The Importance of Using a Private Server in Electrum Wallet

[AakZaki]

On September 1st, a friend from my local Indonesia, admitted that he had lost his Bitcoin as much as 1.21246839 BTC, but after he found the explanation in this link https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v he realized that it was caused by the Electrum Server, because the incident was exactly the same as described in the link.

In addition, he also showed another link that also explained a similar case to him that occurred 3 years ago here https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

And currently I read another similar case that happened on October 28 yesterday, which resulted in the loss of 0.87492841 BTC here https://www.reddit.com/r/Bitcoin/comments/1xjfa5i/lost_70k_usd_085btc_due_to_electrum_rbf_security/

After an incident like the case above, there is actually no longer a reason to use the Electrum Public Server randomly, because in the Electrum Wallet there are a lot of Public Servers that we don't even recognize or even one of them is a Malicious Server that we are not aware of.


I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

[Zaguru12]

I think this particular is very much related to the reason for this new electrum update as it was explained on this thread: Electrum 4.8.3. This release fixes a critical security issue it’s an RBF related problem although it has been fixed but it’s best to take caution first is to always verify the recipient address when carrying out RBF or before bumping any transaction one should also check the TXID using any block explorer to actually verify if the transaction was actually propagated by the connected node because usually such transactions are not propagated and on the block explorer it will show in invalid transaction.

Although the best option still remains running your own server but if it’s complex I think one of the best resolution will be maybe one should start connecting to servers of reputable members here it is much better to connecting to just any random server

[BitMaxz]

Most of the Electrum servers nowadays are IPs; it's too risky to connect to any of these. That is why I only do it manually and connect to a well-known one, and another layer of my protection against them only uses them for the watch, not the wallet. Meaning my real wallet never reaches the internet, and I only use them to monitor my wallet and create unsigned transactions and broadcast my transaction manually to mempool.space and sometimes to ViaBTC.

Like the above, if it was the same issue as the previous post here on the forum related to a critical issue on a few Electrum servers, those who had cold storage wallets won't easily be infected from those online attacks. That is why having two separate devices is a must; at least the watch-only wallet is the one that will suffer from any attacks that come from other sources online. Your offline wallet is completely protected from these attacks.

[pooya87]

I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

The only problem with this solution is that majority of people who choose a light wallet cannot or do not want to run a full node, so I doubt if they could spend money to run a full node on a remote server just so that they could connect their local light wallet to it.

But if anybody can do it then the best solution is to run their own full node locally (on their own machine) if they want maximum security and privacy.

[nc50lc]

In addition, he also showed another link that also explained a similar case to him that occurred 3 years ago here https://www.reddit.com/r/Electrum/comments/1ccrfop/transaction_replaced_to_scammer_wallet/

Holy cow, that's 3 years ago and it's surprising that it's never been found until recently when one user reported his case.
There're probably more undocumented or mislead cases since the issue had been there ever since opt-in-rbf is implemented in Electrum.

One reason of its elusiveness was probably,
most tech savvy users tend to use their own Electrum server or haven't set to randomize their server selection method.
Regular joe victims are most probably brushed off to thinking that they're just hacked or it's a clipboard hijacking virus/malware.

[ABCbits]

I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

FWIW, the complexity can be reduced if you use more user-friendly OS (such as Umbrel), assuming you trust whoever create and maintain the OS. As for the cost to buy device capable to run both full node and Electrum server, it can be reduced if you're willing to risk buying used computer, laptop and other parts.

But i understand people wouldn't even consider it, unless amount of coin they own is a lot higher than cost to buy such capable device.

[FinneysTrueVision]

Code:

bc1qzzm384q8hxwlqckjlft3prrac0vccqq7x750kw - Alamat Hacker
sent to
bc1percchvk7ts3act9zcwggz9vvw7fj5l08uzfkxa3vn0hsjv6vlaws2z8dg2
bc1pjln2tr7zsystyfgnff59saydquu00x742uqsa7fxpj0ejsfpy8ws6fv3gx
bc1pznvxgtuppvjwn7526tjxecnew22cjv64d2qgd3h0d2u9yf35pknqh8u4rd
sent to 
bc1q62xgxfs990ntrw87c6nuqw9j53ln7t2ue23dhvr9sgv2ptyfh59qvt7sun
sent to
bc1qv8f0y5cdy5vrj9yt6j28pum8umckawxj88kqaf
sent to
3Cy2Q9w7cpCND8AoMM9hDVujP6RQmBaThP - Coinbase Hub dalam penyebutan di gambar OP.

By the way, your tracing on the stolen funds wasn’t entirely correct. The first hop are deposit addresses belonging to Symbiosis Finance. You can search the hackers address on https://explorer.symbiosis.finance/transactions?search=bc1qzzm384q8hxwlqckjlft3prrac0vccqq7x750kw

The funds were swapped to ETH with the ultimate destination leading to various Kucoin deposit addresses including:
0xF9BEb63F84d90cDA174D7C2A25015149873cD3bf
0xD69f07C15EBd87F35b51E5fCE00e6eC337a8fED6

The stolen funds from the Reddit users were also sent to Kucoin.

