[Warning] - Atomic & Exodus wallets are under continued attack.

[satscraper]

Heads up to crypto users!

Attackers don't settle down and continue the setting their sight on users of both Atomic & Exodus wallets.

As it has been found by researchers from reversinglabs team intruders are trying to inject harmful code into users' machines ^{the aim being to hijack cryptocurrency transactions by altering recipients' addresses} via two compromised npm packages pretend to serve as a tool for converting PDF files to Microsoft Office documents. But in reality this "tool" ^{after its launch} modifies core files in the local installations of the given wallets so that their user may direct their transactions to hackers' addresses.

To stay safe everyone should avoid the installation of unknown npm packages and check twice all details of their transactions before signing them.

P.S. More technicalities on this attack is here.

[NotATether]

NodeJS is for vibe coding and creating SaaS only. It is not for creating any secure application.

I don't understand why the companies doing this don't get the memo. Same goes for individuals as well.

There is no reason for you to be using npm packages or even PIP python packages on your regular computer. It interferes with your regular activity if you install some malware. These kind of things should be running inside a Linux box or server only.

Remove Javascript, and these insecure closed-source wallets, and you've eliminated 90% of the problems. (The remaining 10% can be removed by deleting Windows.)

[Catenaccio]

Attackers don't settle down and continue the setting their sight on users of both Atomic & Exodus wallets.

Both Atomic and Exodus wallets are close source wallets and they're unproducible.
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=exodus
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=atomic

In cryptocurrency, if a wallet is close source, unproducible, it's not a recommended wallet for using.

Recommended wallets.

Setting up a Wallet➣
There are dozens of wallets to choose from when it comes to securing your private keys. Hardware, software, metal, paper, each with their own trade-offs. Remember: if you aren't holding your own private keys, you don't actually own BTC - you only own an IOU!

Wallet Basics:

• Do not use wallets that don't give you recovery data; these wallets are likely controlling your keys.
• Do not use paper wallets unless you're an advanced user who understands all the risks.
• Do not store large amounts of value in single signature wallets.
• Make sure your heirs know how to recover your wallets without you!

[KiaKia]

How about "don't store massive amount of assets on PC wallets" because let's be real we can't escape the mistakes we can make on PC this days, there are too many ways to mess things up easily.

Targeting crypto wallets on PC is highly possible compare to other devices because every hacking tools are runable on PC, the ways are endless, this is my own personal reason why I don't trust running Crypto wallets on PC.

I like using Trust wallet and Exodus on my phone but I only leave small assets on these wallets, my main wallet is hardware wallet, air gapped to be precise, I can store thousands of dollars on my hardware wallet with no need to worry myself about this attacks.

Make things easier for yourself, as soon as you get the money to buy a hardware wallet don't hesitate to buy one, and make sure you only store few dollars only on crypto wallets available for mobile and PC.

[SilverCryptoBullet]

How about "don't store massive amount of assets on PC wallets" because let's be real we can't escape the mistakes we can make on PC this days, there are too many ways to mess things up easily.

Make things easier for yourself, as soon as you get the money to buy a hardware wallet don't hesitate to buy one, and make sure you only store few dollars only on crypto wallets available for mobile and PC.

Devices that are hot, and connected to Internet are not places to store main capital you have in bitcoin or altcoins. Devices can be infected when you are using it for many purposes and interactions on Internet and smart contracts, applications and no Internet security or Anti virus software can completely protect your devices safely from online threats.

If you want safety, use cold wallets and hardware wallets are available for you with not too expensive costs. It is less expensive investment for your fund safety if your fund is big enough.

Hardware wallets are close source and open source, choose open source hardware wallets.
[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.

[satscraper]

Attackers don't settle down and continue the setting their sight on users of both Atomic & Exodus wallets.

Both Atomic and Exodus wallets are close source wallets and they're unproducible.

In this case it doesn't really matter.

These types of attacks ^{where hackers indirectly target wallets by injecting malicious payloads that are capable of modifying the transaction destination address before it's signed} can affect any kind of wallet whether open source or closed source.

That said I suspect it's actually easier to exploit open-source wallets in some cases simply because the code is publicly available for study.

Still you're right, open source wallets are generally the better choice for us due to their transparency.

[Ruttoshi]

How about "don't store massive amount of assets on PC wallets" because let's be real we can't escape the mistakes we can make on PC this days, there are too many ways to mess things up easily.

Make things easier for yourself, as soon as you get the money to buy a hardware wallet don't hesitate to buy one, and make sure you only store few dollars only on crypto wallets available for mobile and PC.

