Coding Enthusiast (OP)
Legendary
Offline
Activity: 1040
Merit: 2785
Bitcoin and C♯ Enthusiast
|
![](https://bitcointalk.org/Themes/custom1/images/post/exclamation.gif) |
December 27, 2018, 05:12:50 AM Last edit: December 27, 2018, 05:39:09 AM by Coding Enthusiast Merited by theymos (25), Foxpup (10), suchmoon (10), LoyceV (10), NeuroticFish (5), dbshck (5), ABCbits (4), BitcoinGirl.Club (2), bones261 (2), squatter (2), Heisenberg_Hunter (2), asche (2), DaCryptoRaccoon (2), seoincorporation (1), AdolfinWolf (1), BitHodler (1), khufuking (1), sncc (1), xenon131 (1), butka (1), wry (1) |
|
The real links are: https://github.com/spesmilo/electrum (the github repository hosting the code) https://electrum.org/ (website of the project) 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6 (the real PGP public key of the developer) Anything else is fake. Don't just trust me, double and triple check these values yourself. I have also included the PGP public key because I have been seeing many scammers in the past signing the malicious Electrum releases with a PGP public key (obviously a different one that they own) and if you check the signature with their public key you will see a correct signature and it can create the illusion of being real! Additionally if you see the following error message, ignore it and change your server. It is the malicious server of the attacker and as you can see the link is also fake: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fuser-images.githubusercontent.com%2F29142493%2F50359293-8780b500-055c-11e9-8cfd-83b342edeffb.png&t=665&c=gfjgfv-S2vls5w) More information: https://github.com/spesmilo/electrum/issues/4953https://github.com/spesmilo/electrum/issues/4968
|
|
|
|
|
Heydude1
Newbie
Offline
Activity: 10
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:01:18 AM |
|
Yes i fell for it because i was in a hurry and didn't expect a pop-up within a legit version to be a phishing link. Do you know if they think it was just the standalone client that is the issue or is it malicious files aside from it? I plan on wiping and reinstalling OS in the morning but don't want to if i don't have to ( i know, i know i probably should just to be safe)
|
|
|
|
TryNinja
Legendary
Offline
Activity: 2940
Merit: 7368
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:15:34 AM Last edit: December 27, 2018, 06:27:03 AM by TryNinja |
|
Yes i fell for it because i was in a hurry and didn't expect a pop-up within a legit version to be a phishing link. Do you know if they think it was just the standalone client that is the issue or is it malicious files aside from it? I plan on wiping and reinstalling OS in the morning but don't want to if i don't have to ( i know, i know i probably should just to be safe)
Either you already had a malicious version of Electrum, or the pop up was coming from a different malicious software/website. There is not even a single chance the pop up came from the official Electrum. That's a fact.Edit: thought that this was the first post from the user and literally missed the OP. Sorry.
|
|
|
|
|
Coding Enthusiast (OP)
Legendary
Offline
Activity: 1040
Merit: 2785
Bitcoin and C♯ Enthusiast
|
Do you know if they think it was just the standalone client that is the issue or is it malicious files aside from it?
If you have downloaded the files (standalone, portable, linux tar.gz file,...) from anywhere else other than the legitimate links, then they are all malicious and should not be used. There is not even a single chance the pop up came from the official Electrum. That's a fact.
The "pop up message" that I posted in OP is appearing in Electrum (the real wallet software). It was a bug that was being exploited where the server can return an error message and it showed up like what you see in your wallet. The error message is returned when you send a transaction.
|
|
|
|
Heydude1
Newbie
Offline
Activity: 10
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:20:54 AM |
|
Yes i fell for it because i was in a hurry and didn't expect a pop-up within a legit version to be a phishing link. Do you know if they think it was just the standalone client that is the issue or is it malicious files aside from it? I plan on wiping and reinstalling OS in the morning but don't want to if i don't have to ( i know, i know i probably should just to be safe)
Either you already had a malicious version of Electrum, or the pop up was coming from a different malicious software/website. There is not even a single chance the pop up came from the official Electrum. That's a fact. that's actually false and i know my version was a real version. I also just saw the comments on their GitHub page. It is coming from malicious servers through official electrum client. Which prompts a pop up to download the malicious client. https://github.com/spesmilo/electrum/issues/4968
|
|
|
|
Heydude1
Newbie
Offline
Activity: 10
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:27:41 AM |
|
Do you know if they think it was just the standalone client that is the issue or is it malicious files aside from it?
