2 weird happening now in ELECTRUM WALLET. (calling all devs from electrum)

[Quack2341]

yeah i have heard of all these things happen and I guess you always think you've done the right thing and couldn'thave been compromised.


So i have restored OS, used anti malware and virus protection, and I use cc cleaner to clear out cookies etc .then made new seperate wallets with new paswords/seeds stored not electronically.

I hope it doesn't happen again, but obviously it's my fault. I haven't done something right along the way.

[nc50lc]

electrum must verify itself. If do that from the first version we dont have these problems

Don't know if this is trap or a stupid suggestion.

If this will solve these problems, tell me:
How can you trust something that you don't know if you can trust to verify itself if you can really trust it?

[ysangkok]

electrum must verify itself. If do that from the first version we dont have these problems

Electrum has a signed update announcement mechanism since v3.3.3. It was introduced in this commit: https://github.com/spesmilo/electrum/commit/0bfda7c8c74757d261bbc7e24eee44fa09965e85

You should still verify downloaded binaries using GPG, of course. And only get your binaries from electrum.org. Type it yourself, do not copy-paste, do not click links.

[progamegamegame]

Help PLEASE, just made sending bitcoins through a mixer, clicked send a window appeared where update was written and so on, there were no versions download links, I clicked ok. I clicked send bitcoin to the address, after which the window clicked ok, I started updating version , I look and the translation has already gone, after which I started watching the transfer transaction, sending has already taken place, but bitcoins have not yet arrived at the address I have already received 3 hours and not one confirmed transaction please help the guys, I don’t understand me or what? I didn’t follow the links by any means, a small window popped up and I clicked ok and that's it!
At the moment, the transaction did not reach 0 confirmations hung as if, but I didn’t download anything, I just went into the electronic version as usual. The version was 3.3.2. A window pops up. I clicked ok, then I noticed that the transaction began to transfer. it has come, BUT I HAVE NOTHING HAVINGED ANYTHING AND DIDN'T UPDATE 100%

[zetzetzet]

ThomasV, you should post here in sticky thread HASH of .exe file - to do 2step verification of software.

[CJR]

I received the same error on my electrum wallet 3.3.2, but instead of downloading from the link, I went to download the new .exe installer for windows on electrum.org website.

As soon as I downloaded it, windows defender showed me an error of a trojan on the file.

Not sure what to do, if I leave the previous version Im exposed to phishing, but if I download the new version from the electrum.org website I get a trojan warning message from windows defender.

Any updates on this?

[TryNinja]

I received the same error on my electrum wallet 3.3.2, but instead of downloading from the link, I went to download the new .exe installer for windows on electrum.org website.

As soon as I downloaded it, windows defender showed me an error of a trojan on the file.

Not sure what to do, if I leave the previous version Im exposed to phishing, but if I download the new version from the electrum.org website I get a trojan warning message from windows defender.

Any updates on this?

Don’t worry. That’s most likely just a false positive. Electrum shows as a trojan to a few AVs out there. If you downloaded from electrum.org then you are safe. But, make sure to verify the file signatures before running it.

Here is an tutorial on how to verify the file signature: https://bitcointalk.org/index.php?topic=5105901.0

I made a post talking about this yesterday:

Lucius, yeah, just seen that thread.

ThomasV, could you, please, write here in sticky thread MD5 / SHA-1 / signature of real Electrum 3.3.3 ?

Just verify the signatures.

Electrum is commonly acussed as a trojan by a few random AV’s. But that’s just a false-positive. It happens all the time.

Here is Electrum’s “official” explanation:

"Anti-virus" software uses shitty heuristics to detect malware. PyInstaller is a convenient tool to package python apps. We use PyInstaller. Malware authors use PyInstaller. Everything that uses PyInstaller is detected as malware.

Anti-virus software have (and always had) false positives, and some of them tag Electrum as malware. This is out of our control. This does not mean that Electrum is or contains malware.

The Windows binaries are signed using the native Windows signing scheme by an entity named Electrum Technologies GmbH. They are also signed using GPG by @ecdsa (ThomasV). The GPG key fingerprint is 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6.

If you trust the developers of the project, you can verify the GPG signature, and ignore any anti-virus warnings.

If you don't trust the developers with not backdooring the binaries, you can (1) build binaries yourself; or (2) you can run from source. Some of the binaries are built reproducibly, so you can also check that those match.

More: https://github.com/spesmilo/electrum/issues/3198#issuecomment-458949319

[HCP]

Help PLEASE, just made sending bitcoins through a mixer, clicked send a window appeared where update was written and so on, there were no versions download links, I clicked ok. I clicked send bitcoin to the address, after which the window clicked ok, I started updating version , I look and the translation has already gone, after which I started watching the transfer transaction, sending has already taken place, but bitcoins have not yet arrived at the address I have already received 3 hours and not one confirmed transaction please help the guys, I don’t understand me or what?

If you didn't follow any links and/or download and install anything... then there is a very good probability that you are OK and there is nothing to worry about. Your transaction is probably just stuck for some reason (lots of unconfirmed transactions, low fee etc).

I had a look and there was a big spike in unconfirmed transactions (and fees) around the time you posted your message, so it is most likely related to that. Since then the mempool has cleared, so I would assume that your transaction has most probably confirmed now.

However, if your transaction has still not confirmed, can you post the transaction ID or the address that you were trying to send to? I realise that you're attempting to send to a mixer... and posting the TXID or Address will compromise the privacy, but without this, there is no way to understand what is happening with your transaction. You can PM me if you would like to post the TXID/address privately.

[G3nijalac]

I guess you could wait for the malicious server attacks to stop before trying to send.
Or if you need the funds sooner just import seed into another HD wallet.
Hope you can sort it all out successfuly.

[TryNinja]

I guess you could wait for the malicious server attacks to stop before trying to send.
Or if you need the funds sooner just import seed into another HD wallet.
Hope you can sort it all out successfuly.

Or just connect to a non-malicious server.