Fraudulent transaction along with the correct one(Ledger Nano S + Electrum)

[AltcoinBuilder]

from where you bought your Ledger? maybe it is fake, or you upgraded firmware with a fake one that do dirty thing just once (just a suggestion)
 
check your device:
https://support.ledger.com/hc/en-us/articles/360002481534-Check-if-device-is-genuine
https://support.ledger.com/hc/en-us/articles/115005321449

also look here:
https://www.reddit.com/r/ledgerwallet/comments/bhb2o2/warning_weve_detected_a_malware_that_locally/

[Electrum_LedgerNS_Issue]

from where you bought your Ledger? maybe it is fake, or you upgraded firmware with a fake one that do dirty thing just once (just a suggestion)
 
check your device:
https://support.ledger.com/hc/en-us/articles/360002481534-Check-if-device-is-genuine
https://support.ledger.com/hc/en-us/articles/115005321449

also look here:
https://www.reddit.com/r/ledgerwallet/comments/bhb2o2/warning_weve_detected_a_malware_that_locally/

Bought the Ledger Nano S from their website more than 2 years ago, did multiple transactions during this time with it without any issues.
Can't exclude the fact that the firmware was somehow compromised during this time, even if I don't know how it's possible to do it.
Didn't open the device to check if it's genuine yet, in case it gets to the police and they need it.

About the malware that replaces Ledger Live and asks for the seed (or any other malware/social engineering attack that asks for the seed), it didn't happen ... 

[20kevin20]

I'm still wondering in what circumstances this possible hack took place. One thing I can think of is that someone might've physically altered your device to get the funds transferred from your device to their wallet, although the chances are slight considering not many know what the hell a Ledger even is. But it's worth giving it a thought.

Otherwise I have no idea what the hell could've happened.. Have you tried contacting Ledger? Maybe they've got the right person to help you out. AFAIK, in these cases they'll ask you to send the possibly compromised device for further testing.

[Lucius]

Otherwise I have no idea what the hell could've happened.. Have you tried contacting Ledger? Maybe they've got the right person to help you out. AFAIK, in these cases they'll ask you to send the possibly compromised device for further testing.

Look at post number 10 in this topic, there is link which explain change path attack, which for now is the only thing that makes sense, because apparently the missing assets were not actually stolen, but were hidden somewhere in Ledger. It is also strange that only one problematic transaction took place and that the OP successfully moved the rest of the coins to safety without repeating a similar incident.

The OP contacted Ledger, but to my knowledge, they were unable to help him. It might make sense to contact Saleem Rashid who showed a great deal of knowledge 2 years ago when he discovered some vulnerabilities in Ledger Nano S. I see he is still active and there is e-mail/twitter in his contact info :

https://saleemrashid.com/

[20kevin20]

So I gave a Google search of the two servers you've mentioned in the third post of this thread. A Google search of "exs.ignorelist.com phishing" resulted in a report from MalwareBytes, and I don't believe it's a coincidence.

Something smells fishy to me here. I've taken a look over all the posts on this thread and, according to #4, the address 34Y6nb5SRxAGkozUpyKa59Qq7f87acC98s, which OP confirmed was one of the addresses he used as an input in one of his transactions, is listed right next to its private key on https://bitkeys.work/?page=725.

I'm confused, to be honest.

Edit: apparently the website generates a random private key for the richest wallets, hoping to collide with the address.. I thought it was one of these "all BTC private keys" websites.

Still, the Google search I've done linked me to the report above. Hence, OP might've downloaded an infected Electrum wallet..

Edit 2: I've done another search for the second server MalwareBytes categorized as a "Phishing". According to this link I found,

In other words, OP has fallen victim to a phishing attack... Press CTRL + F and look for "exs.ignorelist.com" and "endthefed.onthewifi.com", you can find them in the code above. I'm sorry, OP. Please take measures ASAP to secure all your funds before they'll steal more out of your wallets..


Considering your wallet is compromised, I can assume you might also have other compromised softwares installed on your computer. Therefore, I'd suggest switching the internet off on the computer you've got Electrum on (or plugging out the Ethernet cable), backing up everything important (don't forget to backup the wallet.dat files!!!!) and doing a fresh, SECURE complete wipe out and reinstall of the operating system.

If you connect your computer to the internet again after reinstalling the OS, please make sure the software you install is legit.