If you have downloaded the files (standalone, portable, linux tar.gz file,...) from anywhere else other than the legitimate links, then they are all malicious and should not be used. i know that, i have since wiped all the electrum files i could find since i downloaded the malicious file. I am at the point i will most likely reformat my hard drive in the morning as i am unsure at this point if any other malware was attached to it aside from the malicious client
|
|
|
|
TryNinja
Legendary
Offline
Activity: 2940
Merit: 7368
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:27:50 AM |
|
that's actually false and i know my version was a real version. I also just saw the comments on their GitHub page. It is coming from malicious servers through official electrum client. Which prompts a pop up to download the malicious client. https://github.com/spesmilo/electrum/issues/4968Yeah. I thought this thread was the older one from the other user and missed the OP. Sorry about that. Unfortunately, there is still nothing you can do to recover your coins.
|
|
|
|
Heydude1
Newbie
Offline
Activity: 10
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 06:33:55 AM |
|
that's actually false and i know my version was a real version. I also just saw the comments on their GitHub page. It is coming from malicious servers through official electrum client. Which prompts a pop up to download the malicious client. https://github.com/spesmilo/electrum/issues/4968Yeah. I thought this thread was the older one from the other user and missed the OP. Sorry about that. Unfortunately, there is still nothing you can do to recover your coins. i am not worried about that. I use a hardware wallet normally and only use electrum from time to time for small quick transactions. I am however worried what was all attached the bogus client i downloaded. I have wiped anything electrum related but feel like i should be wiping my whole drive just in case.
|
|
|
|
Heydude1
Newbie
Offline
Activity: 10
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 07:40:23 AM |
|
When you download the fake client they must get your seed/password somehow. I wiped electrum files then restore the wallet from seed and put 2$ in there an let it sit. They just emptied the wallet again about 30 mintues ago.
|
|
|
|
bitdaric
Copper Member
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 236
Merit: 17
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 01:02:22 PM |
|
is android version in safe? ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
bitcoinfuck
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 634
Merit: 106
Europe Belongs To Christians
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 01:05:51 PM |
|
When you download the fake client they must get your seed/password somehow. I wiped electrum files then restore the wallet from seed and put 2$ in there an let it sit. They just emptied the wallet again about 30 mintues ago.
maybe UI is doing http post request of your seed ? did you do wireshark ? or can you share the software with me i can try to run it and find which domains its connecting too
|
|
|
|
asche
Legendary
Offline
Activity: 1484
Merit: 1491
I forgot more than you will ever know.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 01:18:49 PM |
|
good catch ! Thank you for sharing ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) Edit: was going to report the github repository but it has been closed already.
|
|
|
|
bL4nkcode
Copper Member
Legendary
Offline
Activity: 2142
Merit: 1305
Limited in number. Limitless in potential.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 01:19:52 PM |
|
Threads like this bother me, luckily I'm not a fan of downloading an update of electrum as in an urgent manner, also I get nothing any notification when I opened the software. And I do always make a practice to see the tweet of electrum official twitter account first before doing something though it might not be a good suggestion but it will help somehow. And I hope victims will not be much for this incident.
|
|
|
|
BitHodler
Legendary
Offline
Activity: 1526
Merit: 1179
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 01:55:34 PM |
|
The "pop up message" that I posted in OP is appearing in Electrum (the real wallet software). It was a bug that was being exploited where the server can return an error message and it showed up like what you see in your wallet. The error message is returned when you send a transaction.
This is actually very concerning since this isn't the first time Electrum as very trusted client has had some issues to work out. Good thing however is that they are pretty quick with patching bugs. Another clear sign why the Core client is so dominant. It's by far the most secure client out there and people rightfully trust it with everything they have. The only thing is that average joes don't like running a full node client. Not sure if and when, but if this continues people might lose confidence in Electrum and ditch it for good. It's a shame since it's one of the better SPV wallets available, but you can't endlessly make headlines like this....
|
BSV is not the real Bcash. Bcash is the real Bcash.
|
|
|
DaCryptoRaccoon
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 02:04:31 PM |
|
Another reason for Full-Validation, Was only a matter of time before the the servers became a point of attack.
|
┏━━━━━━━━━━━━━━━━━┓ ┃ 𝔱𝔥𝔬𝔲 𝔰𝔥𝔞𝔩𝔱 𝔴𝔬𝔯ⱪ 𝔣𝔬𝔯 𝔶𝔬𝔲𝔯 𝔟𝔞𝔤𝔰 ┃ ┃ ➤21/M ┃ ┃ ███▓▓ ███▓▓ ███▓▓ ███▓▓┃
|
|
|
khufuking
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 02:09:58 PM |
|
I posted the warning in my local board, I hope everyone can do the same with his own language I bet we will see a lot of thread about losing Bitcoin with Electrum soon. Please, everyone, have a chance to alert others please do so.
|
|
|
|
Lucius
Legendary
Offline
Activity: 3346
Merit: 5939
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 27, 2018, 02:21:32 PM |
|
This is actually very concerning since this isn't the first time Electrum as very trusted client has had some issues to work out. Good thing however is that they are pretty quick with patching bugs.
Previous issue was fairly harmless compared to this. To users get hacked before version 3.0.5 he need to have wallet which is password unprotected and to have this wallet open on a particular web page which can then use this vulnerability to stole users funds. This new issue is far more dangerous because hackers use original Electrum wallet to trick users to upgrade to fake wallet. For now this issue is not fixed, and the attack is still being performed. So far 15(new data say up to 250) BTC is stolen, only good thing is this happens in time of holidays when many are away from their devices and BTC. https://bitcointalk.org/index.php?topic=5089945.0
|
|
|
|
|
|