slinkybob (OP)
Newbie
Offline
Activity: 3
Merit: 1
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 06:12:48 AM |
|
I just lost .73 of a bitcoin.. about £6k. I was making a small payment (about £50) through electrum and I got a message saying that I needed to apply a patch before the payment could be sent. The patch seemed to be legit and led directly to the electrum website. I downloaded Electrum 4.0. and when I started it up all my bitcoins had gone. my balance is now zero. What happened?
|
|
|
|
Abdussamad
Legendary
Offline
Activity: 3640
Merit: 1571
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 06:16:03 AM |
|
|
|
|
|
slinkybob (OP)
Newbie
Offline
Activity: 3
Merit: 1
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 06:28:10 AM |
|
Thanks.. ![Cry](https://bitcointalk.org/Smileys/default/cry.gif)
|
|
|
|
bob123
Legendary
Offline
Activity: 1624
Merit: 2481
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 07:44:33 AM |
|
The patch seemed to be legit and led directly to the electrum website.
Unfortunately not. The one and only original electrum site is https://electrum.org/. The message which was shown to your came from a malicious electrum server you were connected to. And it linked to a (faked) github repository with no source code, and only a (malicious) binary available to download. Unfortunately, you have been a victim of the phishing campaign. Your funds are gone.
|
|
|
|
Lucius
Legendary
Offline
Activity: 3332
Merit: 5914
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 09:44:09 AM |
|
slinkybob, it's a shame you didn't register in the forum before or that you read just like guest, then you would see warnings about this attack which is start at the end of last year. We have dedicated board for Electrum, and there you can see many identical cases posted by victims. I'm sorry for your loss, hope that hackers will pay one day for their crimes.
|
|
|
|
crwth
Copper Member
Legendary
Offline
Activity: 2856
Merit: 1275
Try Gunbot for a month go to -> https://gunbot.ph
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 09:53:44 AM |
|
So he is a victim of a phishing technique — installed malware, etc.
I want to understand more. Is it because his original software of the wallet is already compromised or is it anything connected with his computer or something? Do the hackers know that he holds Bitcoin? Somehow, someway, they had access? I'm just worried about any other else that could jeopardize my funds.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
AB de Royse777
Legendary
Offline
Activity: 2576
Merit: 4010
Hire Bitcointalk Camp. Manager @ r7promotions.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 10:09:27 AM |
|
Is it because his original software of the wallet is already compromised
Since the code is open source, anyone can alter the code and insert something that will open a door to steal your coins. If you download Electrum from any other website than electrum.org then you are risking your coins. That Electrum client can be infected. So, it is always advised that to down the software from official https://electrum.org/#download and not only this - before installing the file make sure you have verified the signature: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/If you can successfully verity the download file then you are sure that you have the original version.
|
..Stake.com.. | | | ▄████████████████████████████████████▄ ██ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ██ ▄████▄ ██ ▀▀▀▀▀▀▀▀▀▀ ██████████ ▀▀▀▀▀▀▀▀▀▀ ██ ██████ ██ ██████████ ██ ██ ██████████ ██ ▀██▀ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██████ ██ █████ ███ ██████ ██ ████▄ ██ ██ █████ ███ ████ ████ █████ ███ ████████ ██ ████ ████ ██████████ ████ ████ ████▀ ██ ██████████ ▄▄▄▄▄▄▄▄▄▄ ██████████ ██ ██ ▀▀▀▀▀▀▀▀▀▀ ██ ▀█████████▀ ▄████████████▄ ▀█████████▀ ▄▄▄▄▄▄▄▄▄▄▄▄███ ██ ██ ███▄▄▄▄▄▄▄▄▄▄▄▄ ██████████████████████████████████████████ | | | | | | ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ █ ▄▀▄ █▀▀█▀▄▄ █ █▀█ █ ▐ ▐▌ █ ▄██▄ █ ▌ █ █ ▄██████▄ █ ▌ ▐▌ █ ██████████ █ ▐ █ █ ▐██████████▌ █ ▐ ▐▌ █ ▀▀██████▀▀ █ ▌ █ █ ▄▄▄██▄▄▄ █ ▌▐▌ █ █▐ █ █ █▐▐▌ █ █▐█ ▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀█ | | | | | | ▄▄█████████▄▄ ▄██▀▀▀▀█████▀▀▀▀██▄ ▄█▀ ▐█▌ ▀█▄ ██ ▐█▌ ██ ████▄ ▄█████▄ ▄████ ████████▄███████████▄████████ ███▀ █████████████ ▀███ ██ ███████████ ██ ▀█▄ █████████ ▄█▀ ▀█▄ ▄██▀▀▀▀▀▀▀██▄ ▄▄▄█▀ ▀███████ ███████▀ ▀█████▄ ▄█████▀ ▀▀▀███▄▄▄███▀▀▀ | | | ..PLAY NOW.. |
|
|
|
o_e_l_e_o
In memoriam
Legendary
Offline
Activity: 2268
Merit: 18696
|
