|
|
| Line 1: |
Line 1: |
| [[File:Exodus.jpg|thumb|Exodus]]Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent screensaver file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase screenshot and using it to withdraw from their wallet. | | {{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/exodusmalicioustorrentfilecolonelgray.php}} |
| | {{Unattributed Sources}} |
| | |
| | [[File:Exodus.jpg|thumb|Exodus]]Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw from their wallet. |
| | |
| | This is a global/international case not involving a specific country.<ref name="reddit-7894" /><ref name="reddit-8330" /><ref name="exodus-8331" /> |
|
| |
|
| == About Exodus == | | == About Exodus == |
| Exodus is an online web wallet which allows the storage of over 260 cryptocurrencies as well as NFTs<ref name=":0">[https://www.exodus.com/ Best Crypto Wallet for Desktop & Mobile: Altcoin & Bitcoin | Exodus] (Jul 3, 2022)</ref>.<blockquote>"Exodus Bitcoin & Crypto Wallet - Manage and swap 260+ cryptos and NFTs on your web browser, mobile, desktop, and hardware wallets."</blockquote>All user assets are stored within the wallet and backed by a seed phrase, which the user is required to secure<ref name=":0" /><ref name=":1">[https://www.exodus.com/support/article/925-everything-you-need-to-know-about-the-secret-recovery-phrase Everything you need to know about your 12-word secret recovery phrase - Exodus Website] (Feb 28, 2023)</ref>.<blockquote>Your secret recovery phrase is the key to your wallet and controls access to all your funds, so write it down and keep it safe!
| | "Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK." |
| | |
| | "So from what I’m hearing, a screenshot is a bad idea. Cool. Good thing I’m a crypto peasant." |
|
| |
|
| Exodus users are responsible for storing their own recovery phrase. If the recovery phrase is lost, the user might not be able to retrieve their private keys.</blockquote>
| | "Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files." |
|
| |
|
| == About ColonelGray ==
| | "So I called it a goodnight and was just grateful I had not suffered for it." |
| ColonelGray has been an active long-time user of Reddit since 2018<ref>[https://old.reddit.com/r/Tinder/comments/7vpton/the_one_that_got_away/ ColonelGray - "The one that got away" - Reddit] (Mar 1, 2023)</ref>. He reports himself to be from Britain<ref>[https://old.reddit.com/r/AskReddit/comments/jhbli1/aliens_come_to_earth_one_of_them_asks_you_hey_you/g9yq6iu/ ColonelGray - "I'm British" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/britishproblems/comments/112aayb/theres_not_one_person_in_this_country_who_is/j8m4jm7/ ColonelGray - "My neighbour keeps the whole street up with his Hornby train set and Warhammer collection." - Reddit] (Mar 1, 2023)</ref><ref name=":4">[https://old.reddit.com/r/covidlonghaulers/comments/xxvori/deleted_by_user/irfm9z3/ ColonelGray - "I live in the UK." - Reddit] (Mar 1, 2023)</ref> (likely Wales<ref>[https://old.reddit.com/r/Wales/comments/vo277p/stay_classy_swansea/ieb5fxg/ ColonelGray - "Always sad seeing one by itself." - Reddit] (Mar 1, 2023)</ref>), 31 years of age as of November 20th, 2022<ref name=":5">[https://old.reddit.com/r/HPylori/comments/yzlxef/if_this_isnt_hpylori_then_what_is_it_that_makes/ix32ju1/ ColonelGray - "I've been run down for years." - Reddit] (Mar 1, 2023)</ref>, and a Covid long-hauler<ref name=":4" /><ref name=":6">[https://old.reddit.com/r/relationship_advice/comments/j2e7af/my_mom_said_we_should_all_get_covid/g765ape/ ColonelGray - "collapsed from fatigue on the 14th of march. I'm still weak" - Reddit] (Mar 1, 2023)</ref> with a background working in hospitality<ref>[https://old.reddit.com/r/CryptoCurrency/comments/rkkew5/are_you_invested_in_crypto_cool_dont_be_a_vegan/hpabs1h/ ColonelGray - "someone who has worked in hospitality for years" - Reddit] (Feb 28, 2023)</ref>. He is highly open online about his dating life<ref>[https://old.reddit.com/r/averagedickproblems/comments/iudwym/trying_to_be_okay_with_not_being_the_biggest/g5kiftr/ ColonelGray - "I'm in pretty much the same boat as you." - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/OnlineDating/comments/11c5eso/just_got_into_online_dating_for_the_first_time/ja30cth/ ColonelGray - "Tinder gives you a 'newb boost' when you first join." - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/OnlineDating/comments/wwvyx6/what_would_be_your_ideal_dating_app/ilpuxp4/ ColonelGray - "I would like an app that puts a cap on the number of simultaneous matches you can have." - Reddit] (Mar 1, 2023)</ref>, health<ref name=":6" /><ref name=":7">[https://old.reddit.com/r/HPylori/comments/10w5vwi/is_it_possible_to_get_a_false_negative_on_a_stool/j7ow3gg/ ColonelGray - "I've had nothing but false negatives" - Reddit] (Mar 1, 2023)</ref><ref name=":5" />, and self image<ref name=":8">[https://old.reddit.com/r/AskReddit/comments/gw9oke/when_did_you_stop_giving_a_fuck_and_why/fsugep2/ ColonelGray - "I've always been the friend who would be picked last" - Reddit] (Mar 1, 2023)</ref>. He actively plays and discusses video games including Company of Heroes<ref>[https://old.reddit.com/r/CompanyOfHeroes/comments/i5kg5z/haha_planes_go_boom_boom/g0qc1xf/ ColonelGray - "In one of the best games I had" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/CompanyOfHeroes/comments/11ee3j9/its_unbelievable_people_try_to_claim_axis_are/jah0kgb/ ColonelGray - "it does feel like 1v1 players are over represented in regards to balance" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/CompanyOfHeroes/comments/krrxc0/is_it_time_to_finally_return_what_is_the_state_of/gicyj1j/ ColonelGray - "It's still my favourite game." - Reddit] (Mar 1, 2023)</ref>, Age of Empires 4<ref>[https://old.reddit.com/r/aoe4/comments/10v6q0c/sometimes_it_do_be_like_that/j7ly8mc/ ColonelGray - "That's just the basic dynamic of a premade team vs randoms" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/aoe4/comments/10qk5yj/i_dont_have_a_problem_with_the_matchmaking/j6rptnt/ ColonelGray - "once you try out 3v3/4v4 it starts getting a bit out of hand" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/aoe4/comments/yph8gb/numeric_player_names/ivk6ixx/ ColonelGray - "In team games they usually" - Reddit] (Mar 1, 2023)</ref>, Hunt: Showdown<ref>[https://old.reddit.com/r/HuntShowdown/comments/10vi79c/duos_and_trios_angry_that_they_cant_just_roll/j7kmtco/ ColonelGray - "as a duo player I think I should be allowed the option" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/HuntShowdown/comments/y5urzg/no_anticamping_method_the_devs_ever_introduce/isngxa3/ ColonelGray - "Starting to think a beetle found the compound" - Reddit] (Mar 1, 2023)</ref>, Warhammer 40k<ref>[https://old.reddit.com/r/Warhammer40k/comments/z95mhc/so_i_made_a_thing/iyh4fvd/ ColonelGray - "not the wolf bayonet and conceal carry wolf crotch defence apparatus" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/Warhammer40k/comments/ww9unz/darktide_looks_cool_and_all_but_for_the_love_of/ills613/ ColonelGray - "IG vs Blood Pact would be the best starting point for a game like that I think." - Reddit] (Mar 1, 2023)</ref>, Foxhole<ref>[https://old.reddit.com/r/foxholegame/comments/yzuflr/when_82dk_approaches_we_run_away/ix2sblt/ ColonelGray - "Defence in depth" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/foxholegame/comments/vp27is/alts_skynet_cheats_hostility_make_the_game_a_hard/iegtt83/ ColonelGray - "In game is 99% fine." - Reddit] (Mar 1, 2023)</ref>, SkyRim<ref>[https://old.reddit.com/r/freefolk/comments/w2w8ly/we_will_stay_true_to_the_original_story_proceeds/igwfko6/ ColonelGray - "It looks like a Skyrim hair replacement mod installed incorrectly." - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/skyrim/comments/jq8gs9/progress_is_slow_but_i_found_a_good_spot_for_my/gbljgtr/ ColonelGray - "He should have built the walls out of Brie-ezeblocks." - Reddit] (Mar 1, 2023)</ref>, Team Fortress 2<ref>[https://old.reddit.com/r/tf2/comments/umw2q6/this_item_i_thought_of_functions_the_same_as_the/i87j5w0/ ColonelGray - "I feel like the heavy should definitely get something like this." - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/tf2/comments/ktsb83/are_best_friends/gioh2eq/ ColonelGray - "Then quickly disconnect on my streak of 1." - Reddit] (Mar 1, 2023)</ref>, and Battlefield<ref>[https://old.reddit.com/r/BattlefieldV/comments/z5uto4/when_you_have_terrible_aiming_but_you_got_into/iy3b27m/ ColonelGray - "assault really is easy mode lol" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/battlefield2042/comments/vo4in4/the_next_battlefield_will_have_a_campaign_again/iecqerm/ ColonelGray - "I don't care if they have to destroy it all and build from the ground up." - Reddit] (Mar 1, 2023)</ref>.
