just got hacked through electrum

[jon0190]

I tried to send coins out of electrum and was stopped for upgrades, when I get back in my money is gone? I frooze the transaction and it confirmed anyway. Do they even have support to contact? I have no money now, how is this happening,

[1713524726]

1713524726

[TryNinja]

Which version were you previously using? Did you receive a “warning popup” - after trying to do a transaction -  telling you to update your Electrum from a github link?

If that’s the case, your fell for a phishing scam and your coins are gone. There is nothing you can do since BTC transactions are irreversible.

Do a clean reinstall of your OS and create a new wallet. Both your PC and walet are most likely compromised. Also, NEVER dowpoad Electrum from a website that isn’t electrum.org; That’s the ONLY legit place you can get it.

[jon0190]

I've never been phished before, its fucked up because it comes from the app. Not being mean towards you this is fucked up. they need to pull the service if they can't run it decently

[TryNinja]

I've never been phished before, its fucked up because it comes from the app. Not being mean towards you this is fucked up. they need to pull the service if they can't run it decently

It was a vulnerability. The Electrum servers (which anyone can run due to its descentralized nature) could make the Electrum wallet connected to it show a customized error message. So, the hacker deployed a bunch of malicious servers they showed the “please update” message you say.

When dealing with money, you should never put your guard down. Verifying the signatures of the binaries should be a mandatory step when downloading/updating Electrum.

Anyways, the vulnerability has been fixed in the latest version which was launched a few days ago and that you didn’t have. Unfortunately, it’s too late now. Sorry.

[elda34b]

lol. "has been fixed in the latest version" but old users dont know about that

Well they should always verify a signature before they download and install the apps. That's the basic steps to protect yourself. Blaming everything on the software won't solve anything, help yourself by making sure you install the correct apps.

[jon0190]

It happened because the software stopped me from proceeding you fucking idiot!

lol. "has been fixed in the latest version" but old users dont know about that

Well they should always verify a signature before they download and install the apps. That's the basic steps to protect yourself. Blaming everything on the software won't solve anything, help yourself by making sure you install the correct apps.

[jon0190]

What’s happening is the equivalent of your bank letting you use a mobile app as your only way to bank, then not telling you hackers have taken it over and you won’t be able to withdraw your money. What good is updates on your website when you have no reason to go to the website in the first place. This is a complete crock of shit

[jon0190]

What kind of software doesn’t tell you when important updates are required?

[jossiel]

Is this exactly the same problem that you met?
https://www.reddit.com/r/Electrum/comments/amfbie/ongoing_attack_on_electrum_cant_send_bitcoins/

Do they even have support to contact?

https://twitter.com/ElectrumWallet

when I get back in my money is gone?

Sorry for your lost mate.

[HCP]

electrum should protect its users. If op run electrum and it says "No. You are using old version and it has been hacked. It has been fixed in the latest version. Download the latest version from electrum.org" then we dont have topics like this

What kind of software doesn’t tell you when important updates are required?

And what happens when the centralised update server gets hacked... broadcasts a spam to all users that they need to update to new version and all the users blindly trust that because "it is the Electrum update server" and download a malware wallet and lose all their funds? You'd all be asking "why Electrum have forced update notification?"

"Be your own bank" implies "Be your own Bank's security department as well". Everyone is all about the "freedom" of Cryptocurrency... no-one seems to want the added responsibility that comes with that freedom.

There are ways and means to protect yourself... and the easiest is to ALWAYS verify the digital signature of the Electrum installer (or portable .exe). Even when I have downloaded it from Electrum.org, I will ALWAYS verify the digital signature of the downloaded file to confirm it is legit.

So, even if I had received the spam message, ignored the fact it redirected to github instead of the official website and downloaded the malware installer, I never would have installed it... because the malware installer would have FAILED the digital signature verification.

[HCP]

It is all rather moot anyway... it looks like you got your wish... they've added (opt-in) update notifications to Electrum, and apparently have started using "good" servers (via an ElectrumX update) to broadcast update notifications to older versions of Electrum that are vulnerable to the exploit.

[pooya87]

What kind of software doesn’t tell you when important updates are required?

in my opinion it is mainly because there is a lot of controversy circling the wallet softwares that do alert users of new versions. so developers decide not to include such features in their software.

in any case, you are in a decentralized world using a decentralized currency with open source/free software. it is your own responsibility to follow their vulnerabilities, shortcomings,... and learn how to increase your own security as much as possible. nobody is going to take your hand and do it for you.

[ml73]

Hi..

I think my electrum wallet is hacked too.

Yesterday i received 0.048 btc , clock 08.50 pm.

Then ,  clock 00.27 am i have send those bitcoins but i havent.

Whats going on ??


       Mika

[ml73]

I have version 3.0.3 and i have a password when i open my wallet and send.

[TryNinja]

I have version 3.0.3 and i have a password when i open my wallet and send.

Did you download Electrum from anywhere else other than electrum.org? Like a github link?

Did you receive a popup telling you to update your Electrum after trying to make a transaction?

[ml73]

I havent receive any popups and i downloaded from their site about two years ago.

This is the transaction what i havent made :

https://www.blockchain.com/btc/tx/785727d486869504a0e9e505b7430001ea7d0d2ce574ebde00fccc21b42e2d9c

[bob123]

It happened because the software stopped me from proceeding you fucking idiot!

That's not completely true.

The electrum server which you were connected to (which can by run by anyone who wants to) didn't broadcast your transaction.
That's not related to the electrum wallet itself.


Instead of simply clicking on an URL to download software which you didn't even verify the signature of, you could have simply connected to a different (non-malicious) electrum server.


I don't know how often you already read that here on the forum.. but.. Verify, don't trust!

I havent receive any popups and i downloaded from their site about two years ago.

The fact that you didn't update a software which holds your money for about 2 years, is already pretty bad.

Unfortunately there is no way for you to get the money back.


Since you didn't download a malicious wallet trough a phishing attempt and since your wallet is password protected, i'd say that the most plausible explanation is that your computer is infected with malware.

Did you download any half-way-shady software within the recent days ?
Do you use a legal copy of windows (cracked versions almost always have backdoors built in) ?

[ml73]

and i have a password in my wallet

[ml73]

Electrum should pay me for my lost coins  !!!

[ml73]

There is nothing what i can do