Electrum versions prior to 3.3.4 had a feature which allowed servers to display a pop up box to connected users to tell them about errors. Some third party hosted a malicious server, and anyone who connected to it (which can happen automatically) would be shown a pop up box advising them their Electrum client was out of date and they needed to update to version 4.0, along with a link to the fake wallet, which many users blindly follow, download, install, and use, without checking or verifying it first. In this case, OP didn't need to have anything already compromised or anything connected to his computer as you suggest. The hackers don't know who he is, or have any access to his machine. They exploited a (now patched) flaw in older versions of Electrum to trick OP in to downloading malware. You can read more about this flaw here: https://github.com/spesmilo/electrum/issues/4968
|
|
|
|
UnruffledST
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 243
Merit: 18
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 10:48:18 AM |
|
Electrum versions prior to 3.3.4 had a feature which allowed servers to display a pop up box to connected users to tell them about errors. Some third party hosted a malicious server, and anyone who connected to it (which can happen automatically) would be shown a pop up box advising them their Electrum client was out of date and they needed to update to version 4.0, along with a link to the fake wallet, which many users blindly follow, download, install, and use, without checking or verifying it first. In this case, OP didn't need to have anything already compromised or anything connected to his computer as you suggest. The hackers don't know who he is, or have any access to his machine. They exploited a (now patched) flaw in older versions of Electrum to trick OP in to downloading malware. You can read more about this flaw here: https://github.com/spesmilo/electrum/issues/4968Wow legit feel bad for the user, downloads a patch thinking hes doing the right thing just to find his coins gone. To be honest this technique would have even caught me off guard if presented with it. I mean not everyone usually checks the link before downloading even more when it comes from the program itself. Really man hope that you are keeping your head up even though you came out with a loss. 8k usd is not a small sum for alot.
|
|
|
|
bob123
Legendary
Offline
Activity: 1624
Merit: 2481
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 31, 2019, 12:56:21 PM |
|
To be honest this technique would have even caught me off guard if presented with it. I mean not everyone usually checks the link before downloading [...]
Well.. then you should reconsider your security measurements. You should never download anything without double-checking the URL. And additionally you also should never install sensitive software (e.g. wallet software) without verifying the signature. There are tons of guides available how to verify the signature. It is even mentioned on electrum.org.
|
|
|
|
pereira4
Legendary
Offline
Activity: 1610
Merit: 1183
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 12:28:18 AM |
|
Even signatures don't guarantee anything, the MIT server where they store them could have been compromised, the people involved could have been compromised... etc
This is why you want to ideally run a full client and validate your own transactions, otherwise you are basically running a webwallet.
|
|
|
|
TryNinja
Legendary
Offline
Activity: 2926
Merit: 7351
Top Crypto Casino
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 12:40:31 AM |
|
Even signatures don't guarantee anything, the MIT server where they store them could have been compromised, the people involved could have been compromised... etc
This is why you want to ideally run a full client and validate your own transactions, otherwise you are basically running a webwallet.
Well, you don't actually need to get a new signature every time a new update is released. Get it now while the MIT server hasn't been compromised and use it for every new update. Also, a full client (node) is as much as of a software as any other wallet (such as Electrum). How would you confirm the full client you are running is legit if even the signature server is potentially compromised? At some point you will have to trust something/someone.
|
|
|
|
ranochigo
Legendary
Offline
Activity: 3024
Merit: 4350
Crypto Swap Exchange
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 01:32:34 AM |
|
Even signatures don't guarantee anything, the MIT server where they store them could have been compromised, the people involved could have been compromised... etc
This is why you want to ideally run a full client and validate your own transactions, otherwise you are basically running a webwallet.