Devices that are hot, and connected to Internet are not places to store main capital you have in bitcoin or altcoins. Devices can be infected when you are using it for many purposes and interactions on Internet and smart contracts, applications and no Internet security or Anti virus software can completely protect your devices safely from online threats.

If you want safety, use cold wallets and hardware wallets are available for you with not too expensive costs. It is less expensive investment for your fund safety if your fund is big enough.

Hardware wallets are close source and open source, choose open source hardware wallets.
[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.

If you cannot afford to buy a hardware wallet and you have an old PC that isn't that useful, you can use it to set up electrum cold storage wallet, where you generate your private keys in an airgap device and never connect it to the internet. Your bitcoin will be save because it's kept offline.

You  need to open a watch wallet that you can use to sign and track your transactions. Crypto users needs to be very careful these days and take their wallet security as their priority.

[notocactus]

If you cannot afford to buy a hardware wallet and you have an old PC that isn't that useful, you can use it to set up electrum cold storage wallet, where you generate your private keys in an airgap device and never connect it to the internet. Your bitcoin will be save because it's kept offline.

You  need to open a watch wallet that you can use to sign and track your transactions. Crypto users needs to be very careful these days and take their wallet security as their priority.

An airgap (offline) device is necessary for setting up a cold storage wallet with Electrum software that can help you avoid online threats that can steal your bitcoin. Two guides on Cold wallet with Electrum wallet software.

• Cold storage.
• Creating a Cold Storage wallet in Electrum

[btcltcdigger]

Honestly, anything that's open source and is widely used is susceptible for these kinds of attacks. Open source just begs evil doers to sit in front of the code, and disguise something malicious as an update.
What worries me is that this code passed the test and code review. That's the bigger issue, means QA is not up to standard

[hd49728]

Honestly, anything that's open source and is widely used is susceptible for these kinds of attacks. Open source just begs evil doers to sit in front of the code, and disguise something malicious as an update.
What worries me is that this code passed the test and code review. That's the bigger issue, means QA is not up to standard

But did you miss that Atomic and Exodus wallets are not open source at all?

Open source is double edged, that it allows community members to verify the source code and find back doors, if any, from the wallet developers, and see risk then stay away from that wallet. In another hand, it gives space for hackers and bad people to test the source code, find holes for exploitations, but it raises another important point. If an open source wallet works fine, it means already tested top-notch quality wallet to use safely.

[TravelMug]

Honestly, anything that's open source and is widely used is susceptible for these kinds of attacks. Open source just begs evil doers to sit in front of the code, and disguise something malicious as an update.
What worries me is that this code passed the test and code review. That's the bigger issue, means QA is not up to standard

It's not the QA, once the program is deployed you can't do anything about it, and as per article,

The package was initially flagged in RL’s Spectra Assure platform with the help of automated, machine learning (ML) detection algorithms that spotted behaviors associated with previously discovered npm-based malware campaigns and software supply chain attacks. These behaviors are formalized in Threat Hunting (TH) policy TH15502.

So it was a machine learning base algorithm that detects that something is suspicious in the package as it is obfuscated. And we all know that this criminals are one step ahead of the game so it's really hard to detect it in the beginning as thousands of packages are being deployed in a day.

[logfiles]

Honestly, anything that's open source and is widely used is susceptible for these kinds of attacks. Open source just begs evil doers to sit in front of the code, and disguise something malicious as an update.
What worries me is that this code passed the test and code review. That's the bigger issue, means QA is not up to standard

But the two wallets are not open source or perhaps you were tired when posting?


Anybody who still installs or uses Exodus on their device will have no one but him/herself to blame if things go South. Both wallets have been reported to have a number of vulnerabilities in the past whilst they are closed source. Atomic wallet in particular even had customers' funds get hacked, and the cause plus the impact of the hack has never been revealed by the team to this day.

[Charles-Tim]

Honestly, anything that's open source and is widely used is susceptible for these kinds of attacks. Open source just begs evil doers to sit in front of the code, and disguise something malicious as an update.
What worries me is that this code passed the test and code review. That's the bigger issue, means QA is not up to standard

If you have been reading posts on this thread, you will see clearly that some people posted that both Exodus and Atomic wallets are not open source but close source. But you still decided to post that they are both open source. Try and be reading what others posted before posting.

[dkbit98]

I would stop using Atomic, Exodus and any other closed source wallets asap, and there is a reason why scammers are mostly targeting this type of wallets.
There are many good open source alternative wallets, and if you want to be more secure from malware than use Linux OS.