Electrum hacked | Bitcointalksearch.org

ragnar dannesk gold

jr. member

Activity: 32

Merit: 37

Quote from: audaciousbeing on September 04, 2018, 01:44:59 PM

This is serious issue I must admit and I just cannot assume that you were ignorant of certain things because of your knowledge of mining is enough to implement basic security of your wallet and I am not more skeptical on which wallet is the best one to use if desktop wallet is now vulnerable to this kind of attack. The only explanation to this is the issue of virus which must have created a gateway for the attack to be launched. But I still need to apportion some blame to you that you had to wait for over a month to know something is wrong. It speak more of how much value to place in your assets. Even if you cannot be checking everyday, once in a week won't be too much as you would have been able to take action and the little funds you lost after the main event would have been saved.

How often the OP checked his wallet is the least important part here. You could happily not check your balance for years on end if you do the security correctly.

"I had a note pad file with my wallet words on my pc" <- This, and the OP having $10,000+ worth of BTC on an online computer, is what you should be focusing on.

yonton

sr. member

Activity: 854

Merit: 262

Quote from: audaciousbeing on September 04, 2018, 01:44:59 PM

This is serious issue I must admit and I just cannot assume that you were ignorant of certain things because of your knowledge of mining is enough to implement basic security of your wallet and I am not more skeptical on which wallet is the best one to use if desktop wallet is now vulnerable to this kind of attack. The only explanation to this is the issue of virus which must have created a gateway for the attack to be launched. But I still need to apportion some blame to you that you had to wait for over a month to know something is wrong. It speak more of how much value to place in your assets. Even if you cannot be checking everyday, once in a week won't be too much as you would have been able to take action and the little funds you lost after the main event would have been saved.

Yes you’re right I knew in the back of my mind I should have stored it offline, the reason why I didn’t check my wallet often is because I thought the less I opened it, the safer it would be.

audaciousbeing

hero member

Activity: 1330

Merit: 569

This is serious issue I must admit and I just cannot assume that you were ignorant of certain things because of your knowledge of mining is enough to implement basic security of your wallet and I am not more skeptical on which wallet is the best one to use if desktop wallet is now vulnerable to this kind of attack. The only explanation to this is the issue of virus which must have created a gateway for the attack to be launched. But I still need to apportion some blame to you that you had to wait for over a month to know something is wrong. It speak more of how much value to place in your assets. Even if you cannot be checking everyday, once in a week won't be too much as you would have been able to take action and the little funds you lost after the main event would have been saved.

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: yonton on September 04, 2018, 12:32:33 AM

I had a note pad file with my wallet words on my pc, I think that is how they got it.

Very well imaginable :/
Such sensitive information should only be stored offline without the possibility to be accessed by stranger.

At least an encryption with a password which is long enough (stored offline) should be done before keeping sensitive data on your PC.

Quote from: yonton on September 04, 2018, 12:32:33 AM

I haven’t claimed any forks but I have opened the wallet a few times to look at my coins.

It is unlikely that the RPC vulnerability led to your coins getting lost.

This would have required you to have:
1) Your wallet open
2) Your wallet NOT password protected (which it is according to your posts)
3) Visiting a malicious site which tries to exploit the vulnerability

.. at the SAME time. It is pretty 'safe' to assume that this was not the way your data got leaked.

Quote from: yonton on September 04, 2018, 12:32:33 AM

Since the hack I have disconnected the hard drive.

Note that simply disconnecting the hard drive doesn't change anything.
If your system was/is infected, simply changing hard drives won't change much.

You need to make sure to completely fresh install a new OS. In most cases this is enough.
There are still some cases (e.g. root kits) where installing a new OS won't help, but those are rare.

yonton

sr. member

Activity: 854

Merit: 262

I had a note pad file with my wallet words on my pc, I think that is how they got it. I haven’t claimed any forks but I have opened the wallet a few times to look at my coins. Since the hack I have disconnected the hard drive.

pooya87

legendary

Activity: 3472

Merit: 10611

Quote from: Abdussamad on September 03, 2018, 11:35:29 PM

Quote from: jackg on September 02, 2018, 11:23:43 AM

Yes but some information could still be drawn, if he got one of his private keys at the time, a call could be made to get that one and his xpub would have been available on his memory to be drawn if he had decrypted his wallet by that point for example...

The vulnerability didn't let you access memory. You could only do things via the json rpc interface. If you had a password on your wallet then private key/seed were not accessible. They could have still gotten to the xpub if full wallet file encryption wasn't being used but the xpub doesn't let you spend bitcoins.

