New Attack Against Electrum Bitcoin Wallets

This is clever:

How the attack works:

• Attacker added tens of malicious servers to the Electrum wallet network.
• Users of legitimate Electrum wallets initiate a Bitcoin transaction.
• If the transaction reaches one of the malicious servers, these servers reply with an error message that urges users to download a wallet app update from a malicious website (GitHub repo).
• User clicks the link and downloads the malicious update.
• When the user opens the malicious Electrum wallet, the app asks the user for a two-factor authentication (2FA) code. This is a red flag, as these 2FA codes are only requested before sending funds, and not at wallet startup.
• The malicious Electrum wallet uses the 2FA code to steal the user’s funds and transfer them to the attacker’s Bitcoin addresses.

The problem here is that Electrum servers are allowed to trigger popups with custom text inside users’ wallets.

Tags: bitcoin, cryptocurrency, fraud, hacking, two-factor authentication

Posted on January 7, 2019 at 6:13 AM • 26 Comments