Exodus Malicious Torrent File ColonelGray: Difference between revisions
(Another 30 minutes complete. All sources merged in. Prevention added.) |
|||
| (14 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
{{ | {{Case Study Under Construction}}[[File:Exodus.jpg|thumb|Exodus]]Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw all funds from their wallet. | ||
== About ColonelGray == | == About ColonelGray == | ||
ColonelGray | ColonelGray is a Reddit user. TBD | ||
After setting up his Exodus wallet, ColonelGray stored a screenshot of his seed phrase. | |||
== About Exodus == | |||
<ref name="exodus-8331" />TBD | |||
== The Reality == | == The Reality == | ||
TBD | |||
== What Happened == | == What Happened == | ||
ColonelGray | ColonelGray downloaded a malicious torrent file onto their computer which stored a screenshot of their seed phrase. The malware was able to retrieve the seed phrase and the attacker was able to extract their funds from the wallet. | ||
{| class="wikitable" | {| class="wikitable" | ||
|+Key Event Timeline - Exodus Malicious Torrent File ColonelGray | |+Key Event Timeline - Exodus Malicious Torrent File ColonelGray | ||
| Line 28: | Line 20: | ||
!Description | !Description | ||
|- | |- | ||
| | |January 2nd, 2022 7:27:02 AM MST | ||
| | |Reddit Comment Posted | ||
|ColonelGray | |ColonelGray shares his main comment on Reddit with the details of what happened in [[Ledger/MetaMask Hack PowerOfTheGods|another loss post by PowerOfTheGods]]<ref name="reddit-8330" />. | ||
|- | |- | ||
| | | | ||
| | | | ||
| | | | ||
|} | |} | ||
== Technical Details == | |||
TBD | |||
== Total Amount Lost == | == Total Amount Lost == | ||
The total amount lost has been estimated at $5,000 USD. | The total amount lost has been estimated at $5,000 USD. | ||
== Immediate Reactions == | == Immediate Reactions == | ||
"Cut to a few months ago and I accident[al]ly clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files." | |||
"So I called it a goodnight and was just grateful I had not suffered for it." | |||
== Ultimate Outcome == | == Ultimate Outcome == | ||
"Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before." | |||
"I immediately wiped all my drives and did a fresh install of windows." | |||
"I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them." | |||
"It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs." | |||
"Perhaps if I had not been so grief stricken I might have acted fast enough." | |||
"So from what I’m hearing, a screenshot is a bad idea. Cool. Good thing I’m a crypto peasant." | |||
"Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK." | |||
=== Post Shared On Reddit === | |||
ColonelGray later shared his post on Reddit<ref name="reddit-8330" />.<blockquote>Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK. | |||
Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files. | |||
So I called it a goodnight and was just grateful I had not suffered for it. | |||
Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before. | |||
I immediately wiped all my drives and did a fresh install of windows. | |||
I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them. | |||
It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs. | |||
Perhaps if I had not been so grief stricken I might have acted fast enough. | |||
But now it is just a cautionary tale, just like the ones I used to read and ignore lol.</blockquote> | |||
== Total Amount Recovered == | == Total Amount Recovered == | ||
| Line 60: | Line 85: | ||
== Ongoing Developments == | == Ongoing Developments == | ||
ColonelGray's story will continue to live on and hopefully warn others about the dangers of saving a screenshot of a seed phrase.<blockquote>"But now it is just a cautionary tale, just like the ones I used to read and ignore lol."</blockquote> | |||
== Individual Prevention Policies == | |||
The situation could have been prevented by properly storing the seed phrase or avoiding running untrusted software in the same environment as the cryptocurrency wallet. Never screenshot the seed phrase. Always store it offline, and only offline. | |||
=== Storage Of Seed Phrase === | |||
The primary problem was in regards to the storage of the seed phrase. The seed phrase should never be stored in any online form such as a screenshot. Instead, all copies of the seed phrase should be stored offline, disconnected from any online devices. | |||
{{Prevention:Individuals:Store Funds Offline}} | |||
=== Execution Of Malware === | |||
In addition, untrusted software was run by ColonelGray. Any environment where cryptocurrency is involved should only have fully trusted and verified software running there. If ColonelGray had exercised more diligence in software downloading, or used a separate computer for their cryptocurrency activity, they would also have avoided this loss. | |||
{{Prevention:Individuals:Always Verify Executables}} | |||
{{Prevention:Individuals:End}} | |||
== Platform Prevention Policies == | |||
Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected. | |||
{{Prevention:Platforms:Cryptocurrency Safety Quiz}} | |||
{{Prevention:Platforms:Establish Industry Insurance Fund}} | |||
{{Prevention:Platforms:End}} | |||
== Regulatory Prevention Policies == | |||
Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected. | |||
{{Prevention:Regulators:Cryptocurrency Education Mandate}} | |||
{{Prevention:Regulators:Establish Industry Insurance Fund}} | |||
{{Prevention:Regulators:End}} | |||
== References == | == References == | ||
<references> | <references> | ||
<ref name="reddit- | <ref name="reddit-7894">[https://www.reddit.com/r/CryptoCurrency/comments/rts1w2/got_compromised_and_lost_over_120k_in_crypto_ama/ Got compromised and lost over $120k in crypto; AMA : CryptoCurrency] (Jun 1, 2022)</ref> | ||
<ref name="reddit-8330">[https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_compromised_and_lost_over_120k_in_crypto_ama/hqxq6tg/ ColonelGray - "I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase... I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond... Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before." - Reddit] (Jul 3, 2022)</ref> | |||
<ref name="exodus-8331">[https://www.exodus.com/ Live charts & portfolio] (Jul 3, 2022)</ref> | |||
</references> | </references> | ||
Latest revision as of 14:52, 30 August 2023
Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw all funds from their wallet.
