2018 has been a terrible year for cryptocurrencies - while the first major hack of the year was the Coincheck wallet hack, where NEM (XEM) cryptocurrencies worth $500 Million were stolen, the year has come to a close with a phishing attack on the Electrum Bitcoin Wallet, where at least 245 Bitcoins (worth over $1 Million) have been stolen so far. 

This attack was carried out by the means of phishing, as users who opened their wallet application were redirected to download a fake update, which was exactly similar to the existing app - leading users to believe that they are logging into their wallet. The hackers reportedly achieved this by setting up multiple malicious servers on the Electrum wallet network. When the users tried to log into their app, these servers showed an error message showing they need to update their application from a Github page. When they enter their username and password in this fake page, their details reach the hackers.

Reddit user u/normal_rc explains in detail about how this attack worked:

The hacker setup a whole bunch of malicious servers...If someone’s Electrum Wallet connected to one of those servers, and tried to send a BTC transaction, they would see an official-looking message telling them to update their Electrum Wallet, along with a scam URL.

A major red flag which was pointed out by many users here is that upon downloading the app and trying to log in, the app would ask for a 2 Factor verification from the users. This is something that was never the case in the past - as the app only asked for 2 Factor Authentication from the users when they were approving a transaction. This was when the funds of the users were transferred. 

A number of Electrum users suddenly found their wallets showing either significantly lesser funds or completely empty. Hackers transferred these stolen Bitcoins to multiple blockchain wallets, following which all the funds were consolidated and sent over to a single wallet.

A number of Electrum Wallet users took to Twitter and Reddit to express their outrage and concerns regarding this attack. Following this, Electrum officially announced that there is an ongoing attack on their users. The company pointed out that their official website is electrum.org and users are advised to not download the application from anywhere else. The company also pointed out in their Tweet that the attack is still ongoing. The tweet reads:

“There is an ongoing phishing attack against Electrum users. Our official website is https://electrum.org Do not download Electrum from any other source.”

2018 has been marred by a number of hacks - earlier this year, the Zaif cryptocurrency exchange, as well as industry giant Bithumb were hacked. The biggest cryptocurrency hack of all time also took place this year, as over half a billion dollars worth of NEM was stolen earlier this year. 17 Million Nano were stolen from BitGrail exchange in February of this year. This has been a particularly unsafe year for cryptocurrencies, which poses several questions over the security of cryptocurrency exchanges.

Stay tuned with us on Cryptoground for all the latest updates and news stories from the world of cryptocurrencies and the blockchain technology!