| |
|
| |
|
| ColonelGray is an active and enthusiastic user of the Kraken cryptocurrency exchange<ref>[https://old.reddit.com/r/CryptoCurrency/comments/10pt88x/i_simply_love_the_fact_that_two_posts_on_the/j6nee5z/ ColonelGray - "Kraken has always been fantastic for me." - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/CryptoCurrency/comments/slitx8/proofofreserves_audit_shows_kraken_holds_19b_in/hvsjy1d/ ColonelGray - "Kraken have always been fantastic in regards to customer support as well." - Reddit] (Mar 1, 2023)</ref> though he has also tried CoinBase<ref>[https://old.reddit.com/r/CoinBase/comments/luc4qm/veryfying_for_over_a_week/gp642q0/ ColonelGray - "I created a coinbase account over a month ago, sent off all the identification guff and it still says its under review." - Reddit] (Mar 1, 2023)</ref>. He has investments in ethereum<ref name=":9">[https://old.reddit.com/r/CryptoCurrency/comments/src111/2021_was_the_year_for_terra_luna_and_solana_what/hwrrmpc/ ColonelGray - "DOT is in a very solid spot alongside ADA." - Reddit] (Mar 1, 2023)</ref><ref name=":10">[https://old.reddit.com/r/ergonauts/comments/wv9sro/why_did_eth_move_to_pos_what_does_it_mean_to_erg/ilgs20b/ ColonelGray - "I think PoW is fantastic but from mass adoption perspective" - Reddit] (Mar 1, 2023)</ref><ref name=":11">[https://old.reddit.com/r/erg_miners/comments/q0eaok/this_coin_hopping_is_a_bummer_for_loyal_miners/hf7tte7/ ColonelGray - "Been mining ergo for months but finally gone back to eth and flux for a bit" - Reddit] (Mar 1, 2023)</ref><ref name=":12">[https://old.reddit.com/r/Ravencoin/comments/ohk9yw/deleted_by_user/h4qr7kn/ ColonelGray - "I would mine more RVN but my cards get too hot compared to ETH or ERG." - Reddit] (Mar 1, 2023)</ref>, polkadot<ref name=":9" /><ref name=":13">[https://old.reddit.com/r/CryptoCurrency/comments/qu1dob/which_crypto_are_you_most_bullish_on_even_though/hknewmh/ ColonelGray - "DOT and ERGO" - Reddit] (Mar 1, 2023)</ref><ref>[https://old.reddit.com/r/Polkadot/comments/zhqw4j/trouble_staking_with_ledger/j0yl3y1/ ColonelGray - "just looking into that now. Very helpful thank you!" - Reddit] (Mar 1, 2023)</ref>, cardano<ref name=":9" /><ref>[https://old.reddit.com/r/cardano/comments/pdmi2u/first_bank_in_us_offering_crypto_banking_and_its/hasflgl/ ColonelGray - "I still think one of the founding points of crypto is to not need banks." - Reddit] (Mar 1, 2023)</ref>, ergo<ref name=":11" /><ref name=":12" /><ref name=":13" /><ref name=":14">[https://old.reddit.com/r/Ravencoin/comments/ox7chl/deleted_by_user/h7lk3qs/ ColonelGray - "I'm hoping they will split between ergo and RVN" - Reddit] (Mar 1, 2023)</ref>, ravencoin<ref name=":12" /><ref name=":14" />, and flux<ref name=":11" />. He actively mines ethereum, ergo, and flux<ref name=":11" /><ref name=":15">[https://old.reddit.com/r/erg_miners/comments/os6hj1/finding_good_hardware_for_good_prices_is_hard_now/h6mpspy/ ColonelGray - "used to be able to pick those psus up for £15/20 now they're £40ish" - Reddit] (Mar 1, 2023)</ref> and used to mine ravencoin<ref name=":12" />. He supports Proof of Work but sees merit in Proof of Stake for adoption<ref name=":9" /><ref name=":10" />. He feels that there should be less than 15 total coins<ref>[https://old.reddit.com/r/CryptoCurrency/comments/vuaeuu/whats_your_unpopular_crypto_opinion/ifd79lj/ ColonelGray - There isn't room for more than 15-20 crypto currencies if it is ever to be taken seriously" - Reddit] (Mar 1, 2023)</ref> though has claimed to purchase meme coins at one point<ref name=":16">[https://old.reddit.com/r/CryptoCurrency/comments/rzg6i1/this_sub_2_months_ago_you_will_never_see_bitcoin/hrwbvy7/ ColonelGray - "Not going to miss out on the third memecoin shill extravaganza" - Reddit] (Mar 1, 2023)</ref>. He calls himself a "crypto peasant" and report that early in his bitcoin journey he took and stored a screenshot of his seed phrase, on his computer<ref name="reddit-8330" />.<blockquote>"Hey, I'm willing to come out admit that I was one of those idiots who [screenshot] my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK."
