What happened
From around December 21 to December 27, 2018, attackers ran a phishing campaign against users of the Electrum Bitcoin wallet. They set up many malicious Electrum servers across different IP ranges (a Sybil attack), so wallets frequently connected to one. When a user tried to broadcast a transaction, the malicious server returned an error message that the client displayed as rich text, telling the user to install an urgent update and linking to a look-alike GitHub repository.
The fake Electrum builds stole wallet keys and seeds and sent balances to attacker addresses, including 1MkM9Q6xo5AHZkLv2sTGLYb3zVreE6wBkj and 14MVEf1X4Qmrpxx6oASqzYzJQZUwwG7Fb5. Early reports put the haul at roughly 245 BTC, close to $1 million at the time; Malwarebytes later attributed about 218 BTC to this first malware variant. Electrum warned users to download the wallet only from electrum.org, shipped a quick mitigation in 3.3.2, and in 3.3.3 stopped rendering arbitrary server messages.
The same technique was reused in larger 2019 waves.
How it happened
- The attacker operated many Electrum servers across different
/16IPv4 ranges, so wallets picking random servers often connected to one. - When a victim broadcast a transaction, the malicious server returned an error instead of the transaction ID; the client raised that text verbatim and the GUI rendered it as HTML/rich text.
- The message claimed a security update was required and linked to fake Electrum releases hosted on an
electrum-projectGitHub repository resembling the official one. - Victims who installed the fake build had their wallet keys and seeds exfiltrated and their balances sent to attacker addresses.
Protocol details
Evidence
- report Report cointelegraph.com
- report Report reddit.com
- transaction when broadcasting transaction, error message from server is displayed as is (Issue #4968) github.com
- address www.blockchain.com address 1MkM9Q…wBkj blockchain.com
- code user-images.githubusercontent.com page 503592….png user-images.githubusercontent.com
- analysis Electrum Bitcoin wallets under siege malwarebytes.com
- analysis Dec 2018 - Electrum Mass Phishing Attacks - $937k (Global) quadrigainitiative.com
- analysis Almost $1 Million Stolen in Phishing Attack on Electrum Wallet crypto.news
- analysis electrum.org page electrum.org electrum.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