That isn't secure either. Even running a full client isn't enough. Bitcoin Core can be compromised in that scenario too. The problem here isn't with the validation of the transaction. I don't agree with that either. The difference between SPV clients and Web wallets is huge; SPV clients still do give you full control over your private keys. IMO, SPV clients gives its user the balance between convenience and security. If you want to protect against the scenario that you've described, you have to review and build the client from scratch. This isn't something everyone can do.
|
|
|
|
crwth
Copper Member
Legendary
Offline
Activity: 2856
Merit: 1275
Try Gunbot for a month go to -> https://gunbot.ph
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 05:07:41 AM |
|
Is it because his original software of the wallet is already compromised
Since the code is open source, anyone can alter the code and insert something that will open a door to steal your coins. If you download Electrum from any other website than electrum.org then you are risking your coins. That Electrum client can be infected. Well, then there's no problem with that but as o_e_l_e_o said, even if you downloaded the legitimate one and it prompts an update or something, it could somehow show a pop-up box saying to update it, knowing that there is already an update, they are taking advantage of that part, if I understood correctly. It's because hackers are somehow signaling from their electrum node or something to do that? That must have happened to a lot of users. Sad to say, it's better to be skeptical about these kinds of things.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
AB de Royse777
Legendary
Offline
Activity: 2576
Merit: 4010
Hire Bitcointalk Camp. Manager @ r7promotions.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 01:32:00 PM |
|
~snip~ Well, then there's no problem with that but as o_e_l_e_o said, even if you downloaded the legitimate one and it prompts an update or something, it could somehow show a pop-up box saying to update it,
Since I learnt about the hack of clicking the update button few months ago I never use auto update feature. Luckily I have never seen the update pop up as well. This is what I recommend, if you somehow find yourself in this kind of situation that Electrum is asking for update with a pop up then just close entire Electrum and download a a fresh copy from their official website. Verify it before installing and start over again. This way, you are safe that you are using authentic Electrum and also the latest version. Do not forget to keep your seeds safe in somewhere else. You need them to restore your wallet if you have not backed up your files in the wallet folder before uninstalling the old version.
|
..Stake.com.. | | | ▄████████████████████████████████████▄ ██ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ██ ▄████▄ ██ ▀▀▀▀▀▀▀▀▀▀ ██████████ ▀▀▀▀▀▀▀▀▀▀ ██ ██████ ██ ██████████ ██ ██ ██████████ ██ ▀██▀ ██ ██ ██ ██████ ██ ██ ██ ██ ██ ██ ██████ ██ █████ ███ ██████ ██ ████▄ ██ ██ █████ ███ ████ ████ █████ ███ ████████ ██ ████ ████ ██████████ ████ ████ ████▀ ██ ██████████ ▄▄▄▄▄▄▄▄▄▄ ██████████ ██ ██ ▀▀▀▀▀▀▀▀▀▀ ██ ▀█████████▀ ▄████████████▄ ▀█████████▀ ▄▄▄▄▄▄▄▄▄▄▄▄███ ██ ██ ███▄▄▄▄▄▄▄▄▄▄▄▄ ██████████████████████████████████████████ | | | | | | ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ █ ▄▀▄ █▀▀█▀▄▄ █ █▀█ █ ▐ ▐▌ █ ▄██▄ █ ▌ █ █ ▄██████▄ █ ▌ ▐▌ █ ██████████ █ ▐ █ █ ▐██████████▌ █ ▐ ▐▌ █ ▀▀██████▀▀ █ ▌ █ █ ▄▄▄██▄▄▄ █ ▌▐▌ █ █▐ █ █ █▐▐▌ █ █▐█ ▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀█ | | | | | | ▄▄█████████▄▄ ▄██▀▀▀▀█████▀▀▀▀██▄ ▄█▀ ▐█▌ ▀█▄ ██ ▐█▌ ██ ████▄ ▄█████▄ ▄████ ████████▄███████████▄████████ ███▀ █████████████ ▀███ ██ ███████████ ██ ▀█▄ █████████ ▄█▀ ▀█▄ ▄██▀▀▀▀▀▀▀██▄ ▄▄▄█▀ ▀███████ ███████▀ ▀█████▄ ▄█████▀ ▀▀▀███▄▄▄███▀▀▀ | | | ..PLAY NOW.. |
|
|
|
o_e_l_e_o
In memoriam
Legendary
Offline
Activity: 2268
Merit: 18696
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 02:07:00 PM |
|
Well, you don't actually need to get a new signature every time a new update is released. Get it now while the MIT server hasn't been compromised and use it for every new update. Thomas Voegtlin's GPG key can be found in many places online, and it is impossible for an attacker to compromise them all. If you were really paranoid, you could access it from several sources and compare them. the people involved could have been compromised. If you are worried about a piece of software such as Electrum becoming compromised, then probably the easiest way to mitigate against this is to pair it with a hardware wallet. Even if you were using the malicious version of Electrum we are talking about in this thread, an attacker wouldn't be able to steal your coins unless you were stupid enough/not paying attention enough to confirm their malicious transaction on your hardware device. The only way to fully mitigate against it so examine the source code yourself.
