Electrum Phishing Attack Funds Stolen Cryptbtcaly - Revision history

Azoundria at 16:11, 2 May 2023

2023-05-02T16:11:46Z

← Older revision		Revision as of 10:11, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Electrum.jpg\|thumb\|Electrum]]Electrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the bitcoind software. To assist with usability, formatted text is allowed as output.		[[File:Electrum.jpg\|thumb\|Electrum]]Electrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the bitcoind software. To assist with usability, formatted text is allowed as output.
Line 10:		Line 10:
	Over $1m USD worth of bitcoin was successfully taken from Cryptbtcaly. There is no evidence that any of these funds were ever recovered.		Over $1m USD worth of bitcoin was successfully taken from Cryptbtcaly. There is no evidence that any of these funds were ever recovered.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="spesmilogithub-8398" /><ref name="spesmilogithub-8399" /><ref name="blockchair-8400" /><ref name="cointelegraph-8401" /><ref name="electrum-7965" /><ref name="flathub-8372" /><ref name="sourceforge-8373" /><ref name="download-8374" /><ref name="thecoinspost-8375" /><ref name="decrypt-8402" /><ref name="cryptonews-8403" /><ref name="antidolos-8404" />
	<ref name="spesmilogithub-8398" /><ref name="spesmilogithub-8399" /><ref name="blockchair-8400" /><ref name="cointelegraph-8401" /><ref name="electrum-7965" /><ref name="flathub-8372" /><ref name="sourceforge-8373" /><ref name="download-8374" /><ref name="thecoinspost-8375" /><ref name="decrypt-8402" /><ref name="cryptonews-8403" /><ref name="antidolos-8404" />

	== About Electrum ==		== About Electrum ==
Line 67:		Line 66:
	!Description		!Description
	\|-		\|-
	\|July 6th, 2020 1:55:00 PM		\|July 6th, 2020 1:55:00 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 75:		Line 74:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 94:		Line 96:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	Always bookmark the official links of every service which you use. Never download an update from any other location, even if prompted within the software. If you suspect that the official website of a service has changed, check with friends or post online to see if the link is moved.		Always bookmark the official links of every service which you use. Never download an update from any other location, even if prompted within the software. If you suspect that the official website of a service has changed, check with friends or post online to see if the link is moved.

	Whenever you complete a wallet upgrade or install a new wallet software, always try the new setup first with a smaller wallet and amount. It is recommended to keep the vast majority of funds fully offline in a cold storage wallet with no keys ever stored online.		Whenever you complete a wallet upgrade or install a new wallet software, always try the new setup first with a smaller wallet and amount. It is recommended to keep the vast majority of funds fully offline in a cold storage wallet with no keys ever stored online.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==

Azoundria at 17:19, 17 February 2023

2023-02-17T17:19:24Z

← Older revision		Revision as of 11:19, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}}
			{{Unattributed Citations}}

	[[File:Electrum.jpg\|thumb\|Electrum]]Electrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the bitcoind software. To assist with usability, formatted text is allowed as output.		[[File:Electrum.jpg\|thumb\|Electrum]]Electrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the bitcoind software. To assist with usability, formatted text is allowed as output.
Line 10:		Line 11:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="spesmilogithub-8398" /><ref name="spesmilogithub-8399" /><ref name="blockchair-8400" /><ref name="cointelegraph-8401" /><ref name="electrum-7965" /><ref name="flathub-8372" /><ref name="sourceforge-8373" /><ref name="download-8374" /><ref name="thecoinspost-8375" /><ref name="decrypt-8402" /><ref name="cryptonews-8403" /><ref name="antidolos-8404" />

	== About Electrum ==		== About Electrum ==
Line 45:		Line 47:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 67:		Line 68:
	\|-		\|-
	\|July 6th, 2020 1:55:00 PM		\|July 6th, 2020 1:55:00 PM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 80:		Line 77:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $1,250,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 91:		Line 88:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 104:		Line 101:

	== References ==		== References ==
	[https://github.com/spesmilo/electrum/issues/5072 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jun 6)		<references><ref name="spesmilogithub-8398">[https://github.com/spesmilo/electrum/issues/5072 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jun 6, 2022)</ref>

	[https://github.com/spesmilo/electrum/issues/5072#issuecomment-683666105 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jul 7)		<ref name="spesmilogithub-8399">[https://github.com/spesmilo/electrum/issues/5072#issuecomment-683666105 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jul 7, 2022)</ref>

	[https://blockchair.com/bitcoin/transaction/34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e Bitcoin / Transaction / 34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e — Blockchair] (Jul 7)		<ref name="blockchair-8400">[https://blockchair.com/bitcoin/transaction/34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e Bitcoin / Transaction / 34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e — Blockchair] (Jul 7, 2022)</ref>

