MyEtherWallet Phishing Steals Thousands
Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
MyEtherWallet is a popular and widely used cryptocurrency wallet service. A realistic email update was sent out, providing users with a link to download a new version of the wallet, which was intended to handle an upcoming hard fork.
Those users who clicked the link in the email received would have been redirected to a fake version of the site on a URL which looks extremely similar. Thousands of dollars worth of cryptocurrency (at least $15,000) were stolen in the attack.
This is a global/international case not involving a specific country.[1][2][3][4]
About MyEtherWallet
"MEW (MyEtherWallet) is a free, client-side interface helping you interact with the Ethereum blockchain. Our easy-to-use, open-source platform allows you to generate wallets, interact with smart contracts, and so much more."
"Taylor Manahan and Kosala Hemachandra founded MEW (MyEtherWallet) back in 2015, not long after Ethereum was created."
"The domain xn--myetherwalle-9me.com is a Unicode domain which makes it hard to discern from the real domain. The Unicode trick is used in order to make it difficult to distinguish, as shown below. Never played around with the Unicode trick, so had issues to see the differences myself."
"Behind the phishing domain, a myetherwallet.com clone is present (note the weird “t” with a T-comma underneath the letter, my humble respect for the Unicode trick! To bad they use it in a malicious way)."
"On the 24th, security researcher, Wesley Neelen revealed that he was one of the recipients of the phishing email, claiming that the wallet provider was implementing a hard fork update, urging the victims to unlock their accounts using their Keystore Files or private keys, synchronize their wallets and verify their ETH and token balances. By doing all that, one could have exposed their private keys along with providing information on the hackers about his or her wallet balance."
"Received a MyEtherWallet phishing e-mail on a e-mail address only submitted to a @kin_foundation mailinglist."
"We have pushed an update that allows smooth sailing for all the MyEtherWallet users in the process of the upcoming hard fork. To make use of this update we request all users to sign in to their MyEtherWallet accounts and synchronize their wallets for continuous undisturbed use of our services."
"Unlock your account by using your Keystore File (UTC / JSON) or simply use your private key. Only do this using the official MyEtherWallet site!" (Link to their phishing site.)
"The webpage is a one-on-one clone of the real MyEtherWallet.com website. Also, HTTPS was implemented using the free Let’s Encrypt service."
"After analyzing the live log, it became clear that one of the victims wallets lost 42.50 ETH. 42 ETH was equal to $12,577.63 around the time of the phishing attack."
"This morning, the attackers sent 3 times 16.5 ETH ($4,847.37) to 3 different ETH addresses. In other words: the attackers were able to obtain my e-mail address from the Kin Foundation mailing list in some way, performed a very well setup phishing attack and were able to obtain about $15.000 in 2 hours. I contacted the domain register of the Unicode domain. However, this is “bulletproof” hosting provider, not sure whether they will take it offline. Next to this we contacted appropriate authorities to initialize a notice and take down."
This is a global/international case not involving a specific country.
The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
Include:
- Known history of when and how the service was started.
- What problems does the company or service claim to solve?
- What marketing materials were used by the firm or business?
- Audits performed, and excerpts that may have been included.
- Business registration documents shown (fake or legitimate).
- How were people recruited to participate?
- Public warnings and announcements prior to the event.
Don't Include:
- Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
- Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
| Date | Event | Description |
|---|---|---|
| October 24th, 2017 | Main Event | Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here. |
Total Amount Lost
The total amount lost has been estimated at $15,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
General Prevention Policies
Cryptocurrency users need to always make sure that they are accessing any downloads directly on the official website. Unless infeasible, it's safer to transfer only a small wallet to any newly downloaded software, and wait prior to moving any significant sums over. (Malicious wallet developers typically sweep funds soon after any deposit is made.) Most blockchain updates are backwards compatible. It's a good idea to always ask trusted friends if you receive news of an update. Never make a rushed decision to download any new wallet software. Store most of your funds offline on a hardware wallet or paper copy, with a backup seed phrase, and set up a multi-sig if you have the technical knowledge to do so properly.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam - Coin Journal (Jan 18, 2022)
- ↑ Analysing a Cryptocurrency phishing attack | Dearbytes (Jan 21, 2022)
- ↑ @wesleyneelen Twitter (Jan 21, 2022)
- ↑ Hackers Stole Over $15,000 With a MyEtherWallet Phishing Scam – Crypto Archives (May 31, 2022)