Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/wasabiwalletcoordinatoroverchargingfees.php}} {{Unattributed Sources}} Wasabi Wallet Logo/HomepageWasabi Wallet is a bitcoin wallet which supports the privacy maximizing CoinJoin protocol, which helps make it much more challenging to track the origin and destination of bitcoin which go through the wallet. This process relies on a coordinator to assist wit..."

2024-09-18T21:55:04Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/wasabiwalletcoordinatoroverchargingfees.php}} {{Unattributed Sources}} thumb|Wasabi Wallet Logo/HomepageWasabi Wallet is a bitcoin wallet which supports the privacy maximizing CoinJoin protocol, which helps make it much more challenging to track the origin and destination of bitcoin which go through the wallet. This process relies on a coordinator to assist wit..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/wasabiwalletcoordinatoroverchargingfees.php}}
{{Unattributed Sources}}

[[File:Wasabiwallet.jpg|thumb|Wasabi Wallet Logo/Homepage]]Wasabi Wallet is a bitcoin wallet which supports the privacy maximizing CoinJoin protocol, which helps make it much more challenging to track the origin and destination of bitcoin which go through the wallet. This process relies on a coordinator to assist with matching users together, and for that the coordinator will typically receive a small fee. Wasabi Coordinator is one such coordinator, who promised a low fee on their website. However, they were later found to be running a sophisticated attack that maximized their fees beyond what was intended by the Wasabi Wallet software. The Wasabi Wallet software has been updated to resolve the vulnerabilities which allowed them to overcharge to such an extreme amount.<ref name="slowmisthackedarchive-14638" /><ref name="walletwasabigithub-14647" /><ref name="wasabicoordinatorarchive-14648" />

== About Wasabi Wallet ==
"WASABI WALLET The leading Bitcoin wallet for desktop featuring coinjoin. It's free, open-source, and non-custodial. Reclaim your privacy today."

"Wasabi is a non-custodial hot wallet that requires a connection to the internet and cryptocurrency network to work. As a wallet, Wasabi values user privacy and anonymity. This is evident in its built-in CoinJoin, coin control, and Tor integration features that help to keep users and their IP addresses anonymous. This further prevents security breaches and data leaks."

"Wasabi Wallet is an open-source, non-custodial, privacy-focused Bitcoin wallet with built-in coinjoins. It is a piece of software that runs on your computer and helps you to manage your bitcoins. Although Wasabi has some very advanced magic under the hood, it is rather easy to use. You can generate a new set of seed words, or import already existing ones. With Wasabi you can receive bitcoins into your full control, and you can send them to someone else without needing permission from any other person or entity. There is also a powerful auto-coinjoin feature to help obfuscate your transaction history. You can use Wasabi to manage your hardware wallet, and it even connects to your own full node. Of course, Wasabi is libre and open-source, which means you have full control over the software you manage your money with"
== About Wasabi Wallet Coordinator ==
"Wasabi Wallet Coordinator
Made by community for community

Low Fee
The fair and lowest fee - only 0.003% per round

High Volume
Coordinator has own huge capacity for CoinJoin

Zero Logs Policy
We don't store any logs on our server

Trustless
Coordinator doesn't have access to any of your coins by design of Wasabi Wallet"

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Wasabi Wallet Coordinator Overcharging Fees
!Date
!Event
!Description
|-
|June 9th, 2024 4:18:52 PM MDT
|Website Captured
|The Wasabi Coordinator website is found to be online for the first time and advertising the lowest fees.
|-
|June 10th, 2024 3:22:50 AM MDT
|Website Captured
|The Wasabi Coordinator website is found to be online and advertising the lowest fees.
|-
|July 9th, 2024 6:11:00 PM MDT
|Wasabi Wallet Tweet
|Wasabit Wallet tweets a warning about the coordinator who is reported to be slowly siphoning funds from users of the protocol. WasabiCoordinator is accused of slowly siphoning funds through a complex attack. Wasabi Wallet advises anyone using them to stop immediately and assures that a new version of the wallet will be coming soon.
|-
|July 10th, 2024 7:26:31 AM MDT
|Security Incident Post Made
|The Wasabi Wallet team makes a post on Github to highlight the current security incidents which are happening in the wallet. Free coordinators are being attacked through DDOS attcks, which are hard to distinguish from legitimate traffic. An attack happened with one Windows installer binary being changed.
|-
|July 10th, 2024 7:50:00 AM MDT
|Software Release Tweet
|Wasabi Wallet tweets about the latest software version 2.1.0.0, which features security improvements, and encourages all users to upgrade. This links to the security incident post on Github.
|-
|July 10th, 2024 8:52:39 AM MDT
|Website Captured
|The Wasabi Coordinator website is captured as being online, however it returns a white screen. (This may be an issue with the Internet Archive.)
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"According to a message posted by Wasabi Wallet on Twitter, users have reported that a coordinator named WasabiCoordinator is gradually stealing user funds through a complex attack. Wasabi Wallet advises all users connected to this coordinator to immediately stop CoinJoin operations and announces that a new version will be released soon to prevent such attacks. Subsequently, Wasabi Wallet tweeted that there were three types of attacks in this incident: attacks on free coordinators, supply chain (GitHub) compromise, user-targeted attacks."

"We have been informed that a coordinator named WasabiCoordinator is trying to slowly siphon funds from its users using a sophisticated attack. We advise everyone connected to this coordinator to stop coinjoining immediately. We will release a new version soon preventing this."

== Ultimate Outcome ==
"The new iteration of our effort to reduce trust towards coordinators. This update enforces an absolute minimum input count, stricter safeguards and also ensures that parameters used during blame rounds are accepted by the client."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-14638">[https://web.archive.org/web/20240711160134/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Accessed Jul 11, 2024)</ref>

<ref name="walletwasabigithub-14647">[https://github.com/WalletWasabi/WalletWasabi/discussions/13249 July 9th-10th 2024: Wasabi Wallet Security Incident Disclosure · WalletWasabi/WalletWasabi · Discussion #13249 · GitHub] (Accessed Jul 11, 2024)</ref>

<ref name="wasabicoordinatorarchive-14648">[https://web.archive.org/web/20240710145239/https://wasabicoordinator.io/ Wasabi Wallet Coordinator] (Accessed Jul 11, 2024)</ref></references>

Wasabi Wallet Coordinator Overcharging Fees - Revision history