Hackers hit Electrum Bitcoin wallet and stole over 200 bitcoin, more than $750,000. The attack started on December
The vulnerability could be exploited by attackers to use rogue Electrum servers to generate and display popups to the unaware users.
Users are urged to download and install an emergency security update.
The Electrum Bitcoin wallets don’t download the full blockchain, instead, the information is provided by servers remotely.
The attackers added malicious servers to the network of the wallets and pushed out the messages every time users attempted to carry out a Bitcoin transaction. The hackers set up a GitHub page and asked users to download and install the security update that was actually malware.
Once the installation was completed, the malicious code prompted users to enter the 2FA authentication codes that allowed them to take over the wallets and steal
Hackers used 33 fake servers, experts believe that they can use a similar technique before Electrum’s developers will patch the issue.
The attack was actually stopped and the GitHub page has been removed.
“Although Electrum’s team hasn’t yet developed a strategy to thwart similar attacks in the near future the team was able to mitigate the severity of damage to users’ wallets’ balance early on.” reported Hack Read.
“The team changed the appearance of the message of the hackers from a rich HTML text and removed the link to the fake GitHub repo that was part of the original message.”
An Electrum developer that goes online with the alias SomberNight explained that the attackers started the attack after the release of the
3.3.2 version. The legitimate update doesn’t fix the issue because a complete fix requires the upgrade of the entire “federated server ecosystem.”
“We did not publicly disclose this [attack] until now, as around the time of the 3.3.2 release, the attacker stopped… However, they now started the attack again.”
(SecurityAffairs – Electrum wallets, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.