MyEtherWallet Phishing Steals Thousands - Revision history

Azoundria at 16:31, 14 April 2023

2023-04-14T16:31:13Z

← Older revision		Revision as of 10:31, 14 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Myetherwallet.jpg\|thumb\|MyEtherWallet]]MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.		[[File:Myetherwallet.jpg\|thumb\|MyEtherWallet]]MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.
Line 6:		Line 6:
	Those users who clicked the link in the email received would have been redirected to a fake version of the site on a URL which looks extremely similar. Thousands of dollars worth of cryptocurrency (at least $15,000) were stolen in the attack.		Those users who clicked the link in the email received would have been redirected to a fake version of the site on a URL which looks extremely similar. Thousands of dollars worth of cryptocurrency (at least $15,000) were stolen in the attack.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="coinjournal-5874" /><ref name="dearbytesarchive-5875" /><ref name="wesleyneelentwitter-5876" /><ref name="cryptoarchives-7856" />
	<ref name="coinjournal-5874" /><ref name="dearbytesarchive-5875" /><ref name="wesleyneelentwitter-5876" /><ref name="cryptoarchives-7856" />

	== About MyEtherWallet ==		== About MyEtherWallet ==
Line 67:		Line 66:
	!Description		!Description
	\|-		\|-
	\|October 24th, 2017 ~~12:00:00 AM~~		\|October 24th, 2017
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 94:		Line 93:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Cryptocurrency users need to always make sure that they are accessing any downloads directly on the official website. Unless infeasible, it's safer to transfer only a small wallet to any newly downloaded software, and wait prior to moving any significant sums over. (Malicious wallet developers typically sweep funds soon after any deposit is made.) Most blockchain updates are backwards compatible. It's a good idea to always ask trusted friends if you receive news of an update. Never make a rushed decision to download any new wallet software. Store most of your funds offline on a hardware wallet or paper copy, with a backup seed phrase, and set up a multi-sig if you have the technical knowledge to do so properly.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	Cryptocurrency users need to always make sure that they are accessing any downloads directly on the official website. Unless infeasible, it's safer to transfer only a small wallet to any newly downloaded software, and wait prior to moving any significant sums over. (Malicious wallet developers typically sweep funds soon after any deposit is made.) Most blockchain updates are backwards compatible. It's a good idea to always ask trusted friends if you receive news of an update. Never make a rushed decision to download any new wallet software. Store most of your funds offline on a hardware wallet or paper copy, with a backup seed phrase, and set up a multi-sig if you have the technical knowledge to do so properly.		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==

Azoundria at 17:26, 16 February 2023

2023-02-16T17:26:04Z

← Older revision		Revision as of 11:26, 16 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}}
			{{Unattributed Citations}}

	[[File:Myetherwallet.jpg\|thumb\|MyEtherWallet]]MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.		[[File:Myetherwallet.jpg\|thumb\|MyEtherWallet]]MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.
Line 6:		Line 7:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="coinjournal-5874" /><ref name="dearbytesarchive-5875" /><ref name="wesleyneelentwitter-5876" /><ref name="cryptoarchives-7856" />

	== About MyEtherWallet ==		== About MyEtherWallet ==
Line 45:		Line 47:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 67:		Line 68:
	\|-		\|-
	\|October 24th, 2017 12:00:00 AM		\|October 24th, 2017 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 80:		Line 77:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $15,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 91:		Line 88:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 102:		Line 99:

	== References ==		== References ==
	[https://coinjournal.net/news/hackers-stole-15000-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam - Coin Journal] (Jan 18)		<references><ref name="coinjournal-5874">[https://coinjournal.net/news/hackers-stole-15000-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam - Coin Journal] (Jan 18, 2022)</ref>

	[https://web.archive.org/web/20190309053621/https://www.dearbytes.com/blog/cryptocurrency-phishing/ Analysing a Cryptocurrency phishing attack \| Dearbytes] (Jan 21)		<ref name="dearbytesarchive-5875">[https://web.archive.org/web/20190309053621/https://www.dearbytes.com/blog/cryptocurrency-phishing/ Analysing a Cryptocurrency phishing attack \| Dearbytes] (Jan 21, 2022)</ref>

	[https://twitter.com/wesleyneelen/status/922902052434563073 @wesleyneelen Twitter] (Jan 21)		<ref name="wesleyneelentwitter-5876">[https://twitter.com/wesleyneelen/status/922902052434563073 @wesleyneelen Twitter] (Jan 21, 2022)</ref>

	[https://cryptoarchives.org/hackers-stole-over-15000-with-a-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam – Crypto Archives] (May 31)		<ref name="cryptoarchives-7856">[https://cryptoarchives.org/hackers-stole-over-15000-with-a-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam – Crypto Archives] (May 31, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}} MyEtherWalletMyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork. Those users who clicked the link in the email received would have been redir..."

