Etherdelta was HACKED

[nexus2k14]

According to EtherDelta on Twitter, all deposits should be safe below is the official announcement from EtherDelta Twitter Account. I moved all Tokens "just in case" I am always a little paranoid with security. So far all my assets are split into 7 MEW wallets.

*IMPORTANT* Also note deposits can only be accessed through user's individual private key via the EtherDelta contract. If you had *NEVER* imported your key on the imposer's phishing site, your deposit should be safe.

https://twitter.com/etherdelta

[harizen]

There was a strange behaviour on my wallet that still happening until now . Etherscan always shows new transaction to my address.

Some of my tokens were moving on it's own to but ended up fail (eventhough it was not deposit on ED) (fake transaction? how come). So for convenience, I transfer some tokens with value on my new ethereum address. The only affected address were those who are currently logged on ED before the hacked incident. Those address that being forgotten before are fine. Really weird.

[lite]

I don't use etherdelta much, last time i used etherdelta was a month ago. i hope everyone's tokens/ETH are safe.

I logged 24 hours into the ED yesterday. This morning I saw the ED message was hacked. OMG. I have a little token and eth. I hope not to lose them.

Did you import your private key or just opened ED?

[jagadlangit]

Yes, for now, EtherDelta is under investigation, it was DNS hack. For anyone who has left Tokens on EtherDelta Exchange Smart Contract (didn't transfer to wallet) I post list to YouTube how to withdraw Tokens from smart contract to wallet without using EtherDelta website: https://www.youtube.com/watch?v=slru097RrfM&feature=youtu.be
If you been using ED in last 24h clear your DNS cache:
1. Open CMD with administrator privileges  (Run as administrator)
2. Type: ipconfig /flushdns
3. Restart Windows and Router

thank you for your advice, i will do it
and for other user i think you must move your eth or token balance to the ether add that you never sync it with ED

[parobber]

I woke up to this news and the announcement, quite scary, as of yet is there any confirmation that anything was actually stolen or what it was that was infiltrated? From what I can gather it seems as though they just directed traffic.

[Astrilian]

"Just redirected" but still potentially hazardous if you imported your wallet + private key into the phishing site.
They apparantly created an almost identical replica, I already heard people talking about an Inside Job.
Anyway that's just speculaton, it's very concerning what is happing currently, just heard that also Poloniex is affected.

[TorbiK]

If I did not go to EtherDelta for 5-6 days, my deposit on the exchange as well as my MEW wallet is safe? Hackers just collected private keys from those who directly imported them to the phishing site, right?

[sms301]

When You put multiple order in multiple coins, Etherdelta sucks.  I hate EtherDelta as I don't even know which order consumed my ETH. It's not even in etherscan that I can know and transfer that coin. It just consumes my eth whenever I transfer to the exchange.

[Vikingr]

I woke up to this news and the announcement, quite scary, as of yet is there any confirmation that anything was actually stolen or what it was that was infiltrated? From what I can gather it seems as though they just directed traffic.

Hacking is a bit over exaggerated word for this, I think it was some spoofing attack or may be some phishing attack. There are several types of attacks and most of them are done due to negligence of the people themselves. This is must for all the people to know about these types of attacks and also about the best practices on which they can be countered. Because the money is decentralized and you have to own it else people (Attackers) wont let you to have it.

[blockman]

It's confirmed and some said that don't just log in for now or else your coins will affected by the hack. I don't know if our coins are safe there or not and I don't have any guts to check it out for now, I'm waiting for the directive of the etherdelta before checking them out again. Keep us posted here and I will check this thread from time to time on what are the progress with the hacking incident and I hope this storm calms soon.

[RodneyGrillery]

Yes, for now, EtherDelta is under investigation, it was DNS hack. For anyone who has left Tokens on EtherDelta Exchange Smart Contract (didn't transfer to wallet) I post list to YouTube how to withdraw Tokens from smart contract to wallet without using EtherDelta website: https://www.youtube.com/watch?v=slru097RrfM&feature=youtu.be
If you been using ED in last 24h clear your DNS cache:
1. Open CMD with administrator privileges  (Run as administrator)
2. Type: ipconfig /flushdns
3. Restart Windows and Router

Thanks for this, ED isn't the most user friendly exchange, but gotta love the perks of dencentralized exchanges, this wouldn't be possible on centralized exchange...Also I wasn't even aware of deltabalances.github, and many people I know weren't either so this helped in more ways than one.

[AltMoses]

This is the reason why is not advisable to keep bitcoin or altcoin on exchange site.

[qen10]

Sad with what happened to etherdelta hopefully this problem is quickly over and no one is harmed by this problem

I agree with you, hopefully no one harmed by the problem of etherdelta because there are lots of user in etherdelta which are have a lot of tokens right now. I hope I manage to avoid it when I logged in last time.