Also the user entering the wallet password to access it via the GUI didn't mean that malicious JSON RPC requests wouldn't require a password.

That's why we say if you had a reasonably secure password you were not vulnerable

not to mention that you needed to have your wallet open alongside a malicious website that could make a malicious call to try and access your wallet! and you shouldn't have had any ad blocker on your browser since they block these kinds of scripts.
OP doesn't seem to have opened his wallet for a year!

to OP: since you had bitcoin from last year, did you happen to try and claim some fork coins (like bitcoin-cash, gold, private,....) with your private key(s)? because that might have been the way you leaked them yourself.

Abdussamad

legendary

Activity: 3612

Merit: 1564

Quote from: jackg on September 02, 2018, 11:23:43 AM

Yes but some information could still be drawn, if he got one of his private keys at the time, a call could be made to get that one and his xpub would have been available on his memory to be drawn if he had decrypted his wallet by that point for example...

The vulnerability didn't let you access memory. You could only do things via the json rpc interface. If you had a password on your wallet then private key/seed were not accessible. They could have still gotten to the xpub if full wallet file encryption wasn't being used but the xpub doesn't let you spend bitcoins.

Also the user entering the wallet password to access it via the GUI didn't mean that malicious JSON RPC requests wouldn't require a password.

That's why we say if you had a reasonably secure password you were not vulnerable

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: yonton on September 02, 2018, 12:35:11 AM

It was a new seed and I did have a file on my pc with my private key.

Did you have single private keys stored in the text file ? Or was it your (12-/18-/24- word) mnemonic seed ?

And what funds have been accessed ? Those whose private keys were stored in that file ? Or also from other addresses ?

IMO it is very likely that your PC somehow got compromised. Either by downloading/executing malware or through a vulnerability.

If you had electrum running all the time (e.g. in autostart) the possibility would exist that some malicious website you have entered could exploit a vulnerability in electrum to steal your funds.
But since your wallet file was password protected, this is not the case here.

For the future.. never have a digital backup stored on the same machine. You shouldn't even have a digital backup at all stored anywhere except completely offline.
And note that a digital backup NEVER replaces a physical (analogous) backup.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: yonton on September 01, 2018, 07:37:20 PM

No i didn’t move them, it was a substantial amount for me and a big loss. My wallet was emptied then they repeatedly withdrew small amounts from my mining profits that were going to that address. Over 3 btc

If you plan to continue trying to mine then I'd suggest you use an air gapped computer and a strong password...
The 3BTC is somewhat potentially irreversible, I'll take a look at that address if they were all on there and see if there's anything they've gone to like an exchange.

Quote from: yonton on September 02, 2018, 09:14:50 AM

Quote from: vit05 on September 02, 2018, 03:04:45 AM

What is your OS? Only you used this computer? If they invaded your computer, they left a trail and the attacker is still in it. It would be important before formatting your computer trying to find what they used to hack into. Honestly, in these cases it is best to try to exhaust all possibilities of social engineering before assuming it is an online invasion. A seed can be much more easily copied by someone with access for a few minutes to the PC than in an invasion.

It was on windows 8.1, I have removed the hard drive already and installed a new one. I live alone and only my son is with me but it’s possible my land lord could have entered my place?? Do you think an online invasion is unlikely? What is strange is that I had another wallet on the drive that was not touched.

Anything is possible. I don't think it's unlikely a virus was sent to you...

Quote from: yonton on September 02, 2018, 12:35:11 AM

Quote from: nc50lc on September 02, 2018, 12:11:33 AM

When you created that wallet, was it a "new seed", an imported seed from somewhere else or imported private key(s)?

Quote from: jackg on September 01, 2018, 06:03:31 PM

-snip-
The issue was that other sites were using requests fro JSON files to draw out seeds and master private keys instead...

Depends if he still uses the vulnerable versions of Electrum, but password-protected wallets were still safe from being hacked (Read link).

Possibly, your Seed or private keys backups were compromised in July or earlier months, did you have a backup stored somewhere?

It was a new seed and I did have a file on my pc with my private key. Do you think they would have found it?

Yes but some information could still be drawn, if he got one of his private keys at the time, a call could be made to get that one and his xpub would have been available on his memory to be drawn if he had decrypted his wallet by that point for example...

yonton

sr. member

Activity: 854

Merit: 262

Quote from: vit05 on September 02, 2018, 03:04:45 AM

What is your OS? Only you used this computer? If they invaded your computer, they left a trail and the attacker is still in it. It would be important before formatting your computer trying to find what they used to hack into. Honestly, in these cases it is best to try to exhaust all possibilities of social engineering before assuming it is an online invasion. A seed can be much more easily copied by someone with access for a few minutes to the PC than in an invasion.

