Wasabi Wallet Coordinator Overcharging Fees
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
Wasabi Wallet is a bitcoin wallet which supports the privacy maximizing CoinJoin protocol, which helps make it much more challenging to track the origin and destination of bitcoin which go through the wallet. This process relies on a coordinator to assist with matching users together, and for that the coordinator will typically receive a small fee. Wasabi Coordinator is one such coordinator, who promised a low fee on their website. However, they were later found to be running a sophisticated attack that maximized their fees beyond what was intended by the Wasabi Wallet software. The Wasabi Wallet software has been updated to resolve the vulnerabilities which allowed them to overcharge to such an extreme amount.[1][2][3]
About Wasabi Wallet
"WASABI WALLET The leading Bitcoin wallet for desktop featuring coinjoin. It's free, open-source, and non-custodial. Reclaim your privacy today."
"Wasabi is a non-custodial hot wallet that requires a connection to the internet and cryptocurrency network to work. As a wallet, Wasabi values user privacy and anonymity. This is evident in its built-in CoinJoin, coin control, and Tor integration features that help to keep users and their IP addresses anonymous. This further prevents security breaches and data leaks."
"Wasabi Wallet is an open-source, non-custodial, privacy-focused Bitcoin wallet with built-in coinjoins. It is a piece of software that runs on your computer and helps you to manage your bitcoins. Although Wasabi has some very advanced magic under the hood, it is rather easy to use. You can generate a new set of seed words, or import already existing ones. With Wasabi you can receive bitcoins into your full control, and you can send them to someone else without needing permission from any other person or entity. There is also a powerful auto-coinjoin feature to help obfuscate your transaction history. You can use Wasabi to manage your hardware wallet, and it even connects to your own full node. Of course, Wasabi is libre and open-source, which means you have full control over the software you manage your money with"
About Wasabi Wallet Coordinator
"Wasabi Wallet Coordinator Made by community for community
Low Fee The fair and lowest fee - only 0.003% per round
High Volume Coordinator has own huge capacity for CoinJoin
Zero Logs Policy We don't store any logs on our server
Trustless Coordinator doesn't have access to any of your coins by design of Wasabi Wallet"
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
| Date | Event | Description |
|---|---|---|
| June 9th, 2024 4:18:52 PM MDT | Website Captured | The Wasabi Coordinator website is found to be online for the first time and advertising the lowest fees. |
| June 10th, 2024 3:22:50 AM MDT | Website Captured | The Wasabi Coordinator website is found to be online and advertising the lowest fees. |
| July 9th, 2024 6:11:00 PM MDT | Wasabi Wallet Tweet | Wasabit Wallet tweets a warning about the coordinator who is reported to be slowly siphoning funds from users of the protocol. WasabiCoordinator is accused of slowly siphoning funds through a complex attack. Wasabi Wallet advises anyone using them to stop immediately and assures that a new version of the wallet will be coming soon. |
| July 10th, 2024 7:26:31 AM MDT | Security Incident Post Made | The Wasabi Wallet team makes a post on Github to highlight the current security incidents which are happening in the wallet. Free coordinators are being attacked through DDOS attcks, which are hard to distinguish from legitimate traffic. An attack happened with one Windows installer binary being changed. |
| July 10th, 2024 7:50:00 AM MDT | Software Release Tweet | Wasabi Wallet tweets about the latest software version 2.1.0.0, which features security improvements, and encourages all users to upgrade. This links to the security incident post on Github. |
| July 10th, 2024 8:52:39 AM MDT | Website Captured | The Wasabi Coordinator website is captured as being online, however it returns a white screen. (This may be an issue with the Internet Archive.) |
Technical Details
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?
Total Amount Lost
The total amount lost is unknown.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
"According to a message posted by Wasabi Wallet on Twitter, users have reported that a coordinator named WasabiCoordinator is gradually stealing user funds through a complex attack. Wasabi Wallet advises all users connected to this coordinator to immediately stop CoinJoin operations and announces that a new version will be released soon to prevent such attacks. Subsequently, Wasabi Wallet tweeted that there were three types of attacks in this incident: attacks on free coordinators, supply chain (GitHub) compromise, user-targeted attacks."
"We have been informed that a coordinator named WasabiCoordinator is trying to slowly siphon funds from its users using a sophisticated attack. We advise everyone connected to this coordinator to stop coinjoining immediately. We will release a new version soon preventing this."
Ultimate Outcome
"The new iteration of our effort to reduce trust towards coordinators. This update enforces an absolute minimum input count, stricter safeguards and also ensures that parameters used during blame rounds are accepted by the client."
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ SlowMist Hacked - SlowMist Zone (Accessed Jul 11, 2024)
- ↑ July 9th-10th 2024: Wasabi Wallet Security Incident Disclosure · WalletWasabi/WalletWasabi · Discussion #13249 · GitHub (Accessed Jul 11, 2024)
- ↑ Wasabi Wallet Coordinator (Accessed Jul 11, 2024)