We're talking about very large amounts at stake, so taking appropriate measures against phishing might save you from another disaster. I really wish I could've helped with the recovery of your funds..


Apparently my attempt to do an extensive research of the MB detection from the first few posts of the thread turned out to be just a shitty failure in the end. Will try to look up the change path scenario Lucius has linked and anything useful will be posted on the thread.

[Electrum_LedgerNS_Issue]

So I gave a Google search of the two servers you've mentioned in the third post of this thread. A Google search of "exs.ignorelist.com phishing" resulted in a report from MalwareBytes, and I don't believe it's a coincidence.

Something smells fishy to me here. I've taken a look over all the posts on this thread and, according to #4, the address 34Y6nb5SRxAGkozUpyKa59Qq7f87acC98s, which OP confirmed was one of the addresses he used as an input in one of his transactions, is listed right next to its private key on https://bitkeys.work/?page=725.

I'm confused, to be honest.

Edit: apparently the website generates a random private key for the richest wallets, hoping to collide with the address.. I thought it was one of these "all BTC private keys" websites.

Still, the Google search I've done linked me to the report above. Hence, OP might've downloaded an infected Electrum wallet..

Edit 2: I've done another search for the second server MalwareBytes categorized as a "Phishing". According to this link I found,

Code:

# As of Dec 2018 criminals carry out phishing attacks against vulnerable versions of Electrum asking them to download malware versions of Electrum.
# For abuse desks around the world it is hard to determine whether or not a certain domain name or IP address participates in this scam.
# Perpetrators have also used faked messages with manipulated screenshots to claim legit server domains would take part in sending phishing links, when this is not the case.
# For more information about the issue please see https://blog.malwarebytes.com/cybercrime/2019/04/electrum-bitcoin-wallets-under-siege/
#
# This is a list of electrum servers scanned for whether they distribute malware links or not
# If you work at an abuse desk and have questions or would like to reproduce these results yourself please get in touch with Electrum Technologies at electrumdev@gmail.com
#
# Fri 21 Feb 00:44:02 CET 2020
#
# Valid servers which are working as expected (no scam):
# There are still some false-positives of scam servers detected as legitimate:
#
0.btc.dev
104.244.222.228
104.248.139.211
109.248.206.13
142.93.6.38
148.251.22.104
157.245.172.236
167.172.226.175
167.172.42.31
178.62.80.20
185.64.116.15
198.27.70.66
213.109.162.82
2AZZARITA.hopto.org
2a01
2a02
2a03
2ex.digitaleveryware.com
52.1.56.181
68.183.188.105
VPS.hsmiths.com
bitcoin.alephnullptr.net
bitcoin.lukechilds.co
blkhub.net
btc.electroncash.dk
btc.groftware.com
btc.litepay.ch
btc.skynetcloud.site
caleb.vegas
crypto.no-ip.eu
currentlane.lovebitco.in
dxm.no-ip.biz
e2.keff.org
ecdsa.net
electrum.aantonop.com
electrum.bitblog.io
electrum.bitkoins.nl
electrum.dnshome.de
electrum.emzy.de
electrum.fedaykin.eu
electrum.hodlister.co
electrum.hsmiths.com
electrum.networkingfanatic.com
electrum.nute.net
electrum.papabyte.com
electrum.poiuty.com
electrum.srvmin.network
electrum.vom-stausee.de
electrum2.hodlister.co
electrum3.hodlister.co
electrum5.hodlister.co
electrumx-core.1209k.com
electrumx.alexridevski.net
electrumx.electricnewyear.net
electrumx.kenrufe.com
electrumx.schulzemic.net
electrumx3.nmdps.net
electrumx50102.aspinall.io
endthefed.onthewifi.com
esx.geekhosters.com
exs.ignorelist.com
fortress.qtornado.com
gall.pro
hodlers.beer
kirsche.emzy.de
ndnd.selfhost.eu
noveltybobble.coinjoined.com
ns3079938.ip-217-182-196.eu
ns3079942.ip-217-182-196.eu
ns3079943.ip-217-182-196.eu
ns3079944.ip-217-182-196.eu
satoshi.fan
shogoth.no-ip.info
