Electrum update: A trader lost 1400 BTC

[TedMosby]

moment of silence for that hodler

We are sorry for this, but this message is confusing and too alarming and causes panic among users.
Electrum doesn't have a bug that can be exploited, it cannot be controlled remotely, it has no open vulnerability that can cause loss without user's action.
-snip-

CZ said that Binance already blacklisted the addresses involved, but we all know that it won't help anything.
it can be mixed as well.

so, goodbye 1400 BTC.

[molsewid]

1,400 Bitcoin is a huge amount. If you have this kind of bitcoin you can rest the rest of your life. If I lost that amount I don't know if my mind can handle it. How come the owner of this wallet didn't store in much safer storage? How can he have that large amount of bitcoin and didn't know how to secure it? Goodluck to that hodler hopefully he's in the right mind after that disaster.

[pixie85]

First of all I don't understand how somebody would hold 1400 BTC since 2017 and not check the balance or install updates. Even if he bought it in 2017 for 1000 dollars and forgot about it it would still be 1.5 million USD spent on Bitcoin. With hardware wallets priced at 100 dollars it's amazing that he did not protect his coins.

I installed the update which immediately triggered the transfer of my entire balance to a scammers address.

From what he wrote it's obvious he had a compromised wallet file and lost it all because he was too lazy to download a legit version from the right site.

[gentlemand]

A small update isn't gonna cause such a big loss in bitcoin. Every big loss will be caused by a big team or it'll be executed by the team itself. What' has happened with Binance trader too seems to be a planned scam. 1400 BTC is a big volume, and Binance will not ruin its reputation with this volume of funds. The reserve of Binance is much high compared to the value that's been scammed. Electrum has gained trust as a best wallet, but this isn't fair play from electrum.

Can anyone translate this? I've no idea what they're attempting to say.

If this user has been blissfully unaware since 2017 then I can see how they'd walk straight into this. I expect the person who propagated this will continue to benefit from it as people fire up long untouched Electrum wallets.

If you come back from a long absence you'd better do your homework on the software you stored your coins with. An awful lot can go wrong and be exploited in a year or two, let alone longer.

[jekanmasin]

How come the owner too stupid but yet have 1400btc in his account that untouchable for two years? I guest he must be a billionaire that why he set and forget his bitcoin for a long time now. Maybe that why he so stupid to download the app from unknown resources and not direct official website. It like owner fault that he loses his money and congrats to scammer.. You now a millionaire dude.. 

[gentlemand]

How come the owner too stupid but yet have 1400btc in his account that untouchable for two years? I guest he must be a billionaire that why he set and forget his bitcoin for a long time now. Maybe that why he so stupid to download the app from unknown resources and not direct official website. It like owner fault that he loses his money and congrats to scammer.. You now a millionaire dude..  

I'm sure many people have wallets they haven't touched for years. If you're not going to move or sell it why would you? Even then you need to keep abreast of wallet developments.

The old official version directs to this fucked up one so he could have downloaded from the correct source originally and been fooled by this. If you didn't know about it you likely wouldn't question it.

[BlackHatCoiner]

How come the owner too stupid but yet have 1400btc in his account that untouchable for two years? I guest he must be a billionaire that why he set and forget his bitcoin for a long time now. Maybe that why he so stupid to download the app from unknown resources and not direct official website. It like owner fault that he loses his money and congrats to scammer.. You now a millionaire dude..  

I'm sure many people have wallets they haven't touched for years. If you're not going to move or sell it why would you? Even then you need to keep abreast of wallet developments.

The old official version directs to this fucked up one so he could have downloaded from the correct source originally and been fooled by this. If you didn't know about it you likely wouldn't question it.

The problem is that not all of the people are technicians/programmers/paranoids. There are just some people that want to invest. A lot. They don't believe that something like that can happen. If I were him, I would just export the private key offline, then I would buy a laptop and make it cold storage. If I were him, I wouldn't put 1400 bitcoins in one address in the first place. Too bad for bitcoin fame. Now anti-cryptos can again mention another scam incident.

The scammer now can rest for his entire life.

[hulla]

I doubt Electrum has anything to do with this scam! The person was probably using a compromised wallet .exe file. See what he says,

We know electrum are not to blame for the attack because they have already stated that wallet older than 3.3.4 are vulnerable to phishing attacks and the problem stated from the person the lost his BTC for installing older version of electrum wallet. However, I dont any electrum user claiming the phishing popup wallet update message was from electrum server.

So I suggest you to change the subject line of your thread as it seems that Electrum itself did such scam!

What he need to change is the part that says "Some other users of electrum wallet also complained that the message about update comes directly from the electrum server."

[Yamifoud]

Could be that sorry but I was wondering also for that long since 2017 that person never accesses his electrum account.


I'd never say that he's lying to us but kinda weird how it happens. It is because it is not normal to hold that long, keep your funds online and not even bother to check sometimes. It is impossible that it has gone, unless if your account has been hacked or you already forgot the right wallet address you have visited with. Might be ridiculous but can be possible if you have a lot of wallet address and you have miss one of them.

[Rengga Jati]

Could be that sorry but I was wondering also for that long since 2017 that person never accesses his electrum account.

Agree. How can someone who keeps a big amount of Bitcoin never accesses their electrum account since 2017? It seems a bit strange!. Even if you are the long term holder, doesn't mean you only buy Bitcoin and put it on the wallet without check it regularly. Especially, a digital asset, it doesn't make sense if he never checked the Bitcoin. 1,400 BTC isn't a side asset, it is a serious asset and must be threatened in a special way, including active to monitor the price on the market and check the wallet or account where you put it.

