum Github repository detailing this issue also confirms that:
We did not publicly disclose this until now, as around the time of the 3.3.2 release, the attacker stopped; however they now started the attack again.
The latest malicious popup and link looked like this:
Reporting by indicates Github admins have now removed the repository with the malicious wallet version.
That said, Electrum Wallet users should remain vigilant as the hackers have persevered and adjusted their efforts over the last week, so new attacks are likely.
Electrum has warned its users to only download software from electrum.org and not Github tweeting:
There is an ongoing phishing attack against Electrum users. Our official website is Do not download Electrum from any other source. More on the attack here:
— Electrum (@ElectrumWallet)
Another red flag for users who unwittingly download the malware should be the request for two-factor authentication when starting the malware affected new wallet version. Two-factor authentication is only normally requested when making a transaction.
It’s not just Electrum wallet users that need to be vigilant, on cryptocurrency users are increasing. Non-cryptocurrency users are at risk too, a McAfee report in the past few days also says that crypto mining malware incidences have in 2018 alone.
Featured image from Shutterstock.
Get Exclusive Crypto Analysis by Professional Traders and Investors on Hacked.com. Sign up now and get the first month for free.
Published at Fri, 28 Dec 2018 06:05:56 +0000
