Exodus Malicious Torrent File ColonelGray

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Exodus

Reddit user ColonelGray stored a screenshot of their seed phrase on their PC when setting up their wallet. Some time later, they downloaded a malicious torrent file which ended up running a larger program. This resulted in the hacker gaining access to the seed phrase and using it to withdraw from their wallet.

About Exodus

Exodus is an online web wallet which allows the storage of over 260 cryptocurrencies as well as NFTs.

"Exodus Bitcoin & Crypto Wallet - Manage and swap 260+ cryptos and NFTs on your web browser, mobile, desktop, and hardware wallets."

All user assets are stored within the wallet and backed by a seed phrase, which the user is required to secure.

Your secret recovery phrase is the key to your wallet and controls access to all your funds, so write it down and keep it safe! Exodus users are responsible for storing their own recovery phrase. If the recovery phrase is lost, the user might not be able to retrieve their private keys.

"Cut to a few months ago and I accidently clicked on a malicious file from a torrent. I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and seemed to clear out some suspicious files."

"So I called it a goodnight and was just grateful I had not suffered for it."

"Then a couple of days later I check my exodus wallet and the balance was 0 whereas it had been 5k the day before."

"I immediately wiped all my drives and did a fresh install of windows."

"I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them."

"It damn near threw me over the edge as my mother had just been diagnosed with cancer and I was planning to sell a portion of it to help cover some costs."

"Perhaps if I had not been so grief stricken I might have acted fast enough."

"But now it is just a cautionary tale, just like the ones I used to read and ignore lol."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

About ColonelGray

ColonelGray has been an active long-time user of Reddit since 2018. He reports himself to be from Britain (likely Wales), 31 years of age as of November 20th, 2022, and a Covid long-hauler with a background working in hospitality. He is highly open online about his dating life, health, and self image. He actively plays and discusses video games including Company of Heroes, Age of Empires 4, Hunt: Showdown, Warhammer 40k, Foxhole, SkyRim, Team Fortress 2, and Battlefield.

ColonelGray is an active and enthusiastic user of the Kraken cryptocurrency exchange though he has also tried CoinBase. He has investments in ethereum, polkadot, cardano, ergo, ravencoin, and flux. He actively mines ethereum, ergo, and flux and used to mine ravencoin. He supports Proof of Work but sees merit in Proof of Stake for adoption. He feels that there should be less than 15 total coins though has claimed to purchase meme coins at one point. He calls himself a "crypto peasant" and report that early in his bitcoin journey he took and stored a screenshot of his seed phrase, on his computer.

"Hey, I'm willing to come out admit that I was one of those idiots who [screenshot] my seedphrase. This was when I was first getting into crypto so I did not really understand just how much of an foolish move that was, despite all the massive DO NOT DO THIS TURN BACK." "Good thing I’m a crypto peasant."

At the time of the theft, he reports that his mother had just been diagnosed with cancer.

[M]y mother had just been diagnosed with cancer and I was planning to sell a portion of [my crypto holdings] to help cover some costs.

The Reality

ColonelGray left a screenshot of their recovery phrase on their computer.

I had stupidly left a copy of my recovery phrase on my computer after printing it out.

This goes against Exodus' specific guidance for users of their wallet on their website.

Do not store your 12-word phrase on the notepad of your computer, as a digital image, in a file-sharing service like Dropbox, MegaBox, OneDrive, Google Drive, iCloud, etc., as an e-mail draft, any kind of file on your computer or phone, including password-protected files, or on a USB drive. Because the threats are digital and online, the best way to protect your 12-word phrase is to store it on paper and offline.

ColonelGray additionally used torrent to download files from untrusted sources.

What Happened

ColonelGray reports that they downloaded and ran a malicious torrent SCR file. The SCR file format is typically used for a screensaver, however they can often contain malicious payloads. After downloading the file, he ran anti-virus software, which he believed was satisfactory. He describes that either one or two days later, his wallet was emptied out. Despite his incredible openness about other areas of his life, he did not share the story online until a few months later.

I saw a command window appear for a millisecond and knew I'd fucked up. However, my last run in with a virus was just one of those 'buy our antivirus' malware deals. So I figured it would be much the same. I ran my antivirus and [that] seemed to clear out some suspicious files. So I called it a goodnight and was just grateful I had not suffered for it.

Key Event Timeline - Exodus Malicious Torrent File ColonelGray

Date	Event	Description
December 14th, 2021 1:25:00 PM	First Reddit Post	ColonelGray posts some details in response to the Reddit user anonymizeme's hack for $175k about their own loss.
January 2nd, 2022 7:27:02 AM	Main Event	ColonelGray responds to PowerOfTheGods theft with an expanded post with additional details on their situation and timeline. In this post, they claim the theft happened "a few months ago".

Total Amount Lost

ColonelGray reported their lost funds as "£6,000" and as "5k".

The total amount lost has been estimated at $5,000 USD.

Immediate Reactions

ColonelGray attributes his lack of taking further actions to protect his funds to his present state of grief.

Perhaps if I had not been so grief stricken I might have acted fast enough.

While clearly upset, he immediately took responsibility for what happened and his actions.

It [nearly] threw me over the edge. I felt like such a fool. I was presented with SO MANY chances to secure my crypto and I didn't even think to do one of them.

He reports purchasing a Ledger hardware wallet, wiping his hard drive, and freshly reinstalling Windows.

I immediately wiped all my drives and did a fresh install of [W]indows.

Learnt my lesson and bought a Ledger cold storage. Also [I] formatted and reinstalled everything on my [personal computer].

Ultimate Outcome

ColonelGray has upgraded their storage of funds to use a Ledger hardware wallet.

Learnt my lesson and bought a Ledger cold storage. Also formatted and reinstalled everything on my pc.

It also appears that they have learned their lesson on keeping the screenshot online.

"So from what I’m hearing, a screenshot is a bad idea. Cool."

There may be an argument that this situation has contributed towards greater caution overall for ColonelGray.

I block/ignore every single [direct message] on [R]eddit these days. Just not worth the drama or risk.

There is no indication that ColonelGray has undertaken any efforts to recover his funds.

But now it is just a cautionary tale, just like the ones I used to read and ignore lol.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

There are no ongoing developments. ColonelGray hasn't reported pursuing any efforts to track down his funds.

Prevention Policies

Never screenshot the seed phrase. Always store it offline, and only offline.