2023-01-24T20:59:35Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}} thumb|MyEtherWalletMyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork. Those users who clicked the link in the email received would have been redir..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/myetherwalletphishingstealsthousands.php}}

[[File:Myetherwallet.jpg|thumb|MyEtherWallet]]MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.

Those users who clicked the link in the email received would have been redirected to a fake version of the site on a URL which looks extremely similar. Thousands of dollars worth of cryptocurrency (at least $15,000) were stolen in the attack.

This is a global/international case not involving a specific country.

== About MyEtherWallet ==
"MEW (MyEtherWallet) is a free, client-side interface helping you interact with the Ethereum blockchain. Our easy-to-use, open-source platform allows you to generate wallets, interact with smart contracts, and so much more."

"Taylor Manahan and Kosala Hemachandra founded MEW (MyEtherWallet) back in 2015, not long after Ethereum was created."

"The domain xn--myetherwalle-9me.com is a Unicode domain which makes it hard to discern from the real domain. The Unicode trick is used in order to make it difficult to distinguish, as shown below. Never played around with the Unicode trick, so had issues to see the differences myself."

"Behind the phishing domain, a myetherwallet.com clone is present (note the weird “t” with a T-comma underneath the letter, my humble respect for the Unicode trick! To bad they use it in a malicious way)."

"On the 24th, security researcher, Wesley Neelen revealed that he was one of the recipients of the phishing email, claiming that the wallet provider was implementing a hard fork update, urging the victims to unlock their accounts using their Keystore Files or private keys, synchronize their wallets and verify their ETH and token balances. By doing all that, one could have exposed their private keys along with providing information on the hackers about his or her wallet balance."

"Received a MyEtherWallet phishing e-mail on a e-mail address only submitted to a @kin_foundation mailinglist."

"We have pushed an update that allows smooth sailing for all the MyEtherWallet users in the process of the upcoming hard fork. To make use of this update we request all users to sign in to their MyEtherWallet accounts and synchronize their wallets for continuous undisturbed use of our services."

"Unlock your account by using your Keystore File (UTC / JSON) or simply use your private key. Only do this using the official MyEtherWallet site!" (Link to their phishing site.)

"The webpage is a one-on-one clone of the real MyEtherWallet.com website. Also, HTTPS was implemented using the free Let’s Encrypt service."

"After analyzing the live log, it became clear that one of the victims wallets lost 42.50 ETH. 42 ETH was equal to $12,577.63 around the time of the phishing attack."

"This morning, the attackers sent 3 times 16.5 ETH ($4,847.37) to 3 different ETH addresses. In other words: the attackers were able to obtain my e-mail address from the Kin Foundation mailing list in some way, performed a very well setup phishing attack and were able to obtain about $15.000 in 2 hours. I contacted the domain register of the Unicode domain. However, this is “bulletproof” hosting provider, not sure whether they will take it offline. Next to this we contacted appropriate authorities to initialize a notice and take down."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - MyEtherWallet Phishing Steals Thousands
!Date
!Event
!Description
|-
|October 24th, 2017 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Cryptocurrency users need to always make sure that they are accessing any downloads directly on the official website. Unless infeasible, it's safer to transfer only a small wallet to any newly downloaded software, and wait prior to moving any significant sums over. (Malicious wallet developers typically sweep funds soon after any deposit is made.) Most blockchain updates are backwards compatible. It's a good idea to always ask trusted friends if you receive news of an update. Never make a rushed decision to download any new wallet software. Store most of your funds offline on a hardware wallet or paper copy, with a backup seed phrase, and set up a multi-sig if you have the technical knowledge to do so properly.

== References ==
[https://coinjournal.net/news/hackers-stole-15000-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam - Coin Journal] (Jan 18)

[https://web.archive.org/web/20190309053621/https://www.dearbytes.com/blog/cryptocurrency-phishing/ Analysing a Cryptocurrency phishing attack | Dearbytes] (Jan 21)

[https://twitter.com/wesleyneelen/status/922902052434563073 @wesleyneelen Twitter] (Jan 21)

[https://cryptoarchives.org/hackers-stole-over-15000-with-a-myetherwallet-phishing-scam/ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam – Crypto Archives] (May 31)