[AakZaki]

I think the most sensible solution right now is to use a Private Server and Electrum Wallet running on Linux, but this setup is quite complex and requires large resources such as storage space. But what does all that mean, for the sake of the security of our assets.

FWIW, the complexity can be reduced if you use more user-friendly OS (such as Umbrel), assuming you trust whoever create and maintain the OS. As for the cost to buy device capable to run both full node and Electrum server, it can be reduced if you're willing to risk buying used computer, laptop and other parts.

Honestly bro, the BTC hack that happened in the last few months has made me paranoid, so I think it's hard to trust a third-party tool for this BTC asset deal.
And to be honest I've been running private servers and Electrum wallets on linux, which is why I said that the setup is so complex because I've experienced it.

Code:

bc1qzzm384q8hxwlqckjlft3prrac0vccqq7x750kw - Alamat Hacker
sent to
bc1percchvk7ts3act9zcwggz9vvw7fj5l08uzfkxa3vn0hsjv6vlaws2z8dg2
bc1pjln2tr7zsystyfgnff59saydquu00x742uqsa7fxpj0ejsfpy8ws6fv3gx
bc1pznvxgtuppvjwn7526tjxecnew22cjv64d2qgd3h0d2u9yf35pknqh8u4rd
sent to 
bc1q62xgxfs990ntrw87c6nuqw9j53ln7t2ue23dhvr9sgv2ptyfh59qvt7sun
sent to
bc1qv8f0y5cdy5vrj9yt6j28pum8umckawxj88kqaf
sent to
3Cy2Q9w7cpCND8AoMM9hDVujP6RQmBaThP - Coinbase Hub dalam penyebutan di gambar OP.

By the way, your tracing on the stolen funds wasn’t entirely correct. The first hop are deposit addresses belonging to Symbiosis Finance. You can search the hackers address on https://explorer.symbiosis.finance/transactions?search=bc1qzzm384q8hxwlqckjlft3prrac0vccqq7x750kw

Regardless of whether that's true or not, I actually read those BTC flows in the Arkham data as follows:


That scenario I created, referring to the victim thread that shows this address 3Cy2Q9w7cpCND8AoMM9hDVujP6RQmBaThP (Coinbase Hub) and that is in line with this rumbling BTC flow

[Chikito]

Your offline wallet is completely protected from these attacks.

It's not really actually, because after signing (offline), we need to broadcast (online) to send the transaction, which can be a loophole to change to a new hacker address.
When I read how that happens, it happens when broadcasting. So, to mitigate it, it's better to triple-check the send address both offline and online.

Server issues have been a problem for a long time; rogue servers are flooding on the server and making notifications to cancel transactions to update fake Electrum or send phishing sites. [1]

[1]. https://bitcointalk.org/index.php?topic=5090097.0

[hosemary]

It's not really actually, because after signing (offline), we need to broadcast (online) to send the transaction, which can be a loophole to change to a new hacker address.

That's not possible. If you change anything in the transaction data, the signature will become invalid and you will need to sign it again.
If it was possible to change the receiving address that way, Bitcoin would be worth zero now.

[DireWolfM14]

lost his Bitcoin as much as 1.21246839 BTC

Realistically, even if he only held a tenth of that amount it's worth investing a portion of it into a cheap computer and 2TB SSD to run his own server.   Sometimes it really boggles the mind to see people being so lackadaisical about their own safety, security, and privacy.

FWIW, the complexity can be reduced if you use more user-friendly OS (such as Umbrel), assuming you trust whoever create and maintain the OS. As for the cost to buy device capable to run both full node and Electrum server, it can be reduced if you're willing to risk buying used computer, laptop and other parts.

But i understand people wouldn't even consider it, unless amount of coin they own is a lot higher than cost to buy such capable device.

I have stopped using umbrel myself, and even when I did use it I ran it mostly as a side project to goof around with and never really relied on it as my main node.  That being said, everything runs in docker containers and if you're comfortable poking around in them you can verify all the configurations in each container.  Although, if you have that kind of knowledge, it's easier and faster to just set up the two (bitcoin core and romanz electrs) packages you need.  The hardware needs are the same regardless.

As for the hardware; I think it's easier to trust a used computer purchased from some one who has no idea what you want to do with than trusting a node specific OS.  Flashing the bios and installing a new hard drive would resolve most of any malicious stuff anyone could put on it.  Tinkering with the hardware of a computer just to sell it to someone who might do something with bitcoin on it is a roll of the dice for someone who wants to steal your bitcoin.  There are more practical ways for a hacker to invest his time.  And if you're that paranoid, buy a new micro PC.  They can be found for as little as $200.  The 2TB nvme drive will cost you more than that.  In the end, it's all worth it.