| | "Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before." |
|
| |
|
| "Good thing I’m a crypto peasant."</blockquote>He reports that his mother had recently been diagnosed with cancer and he was planning to sell a portion of his cryptocurrency to help cover costs<ref name="reddit-8330" />.<blockquote>[M]y mother had just been diagnosed with cancer and I was planning to sell a portion of [my crypto holdings] to help cover some costs.</blockquote> | | "I immediately wiped all my drives and did a fresh install of windows." |
| | |
| | "I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them." |
| | |
| | "It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs." |
| | |
| | "Perhaps if I had not been so grief stricken I might have acted fast enough." |
| | |
| | "But now it is just a cautionary tale, just like the ones I used to read and ignore lol." |
| | |
| | This is a global/international case not involving a specific country. |
| | |
| | The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events. |
| | |
| | Include: |
| | |
| | * Known history of when and how the service was started. |
| | * What problems does the company or service claim to solve? |
| | * What marketing materials were used by the firm or business? |
| | * Audits performed, and excerpts that may have been included. |
| | * Business registration documents shown (fake or legitimate). |
| | * How were people recruited to participate? |
| | * Public warnings and announcements prior to the event. |
| | |
| | Don't Include: |
| | * Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed. |
| | * Anything that wasn't reasonably knowable at the time of the event. |
| | There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page. |
|
| |
|
| == The Reality == | | == The Reality == |
| ColonelGray left a screenshot of his recovery phrase on his computer<ref name=":2">[https://old.reddit.com/r/CryptoCurrency/comments/rgck4r/got_hacked_for_about_175k_is_there_any_recourse/hojzzq8/ ColonelGray - "Just about £6,000 gone because of my stupid mistakes." - Reddit] (Feb 28, 2023)</ref>.<blockquote>I had stupidly left a copy of my recovery phrase on my computer after printing it out.</blockquote>This goes against Exodus' specific guidance for users of their wallet on their website<ref name=":1" />.<blockquote>Do not store your 12-word phrase on the notepad of your computer, as a digital image, in a file-sharing service like Dropbox, MegaBox, OneDrive, Google Drive, iCloud, etc., as an e-mail draft, any kind of file on your computer or phone, including password-protected files, or on a USB drive.
| | This sections is included if a case involved deception or information that was unknown at the time. Examples include: |
|
| |
|
| Because the threats are digital and online, the best way to protect your 12-word phrase is to store it on paper and offline.</blockquote>ColonelGray additionally used torrent to download files from untrusted sources<ref name="reddit-8330" /><ref name=":2" />.
