Exodus Malicious Torrent File ColonelGray

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Exodus

Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw all funds from their wallet.

About ColonelGray

ColonelGray is a Reddit user. TBD

After setting up his Exodus wallet, ColonelGray stored a screenshot of his seed phrase.

About Exodus

TBD

The Reality

TBD

What Happened

ColonelGray downloaded a malicious torrent file onto their computer which stored a screenshot of their seed phrase. The malware was able to retrieve the seed phrase and the attacker was able to extract their funds from the wallet.

Key Event Timeline - Exodus Malicious Torrent File ColonelGray

Date	Event	Description
January 2nd, 2022 7:27:02 AM MST	Reddit Comment Posted	ColonelGray shares his main comment on Reddit with the details of what happened in another loss post by PowerOfTheGods.

Technical Details

TBD

Total Amount Lost

The total amount lost has been estimated at $5,000 USD.

Immediate Reactions

"Cut to a few months ago and I accident[al]ly clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files."

"So I called it a goodnight and was just grateful I had not suffered for it."

Ultimate Outcome

"Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before."

"I immediately wiped all my drives and did a fresh install of windows."

"I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them."

"It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs."

"Perhaps if I had not been so grief stricken I might have acted fast enough."

"So from what I’m hearing, a screenshot is a bad idea. Cool. Good thing I’m a crypto peasant."

"Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK."

Post Shared On Reddit

ColonelGray later shared his post on Reddit.

Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK.

Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files.

So I called it a goodnight and was just grateful I had not suffered for it.

Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before.

I immediately wiped all my drives and did a fresh install of windows.

I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them.

It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs.

Perhaps if I had not been so grief stricken I might have acted fast enough.

But now it is just a cautionary tale, just like the ones I used to read and ignore lol.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

ColonelGray's story will continue to live on and hopefully warn others about the dangers of saving a screenshot of a seed phrase.

"But now it is just a cautionary tale, just like the ones I used to read and ignore lol."

Individual Prevention Policies

The situation could have been prevented by properly storing the seed phrase or avoiding running untrusted software in the same environment as the cryptocurrency wallet. Never screenshot the seed phrase. Always store it offline, and only offline.

Storage Of Seed Phrase

The primary problem was in regards to the storage of the seed phrase. The seed phrase should never be stored in any online form such as a screenshot. Instead, all copies of the seed phrase should be stored offline, disconnected from any online devices.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

Execution Of Malware

In addition, untrusted software was run by ColonelGray. Any environment where cryptocurrency is involved should only have fully trusted and verified software running there. If ColonelGray had exercised more diligence in software downloading, or used a separate computer for their cryptocurrency activity, they would also have avoided this loss.

Any time untrusted software is being run is an opportunity for abuse. It is recommended to always interact with cryptocurrency in a fully controlled environment, which is an environment where you have understanding of every piece of software running there. Using a hardware wallet, spare computer with all software wiped, and/or virtual machine with only the needed software greatly reduces your attack surface. Take the time to verify downloaded files come from the correct and expected source and match available hashes if provided. Any time you encounter a new file, always check if it can contain executable code prior to using it.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.