thanos.xskyx.net
v22019051929289916.bestsrv.de
xtrum.com
}
#
#
#IP-Addresses of servers in DNS-records identified to be phishing (with number of occurences in first column):
#
     10 91.211.88.104
      9 91.211.88.115
     10 91.211.88.132
     10 91.211.88.239
     12 91.211.88.249
     11 91.211.88.66
     12 91.211.89.12
     12 91.211.89.37
     14 91.211.89.39
     12 91.211.89.84
      9 91.211.89.85
     10 91.211.89.91
#
#
#IP-Addresses of servers in DNS-records which have been shut down (Port 50002 closed) but are still listed in DNS:
#
#
#Scam servers which are sending a phishing URL (under certain conditions):
#The list is reliable with no false-positives:
#Abuse desks: Please block these domains
#
ELEX01.blackpole.online
antumbra.se
arihanc.com
asis.io
aspinall.io
btc.asis.io
btc.smsys.me
cryptohead.de
electrum.antumbra.se
electrum.be
electrum.cutie.ga
electrum.meltingice.net
electrum.online
electrum.poorcoding.com
electrumx.antumbra.se
electrumx.arihanc.com
electrumx.asis.io
electrumx.aspinall.io
electrumx.cryptohead.de
electrumx.electrum.be
electrumx.electrum.online
electrumx.ga
electrumx.luggs.co
electrumx.meltingice.net
electrumx.ml
electrumx.nmdps.net
electrumx.poorcoding.com
electrumx.smsys.me
[Suspicious link removed]
electrumx1.antumbra.se
electrumx1.arihanc.com
electrumx1.asis.io
electrumx1.aspinall.io
electrumx1.cryptohead.de
electrumx1.electrum.be
electrumx1.electrum.online
electrumx1.luggs.co
electrumx1.meltingice.net
electrumx1.nmdps.net
electrumx1.poorcoding.com
electrumx1.smsys.me
electrumx2.antumbra.se
electrumx2.arihanc.com
electrumx2.asis.io
electrumx2.aspinall.io
electrumx2.cryptohead.de
electrumx2.electrum.be
electrumx2.electrum.online
electrumx2.luggs.co
electrumx2.meltingice.net
electrumx2.nmdps.net
electrumx2.poorcoding.com
electrumx2.smsys.me
electrumx3.antumbra.se
electrumx3.arihanc.com
electrumx3.asis.io
electrumx3.aspinall.io
electrumx3.cryptohead.de
electrumx3.electrum.be
electrumx3.electrum.online
electrumx3.luggs.co
electrumx3.meltingice.net
electrumx3.poorcoding.com
electrumx4.antumbra.se
electrumx4.arihanc.com
electrumx4.asis.io
electrumx4.aspinall.io
electrumx4.cryptohead.de
electrumx4.electrum.be
electrumx4.electrum.online
electrumx4.luggs.co
electrumx4.meltingice.net
electrumx4.nmdps.net
electrumx4.poorcoding.com
electrumx5.antumbra.se
electrumx5.arihanc.com
electrumx5.asis.io
electrumx5.aspinall.io
electrumx5.cryptohead.de
electrumx5.electrum.be
electrumx5.electrum.online
electrumx5.luggs.co
electrumx5.meltingice.net
electrumx5.nmdps.net
electrumx5.poorcoding.com
electrumx50102.antumbra.se
electrumx50102.arihanc.com
electrumx50102.asis.io
electrumx50102.cryptohead.de
electrumx50102.electrum.be
electrumx50102.electrum.online
electrumx50102.luggs.co
electrumx50102.meltingice.net
electrumx50102.nmdps.net
electrumx50102.poorcoding.com
electrumx50102.smsys.me
electrumx50105.antumbra.se
electrumx50105.arihanc.com
electrumx50105.asis.io
electrumx50105.aspinall.io
electrumx50105.cryptohead.de
electrumx50105.electrum.be
electrumx50105.electrum.online
electrumx50105.luggs.co
electrumx50105.meltingice.net
electrumx50105.nmdps.net
electrumx50105.poorcoding.com
electrumx50105.smsys.me
electrumx995.antumbra.se
electrumx995.arihanc.com
electrumx995.asis.io
electrumx995.aspinall.io
electrumx995.cryptohead.de
electrumx995.electrum.be
electrumx995.electrum.online
electrumx995.luggs.co
electrumx995.meltingice.net
electrumx995.nmdps.net
electrumx995.poorcoding.com
electrumx995.smsys.me
icarus.tetradrachm.net
luggs.co
meltingice.net
nmdps.net
node.arihanc.com
oneweek.duckdns.org
poorcoding.com
s2.noip.pl
s5.noip.pl
smsys.me
us.electrum.be

In other words, OP has fallen victim to a phishing attack... Press CTRL + F and look for "exs.ignorelist.com" and "endthefed.onthewifi.com", you can find them in the code above. I'm sorry, OP. Please take measures ASAP to secure all your funds before they'll steal more out of your wallets..


