Possible hack: filesize of Electron cash wallet is different

[letsworktogether122]

Hey guys,
I am suspecting some shenanigan is going on.

Yesterday, I've tried to get Bitcoin Cash from old Multibit classic 0.5.16 and found some instruction here that I can use Electron Cash Wallet and that it should be fine unless it's compromised. I have Mac OSX. I downloaded the Electron-Cash-3.1.2-macosx.dmg WITH Chrome, and when I run it the installation said that it can't be mounted or what and didn't proceed (I don't remember). I've tried to download the file again - same error.

What caught my attention was that the files were different sizes. /I downloaded it from https://www.electroncash.org/. Everything looked legit, https. Nothing out of ordinary /

I tried to download the file from Safari and the file is a different size again - 96,1 MB, but this time when I try to download it from Chrome, it is always 96,1 MB too.

The site also says: "Please, please, PLEASE... take the time to verify the authenticty of these files before running them." - How do you verify them? And why is "authenticty" written wrong?

To me, it looks like some malicious Chrome plugin is changing the content of the website so I download some altered file which would steal my BTC.

Here are the files:
DON'T OPEN THEM UNLESS YOU KNOW WHAT YOU ARE DOING!!!

https://dropfile.to/XoxT8BE
https://dropfile.to/Sy9FxBa
https://dropfile.to/bzMx3Dv


Any ideas?

[xdrpx]

It could be your chrome plugin or it could be some malware on your local PC that could be redirecting you to a fake download version. Either ways you'll need to verify the signatures by using GPG for mac (you might want to search this online and find it)

Then all you need to do is download the signatures that were used to sign the application from here: https://github.com/fyookball/keys-n-hashes/tree/master/sigs-and-sums based on the version you've downloaded.

There's a good guide here using GPGsuite to verify the dmg file in macOS - https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-mac/. If the signature of the downloaded .exe is good, then you can continue to install it on a computer that's clean (probably a fresh install of TAILS OS on USB and then also running electron cash on it)

Edit: I suggest you also don't share links to those executables here even though you've provided the warning.

[TryNinja]

There is nothing wrong with the website. I checked in my computer and its also written "authenticty" (probably just a typo).

About the different file sizes, maybe the file corrupted while downloading? This happens with me sometimes and the file just shows as "download completed" but the size is way lower than it should be and it doesn't open without an error message.

Just make sure that you are download from this link:
https://electroncash.org/downloads/3.1.2/mac/Electron-Cash-3.1.2-macosx.dmg

And verify your files with the guide linked above.
Also download the file and use https://md5file.com/calculator to check if the SHA256 hash matches with the one in this page:
https://github.com/fyookball/keys-n-hashes/blob/master/sigs-and-sums/3.1.2/mac/SHA256.Electron-Cash-3.1.2-macosx.dmg.txt

[letsworktogether123]

(throwaway account)

Guys, thx a lot.

The link is: (I guess it's fine), but:
DON'T DOWNLOAD UNLESS YOU KNOW WHAT YOU ARE DOING
https://electroncash.org/downloads/3.1.2/mac/Electron-Cash-3.1.2-macosx.dmg

[Spendulus]

(throwaway account)

Guys, thx a lot.

The link is: (I guess it's fine), but:
DON'T DOWNLOAD UNLESS YOU KNOW WHAT YOU ARE DOING
https://electroncash.org/downloads/3.1.2/mac/Electron-Cash-3.1.2-macosx.dmg

The same download is available from Github, if I recall correctly. This is a fork of Electrum.

[Cofuchu]

That's terrible of course, that right now you can lose your bitcoins just like that. Thanks for the detailed description. I think there really is a problem here.