Electrum Phishing Update

[jerry0]

I notice several threads of this where people mentioned they tried to send btc and it got a message and it ask to update electrum.


I use electrum very rarely now but still have some btc there.  Does that mean if i try to send btc with electrum, i will get this message?  If so, how does it look and does it update it for you if you click yes or something like that?  Or you have to visit the website to download it? 


I opened electrum few times from my laptop recently and had no issue but i have not sent any btc from it recently.  From what i read, ppl who are trying to send btc get this message.  So did this affect all electrum users?  Someone mentioned i believe its only if you didn't put a password on electrum?  Or its only electrum users from a current version?  I'm using 3.0.5 if that matters?  I don't want to open electrum and then try to send btc and then get an update message and have no clue what to click.  Like does it ask you yes or no?  Or its just a message and you have to X it out?  And where do you do the update?

[Abdussamad]

Download 3.3.2 from electrum.org and install that if you like. Don't respond to any in app update notifications because there are no such legit notifications. The only notification you get is because of a bug that a scammer is exploiting. All he can do is show you a notification. Just x out of it. There are no auto updates.

The fake notification looks like this: https://github.com/spesmilo/electrum/issues/4968#issue-394260722

[Seetth]

So in resume as long the user dont download the software in the notification the transactions can be done safely?

[AdolfinWolf]

So in resume as long the user dont download the software in the notification the transactions can be done safely?

I believe so yes. If you get a pop-up, i think the best thing you can do is force-close electrum, and connect to another server.

The only way to lose your funds AFAIK, is to download the fake electrum, and then run it.

It might be possible that it can only steal your credentials (seed, private key) after you entered them in the "Fake" Electrum wallet, but i wouldn't be so sure of that, especially if your original electrum wallet file wasn't encrypted.

[jerry0]

so as of now, if i open electrum as is and dont send btc, i will not see any message correct?

should i update to the new electrum on the website right now?

should i bother trying to send the small amount of btc i have now in my electrum wallet so i dont keep anything there?  the thing is if i do try to send btc from electrum right now, will i get that message that others got or not?  If i do, can i x it out and ignore it?  im hesitant to even open electrum b/c of this now.

[jerry0]

Im also confused here.  So when the ppl downloaded that software, i read they gave you a link to download it and you had to copy and paste it right?  However, was that directly from electrums website or a fake website?  So if you downloaded electrum from the legit site when this occurred, there would been no issue?


So those that downloaded it, did they had to put their seed into it as copy and paste it?  If not, how did that occur then?

[jerry0]

Also someone mentioned a while back that you could use the nano ledger s with electrum.  I never done this.  But if you do it this way, i heard electrum acts as a watching only wallet.  But if you had download this, it would not affect it since you are still using the nano ledger?