Wasabi Wallet - Open Source, Noncustodial Coinjoin Software

[BlackHatCoiner]

That's probably the malicious coordinator: https://bitcointalk.org/index.php?topic=5499439.msg64308723#msg64308723.

Why can't the client, by default, not allow joining a coordinator with these ridiculous settings?

[dkbit98]

Why can't the client, by default, not allow joining a coordinator with these ridiculous settings?

One Wasabi developer Lucas posted that one Wasabi release was replaced with fake installer and they are investigating issue.
I would recommend everyone to STOP using Wasabi wallet and all coordinators asap or you could lose your coins.
https://x.com/lontivero/status/1810835747324448989

BinaryWatch also confirmed that Wasabi Wasabi-2.0.8.1 had checksum changed!
This is a good reminder why we need to always verify release when we download latest version of software.

🚨💣🚨 1720569731: Wasabi-2.0.8.1.msi -> Checksum changed! e10c4bc3ed4306cc6e499e64eca4fadb051f335710e3c6e40ce1354061e1768f (calculated) 1d112fa7db1f17a2bbb39bbf8bb30aa758baa425ad7e4248e71c2bd13fec6797 (stored)

https://x.com/BinaryWatchBot/status/1810826829940326846

And STOP using Kruw centralized coordinator hypocrite who is doing money laundering scam!

Kruw centralized coordinator crap appears to be directly connected with scammer who hacked several exchanges MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc.
This is direct money laundering and now we can say that Kruw is also a scammer and criminal, and that is much worse than all his unproved scam accusations against bitcointalk members.
We also found out that many of wasabi centralized coordinators are just another way of attack on bitcoin users.

wabisabi coinjoin tx:
https://mempool.space/tx/538a97650fc877efcaf55fd36d8e06a675873284a160efbaf59c60f7880ae750

kruw coordinator used:
https://wasabist.io/8/95e809d3c00fd3beaddef141b021ddaab64dbf23f3a74035a5b983f8894cf77c

Source:
https://x.com/1440000bytes/status/1810923857584242755

[examplens]

One Wasabi developer Lucas posted that one Wasabi release was replaced with fake installer and they are investigating issue.
I would recommend everyone to STOP using Wasabi wallet and all coordinators asap or you could lose your coins.

Well, this escalated quickly.
Wasabi has just announced a new release 2.1.0, with an indication that everyone using coordinators should do a mandatory update.

- Advanced send workflow with coin control
- Coordinator Connection String
- Security improvements
- New look for the website

Full release notes & Download: https://github.com/WalletWasabi/WalletWasabi/releases/tag/v2.1.0.0

https://x.com/wasabiwallet/status/1811035230947402177

[Kruw]

That's probably the malicious coordinator: https://bitcointalk.org/index.php?topic=5499439.msg64308723#msg64308723.

Why can't the client, by default, not allow joining a coordinator with these ridiculous settings?

The new version now sets a default minimum input count of 21.

If a coordinator is running many rounds in parallel with low minimum input counts/fast input registration timeouts, you should already be avoiding them altogether since their config isn't making good use of scarce block space.

I suppose I should take the opportunity to repeat this advice as well.

[JollyGood]

Regardless of what any of us might think about WasabiWallet and their use of blockchain analysis, they were very fast of the mark with this update almost as soon as they discovered the exploit. I suppose that shows the determination on their part to not let unscrupulous co-ordinators steal from clients that opted to use their wallet rather than an alternative.

 

Well, this escalated quickly.Wasabi has just announced a new release 2.1.0, with an indication that everyone using coordinators should do a mandatory update.

[alani123]

Is there going to be a report on what this "sophisticated" attack was? From what I can see here there was a changed hash from one of the binaries. So was the download server hacked? Was the coordinator hacked through a central point of failure?

Could this have all been prevented if the clients had more common sense settings? I can't understand from what has been posted already. Anyway it's interesting that the Wasabi team is still delivering patches even after they closed their main revenue source. I'll wait for the post mortem.

[Kruw]

Is there going to be a report on what this "sophisticated" attack was? From what I can see here there was a changed hash from one of the binaries. So was the download server hacked? Was the coordinator hacked through a central point of failure?

Could this have all been prevented if the clients had more common sense settings? I can't understand from what has been posted already. Anyway it's interesting that the Wasabi team is still delivering patches even after they closed their main revenue source. I'll wait for the post mortem.

Here's the disclosure of the incident: https://github.com/WalletWasabi/WalletWasabi/discussions/13249

[JollyGood]

What is the latest with regards to your relationship with zkSNACKS? Can you clarify whether you are an employee of the team behind WasabiWallet or are you just someone that proposes code changes and they have no relationship to you and you to them? I asked because when I read in your bio "Contributor to Wasabi Wallet" it does not define the extent of the relationship between you and them.

Here's the disclosure of the incident: https://github.com/WalletWasabi/WalletWasabi/discussions/13249

[Dont Trust Verify]

And STOP using Kruw centralized coordinator hypocrite who is doing money laundering scam!