About ColonelGray
ColonelGray is a Reddit user. TBD
After setting up his Exodus wallet, ColonelGray stored a screenshot of his seed phrase.
About Exodus
[1]TBD
The Reality
TBD
What Happened
ColonelGray downloaded a malicious torrent file onto their computer which stored a screenshot of their seed phrase. The malware was able to retrieve the seed phrase and the attacker was able to extract their funds from the wallet.
| Date | Event | Description |
|---|---|---|
| January 2nd, 2022 7:27:02 AM MST | Reddit Comment Posted | ColonelGray shares his main comment on Reddit with the details of what happened in another loss post by PowerOfTheGods[2]. |
Technical Details
TBD
Total Amount Lost
The total amount lost has been estimated at $5,000 USD.
Immediate Reactions
"Cut to a few months ago and I accident[al]ly clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files."
"So I called it a goodnight and was just grateful I had not suffered for it."
Ultimate Outcome
"Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before."
"I immediately wiped all my drives and did a fresh install of windows."
"I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them."
"It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs."
"Perhaps if I had not been so grief stricken I might have acted fast enough."
"So from what I’m hearing, a screenshot is a bad idea. Cool. Good thing I’m a crypto peasant."
"Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK."
ColonelGray later shared his post on Reddit[2].
Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK.
Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files.
So I called it a goodnight and was just grateful I had not suffered for it.
Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before.
I immediately wiped all my drives and did a fresh install of windows.
I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them.
It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs.
Perhaps if I had not been so grief stricken I might have acted fast enough.
But now it is just a cautionary tale, just like the ones I used to read and ignore lol.
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
Ongoing Developments
ColonelGray's story will continue to live on and hopefully warn others about the dangers of saving a screenshot of a seed phrase.
"But now it is just a cautionary tale, just like the ones I used to read and ignore lol."
Individual Prevention Policies
The situation could have been prevented by properly storing the seed phrase or avoiding running untrusted software in the same environment as the cryptocurrency wallet. Never screenshot the seed phrase. Always store it offline, and only offline.
Storage Of Seed Phrase
The primary problem was in regards to the storage of the seed phrase. The seed phrase should never be stored in any online form such as a screenshot. Instead, all copies of the seed phrase should be stored offline, disconnected from any online devices.
Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...
Execution Of Malware
In addition, untrusted software was run by ColonelGray. Any environment where cryptocurrency is involved should only have fully trusted and verified software running there. If ColonelGray had exercised more diligence in software downloading, or used a separate computer for their cryptocurrency activity, they would also have avoided this loss.
Any time untrusted software is being run is an opportunity for abuse. It is recommended to always interact with cryptocurrency in a fully controlled environment, which is an environment where you have understanding of every piece of software running there. Using a hardware wallet, spare computer with all software wiped, and/or virtual machine with only the needed software greatly reduces your attack surface. Take the time to verify downloaded files come from the correct and expected source and match available hashes if provided. Any time you encounter a new file, always check if it can contain executable code prior to using it.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected.
Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.
Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
Increased user education can help users properly store seed phrases and avoid using the same environment as their active cryptocurrency wallet to download untrusted software. An industry insurance fund can provide assistance for users who are affected.
Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.
Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ Live charts & portfolio (Jul 3, 2022)
- ↑ 2.0 2.1 ColonelGray - "I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase... I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond... Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before." - Reddit (Jul 3, 2022)
Cite error: <ref> tag with name "reddit-7894" defined in <references> is not used in prior text.