	[https://cointelegraph.com/news/another-electrum-user-is-claiming-that-their-coins-were-stolen Another Electrum user is claiming that their coins were stolen] (Jul 7)		<ref name="cointelegraph-8401">[https://cointelegraph.com/news/another-electrum-user-is-claiming-that-their-coins-were-stolen Another Electrum user is claiming that their coins were stolen] (Jul 7, 2022)</ref>

	[https://electrum.org/ Electrum Bitcoin Wallet] (Jun 7)		<ref name="electrum-7965">[https://electrum.org/ Electrum Bitcoin Wallet] (Jun 7, 2022)</ref>

	[https://flathub.org/apps/details/org.electrum.electrum Flathub—An app store and build service for Linux] (Jul 7)		<ref name="flathub-8372">[https://flathub.org/apps/details/org.electrum.electrum Flathub—An app store and build service for Linux] (Jul 7, 2022)</ref>

	[https://sourceforge.net/software/product/Electrum/ Electrum Reviews and Pricing 2022] (Jul 7)		<ref name="sourceforge-8373">[https://sourceforge.net/software/product/Electrum/ Electrum Reviews and Pricing 2022] (Jul 7, 2022)</ref>

	[https://download.cnet.com/Electrum/3000-2057_4-77334219.html Electrum - Free download and software reviews - CNET Download] (Jul 7)		<ref name="download-8374">[https://download.cnet.com/Electrum/3000-2057_4-77334219.html Electrum - Free download and software reviews - CNET Download] (Jul 7, 2022)</ref>

	[https://www.thecoinspost.com/bitcoin-user-losses-16-2-million-in-btc-after-using-an-old-electrum-wallet/ Bitcoin User Losses $16.2 Million in BTC After Using an Old Electrum Wallet - TheCoinsPost] (Jul 7)		<ref name="thecoinspost-8375">[https://www.thecoinspost.com/bitcoin-user-losses-16-2-million-in-btc-after-using-an-old-electrum-wallet/ Bitcoin User Losses $16.2 Million in BTC After Using an Old Electrum Wallet - TheCoinsPost] (Jul 7, 2022)</ref>

	[https://decrypt.co/40408/another-bitcoiner-claims-he-lost-430000-in-electrum-wallet-scam Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam - Decrypt] (Jul 7)		<ref name="decrypt-8402">[https://decrypt.co/40408/another-bitcoiner-claims-he-lost-430000-in-electrum-wallet-scam Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam - Decrypt] (Jul 7, 2022)</ref>

	[https://cryptonews.net/news/security/372372/ Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam] (Jul 7)		<ref name="cryptonews-8403">[https://cryptonews.net/news/security/372372/ Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam] (Jul 7, 2022)</ref>

	[https://antidolos.com/electrum-wallet-still-under-phishing-attack/ Electrum wallet still under phishing attack - Antidolos -Latest Blockchain News] (Jul 7)		<ref name="antidolos-8404">[https://antidolos.com/electrum-wallet-still-under-phishing-attack/ Electrum wallet still under phishing attack - Antidolos -Latest Blockchain News] (Jul 7, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}} ElectrumElectrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the..."

2023-01-25T17:34:31Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}} thumb|ElectrumElectrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/electrumphishingattackfundsstolencryptbtcaly.php}}

[[File:Electrum.jpg|thumb|Electrum]]Electrum was a highly popular wallet software for bitcoin. Since Electrum operates in a decentralized manner, anyone can set up a node. On older versions of the client, if a user connects to a node and tries to make a transaction, the node may report an error, typically a string which is passed through from the bitcoind software. To assist with usability, formatted text is allowed as output.

Users of the Electrum wallet came under an elaborate phishing attack. Malicious operators set up a large number of Electrum nodes across a diverse range of IP addresses. When users would connect to these nodes and attempt to send a transaction, they would receive back an error message that informed them of the need to upgrade their Electrum wallet to "v3.4.1", which had an "important security update" that "provides a fix for a transaction deserialization vulnerability". The update was available from the open source "electrum-project" Github repository, which beared a striking resemblance to the official Electrum Github repository.

The message was grammatically correct and the link went to a legitimate Github repository on the Github website. Users who failed to carefully check the exact URL of the Github repository or carefully review the repository ownership would have been convinced they were installing a legitimate update to their Electrum wallet. It appears that the update made the private key of any wallets available to the attackers, who could then spend freely from their new-found coins.

Over $1m USD worth of bitcoin was successfully taken from Cryptbtcaly. There is no evidence that any of these funds were ever recovered.