[dunfida]

How come the owner too stupid but yet have 1400btc in his account that untouchable for two years? I guest he must be a billionaire that why he set and forget his bitcoin for a long time now. Maybe that why he so stupid to download the app from unknown resources and not direct official website. It like owner fault that he loses his money and congrats to scammer.. You now a millionaire dude..  

I'm sure many people have wallets they haven't touched for years. If you're not going to move or sell it why would you? Even then you need to keep abreast of wallet developments.

The old official version directs to this fucked up one so he could have downloaded from the correct source originally and been fooled by this. If you didn't know about it you likely wouldn't question it.

I can say that we are still responsible on making our coins to be safe and to think that there would be always wallet upgrades that do happen and if you did just held up your coins for too long
without minding on what are the updates that had been done you would be completely clueless on which one is the right and which one is on the vulnerable side.This malware had been known
last 2018 as far as i remember and its odd for bitcoin holders like this didnt even know on whats happening on crypto world in terms of hack and scams knowing that he do hold up thousands of btc
which means that he do need to know everything on possible hacking ways or exploits and also people do always miss out the basic thing on checking out those warnings or announcements
on the main site itself.

[jossiel]

Most electrum users are aware of the said bug and warning from the website itself. Owning 1,400 BTC should make him more careful of updates and bugs from the wallet that he's using.

Is he that a busy person to forget this hefty amount of wealth and download the outdated version carelessly?

[Shasha80]

This is clearly the user's mistake, to the point of losing 1,400 BTC. For not being careful and careless download Electrum update from
unofficial sources. Therefore it was successfully stolen by hackers, so this incident was not the fault of Electrum. Often lots of people
tricked by hackers with phishing methods, because they did not learn how to secure their own wallets. This incident is a lesson that
always pay attention to the sites we access, do not let us access other unofficial sites.

[FinneysTrueVision]

This vulnerability has been known about for a while now. It's just irresponsible to hold that many Bitcoin in a software wallet and not even bothering to validate the signatures when you do an update.

[Sadlife]

This is why i rather be in Custodial wallet than in open source cold wallet, because only inexperienced or few people manages it, then split my private keys into different Crypto's into many different wallets, just in case a major critical error or a software happens to that one specific wallet. As the saying goes "Never put all your eggs in one basket" better safe than never.

[hatshepsut93]

The ability to send any sum of money without any additional verifications is both strength and weakness of Bitcoin. No one will ever freeze your money, but also no one will ever check if it's truly you who are sending the transaction. With banks you would be contact by their representatives for far smaller sums than this one, and transaction will take a long time to clear, giving you chance to cancel it if it wasn't you.

Blaming Electrum for this is moronic. This is like clicking on a random link in an email, downloading the file it leads you to, and then being shocked when your personal data is stolen by malware.

It's really not like that, an email you can receive message from anyone, so it's expected that some will be malicious, but this Electrum bug made messages from nodes look like they came from the wallet itself.

[Kemarit]

Most electrum users are aware of the said bug and warning from the website itself. Owning 1,400 BTC should make him more careful of updates and bugs from the wallet that he's using.

Is he that a busy person to forget this hefty amount of wealth and download the outdated version carelessly?

I doubt that he forget it, probably just letting it sit there for a while, he said he didn't accessed the wallet since 2017, so I have the impression that he knows he had it. But he doesn't have the security hygiene to check everything before downloading the supposedly latest Electrum.

$17 million gone just like that, so sad to hear that these criminals are really milking crypto enthusiast. But I would say that it was clearly a big mistake on his part and no one to blame but himself.

[FinneysTrueVision]

This is why i rather be in Custodial wallet than in open source cold wallet, because only inexperienced or few people manages it, then split my private keys into different Crypto's into many different wallets, just in case a major critical error or a software happens to that one specific wallet. As the saying goes "Never put all your eggs in one basket" better safe than never.

A custodial wallet is worse. There's no guarantee that they won't steal your money. I used to use Coinbase before they mandated KYC and then lost access because I registered under a pseudonym and I couldn't provide an ID with that name. A few weeks ago I received an email from Coinbase saying that anybody who hadn't been KYC'd would lose access to their account forever and any funds still on Coinbase would be forfeited to the user's local government.

[wack slacker]

1400 Bitcoin equals $ 16 million at the moment. Why could he be so careless? That's the bulk of his wealth, I think if he deposited his money in a reputable exchange he probably wouldn't lose all of his money. This will be a lesson for us in managing our assets. The best way is to use the latest and licensed software.

[Lucius]

Tell me a person that isn't fool and carries 1400 bitcoins on a non verified electrum wallet. These should be on a cold wallet right now.

There are as many as you want, there are dozens (if not hundreds) of cases on this forum that have lost their coins this way - you just need to search the Electrum board or the whole forum by using keywords. There are people who have no idea what is going on, do not read the forums and are not aware of all the vectors of attack that exist - we can freely call them unintelligent investors.

I believe that there are a lot of them who will appear in large numbers with identical stories in the period of the new big pump. The people behind the Electrum phishing scam are actually geniuses who will receive donations for years to come, and that can't be prevented because of the way Electrum works.

One hardware wallet worth $50 or less would probably save the former owner, but in some cases even that doesn’t help because people lose their coins by typing their seeds in fake Ledger or Trezor sites.