Pierluigi Paganini January 02, 2019

The latest attack of 2018 against cryptocurrency wallets and organizations in the cryptocurrency industry hit the popular Electrum wallets.

Hackers hit Electrum Bitcoin wallet and stole over 200 bitcoin, more than $750,000. The attack started on December 21th, 2018, and hackers leveraged a critical vulnerability that was addressed in early 2018.

The vulnerability could be exploited by attackers to use rogue Electrum servers to generate and display popups to the unaware users.

Users are urged to download and install an emergency security update.

The Electrum Bitcoin wallets don’t download the full blockchain, instead, the information is provided by servers remotely.

The attackers added malicious servers to the network of the wallets and pushed out the messages every time users attempted to carry out a Bitcoin transaction. The hackers set up a GitHub page and asked users to download and install the security update that was actually malware.

Once the installation was completed, the malicious code prompted users to enter the 2FA authentication codes that allowed them to take over the wallets and steal the Bitcoin.

Hackers used 33 fake servers, experts believe that they can use a similar technique before Electrum’s developers will patch the issue.

The attack was actually stopped and the GitHub page has been removed.

“Although Electrum’s team hasn’t yet developed a strategy to thwart similar attacks in the near future the team was able to mitigate the severity of damage to users’ wallets’ balance early on.” reported Hack Read.

“The team changed the appearance of the message of the hackers from a rich HTML text and removed the link to the fake GitHub repo that was part of the original message.”

An Electrum developer that goes online with the alias SomberNight explained that the attackers started the attack after the release of the
3.3.2 version. The legitimate update doesn’t fix the issue because a complete fix requires the upgrade of the entire “federated server ecosystem.”

“We did not publicly disclose this [attack] until now, as around the time of the 3.3.2 release, the attacker stopped… However, they now started the attack again.”

This is not the first time that Electrum was hit by hackers, early 2018 hackers exploited a zero-day in Bitmessage client to steal Electrum wallet keys.

Pierluigi Paganini

(SecurityAffairs – Electrum wallets, hacking)

[adrotate banner=”5″] [adrotate banner=”13″]