It was on windows 8.1, I have removed the hard drive already and installed a new one. I live alone and only my son is with me but it’s possible my land lord could have entered my place?? Do you think an online invasion is unlikely? What is strange is that I had another wallet on the drive that was not touched.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: yonton on September 01, 2018, 04:47:10 PM

I downloaded electrum last year and I just checked my balance today and it’s all gone. Some withdrew everything in July 2018. How is this possible?

We have many cases like yours here, just use search option in this forum with keywords "electrum" "hacked" "stolen" and you will get many results. It is possible that you download fake version of Electrum, especially if you are using search engine. Last year there is so many fake Electrum sites which use Google ads to be displayed at the top of the search results. If you download something like that, hacker is just wait to you send some coins to wallet and then game is over for you.

The fact that you have seed stored in your PC it's just one of the possible ways how hacker can steal your coins. It may be result of Remote Access Trojan, or as some members mentioned it can be work of some family member/friend who had access to the computer.

vit05

hero member

Activity: 672

Merit: 526

What is your OS? Only you used this computer? If they invaded your computer, they left a trail and the attacker is still in it. It would be important before formatting your computer trying to find what they used to hack into. Honestly, in these cases it is best to try to exhaust all possibilities of social engineering before assuming it is an online invasion. A seed can be much more easily copied by someone with access for a few minutes to the PC than in an invasion.

nc50lc

legendary

Activity: 2394

Merit: 5531

Self-proclaimed Genius

Quote from: yonton on September 02, 2018, 12:35:11 AM

It was a new seed and I did have a file on my pc with my private key. Do you think they would have found it?

I'm afraid that this must be the case.
Once your PC got compromised, there's no stopping the hacker from getting that file.
Leaving a backup inside the same machine where the wallet was is a total security risk.

yonton

sr. member

Activity: 854

Merit: 262

Quote from: nc50lc on September 02, 2018, 12:11:33 AM

When you created that wallet, was it a "new seed", an imported seed from somewhere else or imported private key(s)?

Quote from: jackg on September 01, 2018, 06:03:31 PM

-snip-
The issue was that other sites were using requests fro JSON files to draw out seeds and master private keys instead...

Depends if he still uses the vulnerable versions of Electrum, but password-protected wallets were still safe from being hacked (Read link).

Possibly, your Seed or private keys backups were compromised in July or earlier months, did you have a backup stored somewhere?

It was a new seed and I did have a file on my pc with my private key. Do you think they would have found it?

nc50lc

legendary

Activity: 2394

Merit: 5531

Self-proclaimed Genius

When you created that wallet, was it a "new seed", an imported seed from somewhere else or imported private key(s)?

Quote from: jackg on September 01, 2018, 06:03:31 PM

-snip-
The issue was that other sites were using requests fro JSON files to draw out seeds and master private keys instead...

Depends if he still uses the vulnerable versions of Electrum, but password-protected wallets were still safe from being hacked (Read link).

Possibly, your Seed or private keys backups were compromised in July or earlier months, did you have a backup stored somewhere?

yonton

sr. member

Activity: 854

Merit: 262

I can’t remember, it was last year and I’ve had much more in that wallet so if it was a bogus electrum link they would have emptied my account a long time ago when there was more in it.

Abdussamad

legendary

Activity: 3612

Merit: 1564

where did you download electrum from? check your browser history and find out the exact url.

yonton

sr. member

Activity: 854

Merit: 262

No i didn’t move them, it was a substantial amount for me and a big loss. My wallet was emptied then they repeatedly withdrew small amounts from my mining profits that were going to that address. Over 3 btc

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: yonton on September 01, 2018, 05:52:27 PM

I had a password for the wallet but not the Json file?

JSON is a way to represent data, you don't have a JSON file that you create in electrum, the server will generate some sort of json file for your electrum to use and can call for your public keys using json? The issue was that other sites were using requests fro JSON files to draw out seeds and master private keys instead...

Was it a fairly complex virus? Are you sure you didn't move the bitcoins yourself also (It's been a month at least so you might have forgotten you moved them).

Rickorick

jr. member

Activity: 107

Merit: 8

Whats the address the coins went to?

Topic: Electrum hacked (Read 485 times)