[Flickkk]

It proves that Etherdelta has a low on security.
too risky to put coins on that exchanger

[nexus2k14]

It proves that Etherdelta has a low on security.
too risky to put coins on that exchanger

You don't need to put coins, once you finish trading you move your Tokens from EtherDelta Smart Contract to Your wallet, if you want super security you can then transfer to another address (that's what I do) and then I check on Ethereum Network Explorer if the transfer is successful and balance is OK.

EtherDelta is a good ERC20 Token exchange, if someone lost Tokens in recent DNS hack it only proves more time is needed to learn and be more careful. Basically, when you open EtherDelta you should see your balance - the website should never ask you to login if you didn't "Forget / Logout". This should be the first red flag for you, I never clean history on my browser so I can open EtherDelta quick. Always try move coins after trading complete, never leave Tokens on exchange.

*** Official update from Reddit - EtherDelta ***

Site has been restored and secured. Official announcement soon.

Just to clear up a few things:

1) If you use Metamask, you're fine.
2) If you use a Ledger, you're fine.
3) If you didn't visit the site on Dec 20th or 21st, you're fine.
If you store your key in a cookie, and you might have visited the site over the last two days (even just loading it), you should assume your key is burned, and transfer Eth and tokens to a new address. Now's a great time to learn to use Metamask!

link:
https://www.reddit.com/r/EtherDelta/comments/7lf9ni/psa_site_has_been_restored_and_secured_official/

[manchester93]

I got out most of my ETH and all my tokens. But I still have a couple ETH in the smart contract. How can I get it out? When I use the "withdraw" function in MEW, it only reads my wallet amount (~empty), not the amount in the smart contract.

The error says I don't have enough funds. I have 0 ETH in my "wallet" and 1.16 ETH in the Etherdelta contract. Does the gas fee come from my wallet? Is that why I get the error, because I can't cover the gas?

[nexus2k14]

I got out most of my ETH and all my tokens. But I still have a couple ETH in the smart contract. How can I get it out? When I use the "withdraw" function in MEW, it only reads my wallet amount (~empty), not the amount in the smart contract.

You will need to open EtherDelta and withdraw from ED website. Second option is use MyEtherWallet to withdraw ETH from smart contract to wallet. here is a link to video tutorial: https://www.youtube.com/watch?v=slru097RrfM&feature=youtu.be

[manchester93]

I got out most of my ETH and all my tokens. But I still have a couple ETH in the smart contract. How can I get it out? When I use the "withdraw" function in MEW, it only reads my wallet amount (~empty), not the amount in the smart contract.

You will need to open EtherDelta and withdraw from ED website. Second option is use MyEtherWallet to withdraw ETH from smart contract to wallet. here is a link to video tutorial: https://www.youtube.com/watch?v=slru097RrfM&feature=youtu.be

Is it safe to open ED right now? I saw the announcement on Twitter, but people are still reporting losing money.

[nexus2k14]

I got out most of my ETH and all my tokens. But I still have a couple ETH in the smart contract. How can I get it out? When I use the "withdraw" function in MEW, it only reads my wallet amount (~empty), not the amount in the smart contract.

You will need to open EtherDelta and withdraw from ED website. Second option is use MyEtherWallet to withdraw ETH from smart contract to wallet. here is a link to video tutorial: https://www.youtube.com/watch?v=slru097RrfM&feature=youtu.be

Is it safe to open ED right now? I saw the announcement on Twitter, but people are still reporting losing money.

In that case better if you wait. You can always withdraw Tokens using MyEtherWallet. I did withdraw 2 days ago all my Tokens worth 4ETH from ED smart contract. Took me 3h, and 30$ in fees (21,30,40 GWEI) but all Tokens are safe now. Normally I always buy Tokens and  withdraw them from ED Smart Contract and transfer to MyEtherWallet address immediately. My MEW wallets I never Login or use private key and I store keys on offline PC encrypted with VeraCrypt. I check balances using ethereum explorer. Keep in mind that using couple wallet addresses is a good idea. I store Tokens this way in 6 different wallets.

manchester93 may I ask where did you get information people still losing their Tokens?

[manchester93]

manchester93 may I ask where did you get information people still losing their Tokens?

On Twitter.

I just don't understand how to withdraw the ETH using MEW. When I use the "withdraw" function I get "Warning! Error encountered during contract execution [Bad instruction]" and the transaction doesn't confirm. Why?

The "deposit" function works fine, but obviously that just puts more in the smart contract.....

EDIT: Found the answer. Need to use proper unit. https://twitter.com/EthereumBlue/status/943925235098816519

Glad to have my funds safe now. I can finally sleep!