| | * When the service was actually started (if different than the "official story"). |
| | * Who actually ran a service and their own personal history. |
| | * How the service was structured behind the scenes. (For example, there was no "trading bot".) |
| | * Details of what audits reported and how vulnerabilities were missed during auditing. |
|
| |
|
| == What Happened == | | == What Happened == |
| ColonelGray reports that he downloaded and ran a malicious torrent SCR file<ref name="reddit-8330" /><ref name=":2" />. The SCR file format is typically used for a screensaver<ref>[https://docs.fileformat.com/system/scr/ What is an SCR file? - FileFormat Docs] (Feb 28, 2023)</ref><ref name=":3">[https://fileinfo.com/extension/scr What is an SCR file? - FileInfo.com] (Feb 28, 2023)</ref>, however they can often contain malicious payloads<ref name=":3" /><ref>[https://www.reddit.com/r/GlobalOffensive/comments/2rmb3k/watch_out_for_scr_files/ Watch out for .scr files. - Reddit] (Feb 28, 2023)</ref><ref>[https://www.quora.com/What-is-the-scr-virus-and-how-do-you-remove-it What is the ".scr" virus and how do you remove it? - Quora] (Feb 28, 2023)</ref>. After downloading the file, he ran anti-virus software<ref name=":2" />, which he believed was satisfactory. He describes that either one<ref name=":2" /> or two<ref name="reddit-8330" /> days later, his wallet was emptied out. Despite his incredible openness about other areas of his life<ref name=":6" /><ref name=":7" /><ref name=":8" /> and investments<ref name=":15" /><ref name=":16" />, he did not share this story online until a few months later<ref name="reddit-8330" />.<blockquote>I saw a command window appear for a millisecond and knew I'd [mess]ed up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and [that] seemed to clear out some suspicious files.
| | The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it. |
| | |
| So I called it a goodnight and was just grateful I had not suffered for it.</blockquote>
| |
| {| class="wikitable" | | {| class="wikitable" |
| |+Key Event Timeline - Exodus Malicious Torrent File ColonelGray | | |+Key Event Timeline - Exodus Malicious Torrent File ColonelGray |
| Line 28: |
Line 62: |
| !Description | | !Description |
| |- | | |- |
| |December 14th, 2021 1:25:00 PM | | |January 2nd, 2022 7:27:02 AM MST |
| |First Reddit Post | | |Main Event |
| |ColonelGray posts some details in response to the Reddit user [[MetaMask Wallet Funds Taken anonymizeme|anonymizeme's hack for $175k]] about their own loss<ref name=":2" />. | | |Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here. |
| |- | | |- |
| |January 2nd, 2022 7:27:02 AM | | | |
| |Second Reddit Post | | | |
| |ColonelGray responds to [[Ledger/MetaMask Hack PowerOfTheGods|PowerOfTheGods theft]] with an expanded post with additional details on their situation and timeline. In this post, they claim the theft happened "a few months ago"<ref name="reddit-8330" />. | | | |
| |} | | |} |
| | |
| | == Technical Details == |
| | This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited? |
|
| |
|
| == Total Amount Lost == | | == Total Amount Lost == |
| ColonelGray reported their lost funds as "£6,000"<ref name=":2" /> and as "5k"<ref name="reddit-8330" />.
| | The total amount lost has been estimated at $5,000 USD. |
|
| |
|
| The total amount lost has been estimated at $5,000 USD.
| | How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie? |
|
| |
|
| == Immediate Reactions == | | == Immediate Reactions == |
| ColonelGray attributes his lack of taking further actions to protect his funds after executing the SCR file to his present state of grief<ref name="reddit-8330" />.<blockquote>Perhaps if I had not been so grief stricken I might have acted fast enough.</blockquote>While clearly upset over the loss of funds, he immediately took responsibility for what happened and his actions<ref name="reddit-8330" />.<blockquote>It [nearly] threw me over the edge.
| | How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed? |
| | |
| I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them. </blockquote>He reports purchasing a Ledger hardware wallet, wiping his hard drive, and freshly reinstalling Windows<ref name="reddit-8330" /><ref name=":2" />.<blockquote>I immediately wiped all my drives and did a fresh install of [W]indows.
| |
| | |
| Learnt my lesson and bought a Ledger cold storage. Also [I] formatted and reinstalled everything on my [personal computer].
| |
| | |
| </blockquote>
| |
|
| |
|
| == Ultimate Outcome == | | == Ultimate Outcome == |
| ColonelGray has upgraded their storage of funds to use a Ledger hardware wallet<ref name=":2" />.