Considering your wallet is compromised, I can assume you might also have other compromised softwares installed on your computer. Therefore, I'd suggest switching the internet off on the computer you've got Electrum on (or plugging out the Ethernet cable), backing up everything important (don't forget to backup the wallet.dat files!!!!) and doing a fresh, SECURE complete wipe out and reinstall of the operating system.

If you connect your computer to the internet again after reinstalling the OS, please make sure the software you install is legit.

We're talking about very large amounts at stake, so taking appropriate measures against phishing might save you from another disaster. I really wish I could've helped with the recovery of your funds..

Hi,
Thank you for looking into this.
I don't think it's that simple unfortunately - I didn't download a different version than the 3.3.8 which I installed initially from the official website, and besides showing me a message in a previous version of Electrum, a server can't really do much as far as I know ...

Also, dont think the private keys were exposed, as the attacker would've transferred out all the funds, which wasn't the case.
Can't help but think that it's somehow related to the fact that when validating a transaction with multiple outputs you have two "screens" in Ledger but when validating a single output transaction there is only one.

[20kevin20]

It's not that you've downloaded a compromised wallet. From my understanding, there was an exploit in the official version of Electrum that let hackers display a fake update notification. Those who've updated through that notification have updated to a modified version of Electrum.

And if I got it all right, I believe the servers removed by MB were servers through which you've got the malicious update of your Electrum.

If you read the MalwareBytes article, you'd get an idea of what has probably happened.

[Electrum_LedgerNS_Issue]

It's not that you've downloaded a compromised wallet. From my understanding, there was an exploit in the official version of Electrum that let hackers display a fake update notification. Those who've updated through that notification have updated to a modified version of Electrum.

And if I got it all right, I believe the servers removed by MB were servers through which you've got the malicious update of your Electrum.

If you read the MalwareBytes article, you'd get an idea of what has probably happened.

Yes the malicious servers were sending a link to a malware advertising it as update in the wallet's GUI, but I didn't get this sort of message as I only installed the 3.3.8 version which doesn't allow this anymore (and thus didn't do the "update"). So even if the two servers mentioned were part of that attack, I don't see what they could have done in my case ...
And even if the 3.3.8 I installed from the official website was still a malware (because I didn't check the PGP signature on my initial download) I still can't see how the fake Electrum managed to hide the fraud transaction in Ledger's display.

If anyone could modify Electrum in a way in which it can by itself do this (without having access to the physical device) then I would consider my problem "solved" ...

[20kevin20]

I see. I'll have to arrive home and I'll look more things up to see if I find anything helpful.

I'm honestly surprised Ledger didn't try helping you out with finding where the problem is, knowing it could turn out to be a huge vulnerability nobody's found before.. especially because it's supposed not to be able to send any tx without physical confirmation..

[Electrum_LedgerNS_Issue]

I see. I'll have to arrive home and I'll look more things up to see if I find anything helpful.

I'm honestly surprised Ledger didn't try helping you out with finding where the problem is, knowing it could turn out to be a huge vulnerability nobody's found before.. especially because it's supposed not to be able to send any tx without physical confirmation..

Well, they tried, but I guess that without having access to the machine they only can try to replicate the bug using the high-level specs (Windows 10 1903/Electrum 3.3.8/Device firmware 1.6.0 BTC app 1.3.16).
Considering how widely used this setup is, and given that I didn't manage to find anything similar reported in the last 6m/1y, it's not so surprising that it's very hard to replicate otherwise hundres/thousands of reports would be made ...

[Lucius]

20kevin20, why you did not read my post about change path attacks? What you are referring to is something completely different, and if you read the topic from the beginning it is quite clear that OP is not a beginner and that he has not downloaded a fake wallet. If that was the case, then the attacker would have emptied his entire wallet, because in that case he would have access to everything.

You also forget that OP uses a hardware wallet, and Electrum is just a UI. Any action need to be approved by clicking button on Ledger, no modified Electrum is capable of it (as far we know).

I'm afraid this is much more complicated than any ordinary hack we've seen before.