Kruw centralized coordinator crap appears to be directly connected with scammer who hacked several exchanges MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc.
This is direct money laundering and now we can say that Kruw is also a scammer and criminal, and that is much worse than all his unproved scam accusations against bitcointalk members.
We also found out that many of wasabi centralized coordinators are just another way of attack on bitcoin users.

wabisabi coinjoin tx:
https://mempool.space/tx/538a97650fc877efcaf55fd36d8e06a675873284a160efbaf59c60f7880ae750

kruw coordinator used:
https://wasabist.io/8/95e809d3c00fd3beaddef141b021ddaab64dbf23f3a74035a5b983f8894cf77c

Source:
https://x.com/1440000bytes/status/1810923857584242755

If a nonprofit coordinator is a scam because it was used by a hacker what does that make Jambler which was used by the very same hacker? What does it make those like yourself who profited directly for many months from advertising this mixer?

https://www.talkimg.com/images/2024/07/11/o70r1.jpeg

[Wind_FURY]

That's probably the malicious coordinator: https://bitcointalk.org/index.php?topic=5499439.msg64308723#msg64308723.

Why can't the client, by default, not allow joining a coordinator with these ridiculous settings?

That's the point I was telling Kruw. It might take time before some people/groups running those coordinators to be trusted because they need to build a reputation. I believe a reputation system for coordinators will definitely be needed to guide the community which coordinators are trustworthy, and which of them have high liquidity + unique users.

Is there going to be a report on what this "sophisticated" attack was? From what I can see here there was a changed hash from one of the binaries. So was the download server hacked? Was the coordinator hacked through a central point of failure?

Could this have all been prevented if the clients had more common sense settings? I can't understand from what has been posted already. Anyway it's interesting that the Wasabi team is still delivering patches even after they closed their main revenue source. I'll wait for the post mortem.
 

Obviously there was a hack, or it could also be an inside job. Either of the two. Unless there was an "honest mistake", WHICH will be in itself suspicious.

[alani123]

Wasabi is a high profile target for sure. Obfuscating millions with in dollar value on the daily surely rattles some feathers. Maybe the hackers could have wanted to make people lose faith in such project but made it so it looks like they were after financial gain. Either way I think this whole ordeal is going to make privacy tech more hardened in the long run. But it might take some time for the next step into the privacy revolution.

[Wind_FURY]

Wasabi is a high profile target for sure. Obfuscating millions with in dollar value on the daily surely rattles some feathers. Maybe the hackers could have wanted to make people lose faith in such project but made it so it looks like they were after financial gain. Either way I think this whole ordeal is going to make privacy tech more hardened in the long run. But it might take some time for the next step into the privacy revolution.

A VERY high-profile target, and probably a target that state-level actors want to compromise and make it into their honeypot from which they could compromise more users.

Let's wait for the news post-hack.

[Kruw]

Wasabi is now available for Start9 personal servers! https://marketplace.start9.com/wasabi-webtop?api=community-beta-registry.start9.com&name=Community%20Beta%20Registry

This is a community project developed by https://github.com/remcoros - thank you for the contribution!

[JollyGood]

What about this Kruw?

What is the latest with regards to your relationship with zkSNACKS? Can you clarify whether you are an employee of the team behind WasabiWallet or are you just someone that proposes code changes and they have no relationship to you and you to them? I asked because when I read in your bio "Contributor to Wasabi Wallet" it does not define the extent of the relationship between you and them.

~

[Kruw]

What about this Kruw?

What is the latest with regards to your relationship with zkSNACKS? Can you clarify whether you are an employee of the team behind WasabiWallet or are you just someone that proposes code changes and they have no relationship to you and you to them? I asked because when I read in your bio "Contributor to Wasabi Wallet" it does not define the extent of the relationship between you and them.

zkSNACKs shut down a month ago:

https://blog.wasabiwallet.io/zksnacks-is-discontinuing-its-coinjoin-coordination-service-1st-of-june/

[JollyGood]

According to the blog, zkSNACKs did not shutdown. They simply closed their co-ordinator and they will continue funding WasabiWallet.

What about this Kruw?

What is the latest with regards to your relationship with zkSNACKS? Can you clarify whether you are an employee of the team behind WasabiWallet or are you just someone that proposes code changes and they have no relationship to you and you to them? I asked because when I read in your bio "Contributor to Wasabi Wallet" it does not define the extent of the relationship between you and them.

zkSNACKs shut down a month ago:

https://blog.wasabiwallet.io/zksnacks-is-discontinuing-its-coinjoin-coordination-service-1st-of-june/

[ABCbits]

Wasabi is now available for Start9 personal servers! https://marketplace.start9.com/wasabi-webtop?api=community-beta-registry.start9.com&name=Community%20Beta%20Registry

This is a community project developed by https://github.com/remcoros - thank you for the contribution!

I'm curious, why the website page list Bitcoin Core as dependencies? Does that mean the user who run Wasabi Wallet on Start9 forced to run full node?

[Pmalek]

What about this Kruw?

Perhaps you will have more luck directing that question to Wasabi and zkSNACKs instead of to Kruw if you are really interested in the answer. He has seen it, and there is a reason he isn't answering. If it's not in his interest to answer it, he won't. But even if he does, why would you believe what he says is true or the whole truth?