This is a global/international case not involving a specific country.

== About Electrum ==
"Securing Bitcoin payments since 2011, Electrum is one of the most popular Bitcoin wallets. Electrum is fast, secure and easy to use. It suits the needs of a wide spectrum of users." "Electrum verifies that your transactions are in the Bitcoin blockchain. Because Bitcoin is not about trust, It is about freedom and independence." "Sign transactions from a computer that is always offline. Broadcast them from a machine that does not have your keys" "Be safe from malware. Use two-factor authentication by Electrum and Trustedcoin."

"Electrum is free software. Released under the MIT License. Anyone can run an Electrum server. No single entity controls the network." "Electrum has various user interfaces. It can be used on mobile, desktop or with the command line interface." "Electrum supports hardware wallets: Ledger, Trezor, Keepkey" "Split the permission to spend your bitcoins between several wallets."

"Electrum is a light client, which means it must connect to the blockchain through a server, which by default is chosen from a list of public Electrum servers. Anyone can operate such a public server and some users will be randomly connected to it."

"You can specify a specific server to connect to, but by default, it connects to a random peer. There are no "authorized servers". By design, they cannot interfere with bitcoin transactions made by clients except: 1) lie about account balances and 2) not relay a valid transaction to the rest of the network. The problem here is it's messaging capability that communicates directly with it's connected clients. There is no authenticity of any messages created by any statum servers - only what the manager of that server wants to say."

"Electrum, a wallet service like Blockchain.com, has been plagued with several phishing attacks. The issues have dated back to 2018, with accounts confirming that hackers had stolen almost $1 million in cryptocurrencies from users."

"The hacker setup a whole bunch of malicious servers. If someone's Electrum Wallet connected to one of those servers, and tried to send a BTC transaction, they would see an official-looking message telling them to update their Electrum Wallet, along with a scam URL."

"Hello. I had a similar situation 2 months ago. 36.5 Bitcoin was stolen from my address."

"The user claimed someone pilfered 36.5 BTC from one of their wallet addresses. The BTC reportedly ended up spread across five different addresses."

"Some of the stolen Bitcoin went to Binance, but they ignore my appeals and do not return. Cover up fraudsters."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Electrum Phishing Attack Funds Stolen Cryptbtcaly
!Date
!Event
!Description
|-
|July 6th, 2020 1:55:00 PM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Always bookmark the official links of every service which you use. Never download an update from any other location, even if prompted within the software. If you suspect that the official website of a service has changed, check with friends or post online to see if the link is moved.

Whenever you complete a wallet upgrade or install a new wallet software, always try the new setup first with a smaller wallet and amount. It is recommended to keep the vast majority of funds fully offline in a cold storage wallet with no keys ever stored online.

== References ==
[https://github.com/spesmilo/electrum/issues/5072 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jun 6)

[https://github.com/spesmilo/electrum/issues/5072#issuecomment-683666105 BTC Stolen · Issue #5072 · spesmilo/electrum · GitHub] (Jul 7)

[https://blockchair.com/bitcoin/transaction/34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e Bitcoin / Transaction / 34ce7a78c6379d3176200deffd26798901dba1c726663e177d6ca9c1cf18643e — Blockchair] (Jul 7)

[https://cointelegraph.com/news/another-electrum-user-is-claiming-that-their-coins-were-stolen Another Electrum user is claiming that their coins were stolen] (Jul 7)

[https://electrum.org/ Electrum Bitcoin Wallet] (Jun 7)

[https://flathub.org/apps/details/org.electrum.electrum Flathub—An app store and build service for Linux] (Jul 7)

[https://sourceforge.net/software/product/Electrum/ Electrum Reviews and Pricing 2022] (Jul 7)

[https://download.cnet.com/Electrum/3000-2057_4-77334219.html Electrum - Free download and software reviews - CNET Download] (Jul 7)

[https://www.thecoinspost.com/bitcoin-user-losses-16-2-million-in-btc-after-using-an-old-electrum-wallet/ Bitcoin User Losses $16.2 Million in BTC After Using an Old Electrum Wallet - TheCoinsPost] (Jul 7)

[https://decrypt.co/40408/another-bitcoiner-claims-he-lost-430000-in-electrum-wallet-scam Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam - Decrypt] (Jul 7)

[https://cryptonews.net/news/security/372372/ Another Bitcoiner Claims He Lost $430,000 in Electrum Wallet Scam] (Jul 7)

[https://antidolos.com/electrum-wallet-still-under-phishing-attack/ Electrum wallet still under phishing attack - Antidolos -Latest Blockchain News] (Jul 7)