| | What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done? |
| | |
| <blockquote>Learnt my lesson and bought a Ledger cold storage. Also formatted and reinstalled everything on my pc.</blockquote>There may be an argument that this situation has contributed towards greater caution overall for ColonelGray<ref>[https://old.reddit.com/r/CryptoCurrency/comments/vukppm/beware_scammers_are_getting_scary_now/ifgeg6d/ <nowiki>ColonelGray - "I block/ignore every single [direct message] on [R]eddit these days." - Reddit</nowiki>] (Mar 1, 2023)</ref>.<blockquote>I block/ignore every single [direct message] on [R]eddit these days. Just not worth the drama or risk.</blockquote>There is no indication that ColonelGray has undertaken any efforts to recover his funds<ref name="reddit-8330" />.<blockquote>But now it is just a cautionary tale, just like the ones I used to read and ignore lol. </blockquote>
| |
|
| |
|
| == Total Amount Recovered == | | == Total Amount Recovered == |
| There do not appear to have been any funds recovered in this case. | | There do not appear to have been any funds recovered in this case. |
| | |
| | What funds were recovered? What funds were reimbursed for those affected users? |
|
| |
|
| == Ongoing Developments == | | == Ongoing Developments == |
| There are no ongoing developments. ColonelGray hasn't reported pursuing any efforts to track down his funds.
| | What parts of this case are still remaining to be concluded? |
| | | == General Prevention Policies == |
| | Never screenshot the seed phrase. Always store it offline, and only offline. |
| == Individual Prevention Policies == | | == Individual Prevention Policies == |
| {{Prevention:Individual:Store Funds Offline}}
| | {{Prevention:Individuals:Placeholder}} |
| | |
| {{Prevention:Individuals:Always Verify Executables}} | |
|
| |
|
| {{Prevention:Individuals:End}} | | {{Prevention:Individuals:End}} |
|
| |
|
| == Platform Prevention Policies == | | == Platform Prevention Policies == |
| {{Prevention:Platforms:Seed Phrase Education}} | | {{Prevention:Platforms:Placeholder}} |
|
| |
|
| {{Prevention:Platforms:End}} | | {{Prevention:Platforms:End}} |
|
| |
|
| == Regulatory Prevention Policies == | | == Regulatory Prevention Policies == |
| {{Prevention:Regulators:Cryptocurrency Education Mandate}} | | {{Prevention:Regulators:Placeholder}} |
|
| |
|
| {{Prevention:Regulators:End}} | | {{Prevention:Regulators:End}} |
|
| |
|
| == References == | | == References == |
| <references> | | <references><ref name="reddit-7894">[https://www.reddit.com/r/CryptoCurrency/comments/rts1w2/got_compromised_and_lost_over_120k_in_crypto_ama/ Got compromised and lost over $120k in crypto; AMA : CryptoCurrency] (Jun 1, 2022)</ref> |
| <ref name="reddit-8330">[https://www.reddit.com/r/CryptoCurrency/comments/rts1w2/comment/hqxq6tg/?utm_source=reddit&utm_medium=web2x&context=3 ColonelGray - "I check my exodus wallet and the balance was 0 whereas it had been 5k the day before" - Reddit] (Jul 3, 2022)</ref> | | |
| </references> | | <ref name="reddit-8330">[https://www.reddit.com/r/CryptoCurrency/comments/rts1w2/comment/hqxq6tg/?utm_source=reddit&utm_medium=web2x&context=3 Got compromised and lost over $120k in crypto; AMA : CryptoCurrency] (Jul 3, 2022)</ref> |
| | |
| | <ref name="exodus-8331">[https://www.exodus.com/ Live charts & portfolio] (Jul 3, 2022)</ref></references> |
Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw from their wallet.
This is a global/international case not involving a specific country.[1][2][3]
About Exodus
"Hey, I'm willing to come out admit that I was one of those idiots who screenshotted my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK."
"So from what I’m hearing, a screenshot is a bad idea. Cool. Good thing I’m a crypto peasant."
"Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files."
"So I called it a goodnight and was just grateful I had not suffered for it."
"Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before."
"I immediately wiped all my drives and did a fresh install of windows."
"I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them."
"It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs."
"Perhaps if I had not been so grief stricken I might have acted fast enough."
"But now it is just a cautionary tale, just like the ones I used to read and ignore lol."
This is a global/international case not involving a specific country.
The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
Include:
- Known history of when and how the service was started.
- What problems does the company or service claim to solve?
- What marketing materials were used by the firm or business?
- Audits performed, and excerpts that may have been included.
- Business registration documents shown (fake or legitimate).
- How were people recruited to participate?
- Public warnings and announcements prior to the event.
Don't Include:
- Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
- Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
Key Event Timeline - Exodus Malicious Torrent File ColonelGray
| Date
|
Event
|
Description
|
| January 2nd, 2022 7:27:02 AM MST
|
Main Event
|
Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|
|
|
|
|
Technical Details
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?
Total Amount Lost
The total amount lost has been estimated at $5,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
General Prevention Policies
Never screenshot the seed phrase. Always store it offline, and only offline.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