|
|
|
|
erikalui
Legendary
Offline
Activity: 2632
Merit: 1094
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 01, 2019, 03:22:11 PM |
|
Similar case here: https://twitter.com/gage5144/status/1149538691989135362 (They only have 3.3.8 till now so 4.0 is out of question for years. That should have been a warning sign to upgrade from 3.3.x directly to 4.). Since I learnt about the hack of clicking the update button few months ago I never use auto update feature. Luckily I have never seen the update pop up as well.
This is what I recommend, if you somehow find yourself in this kind of situation that Electrum is asking for update with a pop up then just close entire Electrum and download a a fresh copy from their official website. Verify it before installing and start over again. This way, you are safe that you are using authentic Electrum and also the latest version.
Do not forget to keep your seeds safe in somewhere else. You need them to restore your wallet if you have not backed up your files in the wallet folder before uninstalling the old version.
But there should be an option to disable the popups as there have been so many cases where users have lost their money. Last year the same happened and they updated their wallet and now again a new hack since April. Except warning they do nothing.
|
|
|
|
o_e_l_e_o
In memoriam
Legendary
Offline
Activity: 2268
Merit: 18696
|
Except warning they do nothing. They patched the flaw in version 3.3.3, which was released over 6 months ago. There have been 5 new versions since then. The flaw has been widely publicized (including right at the top of the electrum.org landing page), and pretty much everyone who regularly uses these forums, reddit, or reads any crypto media sites would have heard about it. The only people still falling victim to it are those who are using 6 months/6 versions out-of-date software, don't read any crypto sites or news, and don't follow the instructions on how to update and verify Electrum properly. They've done literally everything they could do. There is no way for them to remotely disable all vulnerable clients. It's like the people who type their seed in to random websites despite constant and repeated warnings to keep your seed confidential and never reveal it to anybody or anything. Sometimes you just can't save people from themselves, regardless of how much you try. It's pretty basic security practices to not follow random links, and especially not to download and install software from random links.
|
|
|
|
bob123
Legendary
Offline
Activity: 1624
Merit: 2481
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 02, 2019, 07:45:22 AM |
|
Even signatures don't guarantee anything, the MIT server where they store them could have been compromised, the people involved could have been compromised... etc
You know.. what happens if the internals of ledger get compromised ? What if the hardware manufacturer of your computer (e.g. Intel / AMD) intentionally builds in a backdoor in your computer ? If you really want to go THAT far, the only option is an absolute offline computer (never went / going online) in a faraday cage inside of a highly secured (talking about physical access) room. Everything can be compromised. But you have to look at the probabilities. This is why you want to ideally run a full client and validate your own transactions, otherwise you are basically running a webwallet.
What if the github repository of core gets compromised ? ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) Also.. there are tons of differences between a SPV desktop client and a web wallet security-wise. ETFbitcoin and i have already discussed this topic about one week ago: But the web wallet has a lot more points of failure. For example, a MitM, compromised server, DNS spoofing, etc.. Those all only apply to web wallets and not to desktop wallets.
On the other hand, there is not a single attack point which could target a desktop wallet, but not a web wallet.
~snip~ Don't forget hostile takeover by government, phishing website, malicious browser extension & people in the company went rogue.
|
|
|
|
Stedsm
Legendary
Offline
Activity: 3052
Merit: 1273
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 02, 2019, 05:59:36 PM |
|
I'm sorry for your loss OP.
I believe we should start up a campaign (not speaking about signature campaign) where we should make newbies aware of such vulnerabilities to save them from becoming a victim for those hackers who just want free money and don't really wanna work for it. Else, I'd urge @theymos and @admins (administration) to please display these things as warnings in the News part (top left of your page under avatar) as it'd actually save many of them and even us if we remain unaware until scammed.
|
| .SHUFFLE.COM.. | ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ | ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ | . ...Next Generation Crypto Casino... |
|
|
|
|