Malicious actors stole 1,400 bitcoins (~$16.3 million at the time of writing) from a cryptocurrency investor who had held the coins since 2017. He disclosed this on GitHub
A user using the handle 1400BitcoinStolen said that he stored BTC on an Electrum wallet that he had not accessed since purchase.
Seeking to transfer the funds, he installed an older version of the app, but could not complete a transaction. A pop-up window prompted him to update the wallet to the latest version for security reasons. After installing the update, his funds were moved to the attacker’s address.
The investor did not specify whether he had used the original Electrum version. In the comments under the post by Bitcoin researcher Ben Verret, users speculated that the theft was made possible by the wallet’s failure to receive a timely update.
A pioneer of the cryptocurrency industry and CEO of Blockstream, Adam Back, suggested that the user may have connected to a malicious server from which he received a notification prompting an application update.
Someone explain? Is this due to connecting to a malicious electrum server which pushes a misleading notification message, then the user installs malware? Maybe displayed messages could be signed by electrum the software author instead of network servers?
— Adam Back (@adam3us) August 30, 2020
In April last year, Electrum users lost $4.6 million in bitcoin due to a large DoS attack.
Subscribe to ForkLog news on VK!