What happened
On August 30, 2020, a GitHub user called "1400BitcoinStolen" reported losing about 1,400 BTC (roughly $16 million at the time) after using an outdated version of the Electrum Bitcoin wallet. When they tried to send funds, a pop-up asked them to install a "security update". The update was malware that sent the wallet's entire balance to the attacker.
Electrum developer Thomas Voegtlin said the attack used a phishing technique dating to late 2018 and that the victim was exposed because they ran old software. Decrypt estimated that the technique had taken about 2,171 BTC in total. Binance CEO Changpeng Zhao said Binance had blacklisted the addresses involved, but no recovery was reported.
The loss is based on the victim's own report.
How it happened
- The attackers ran malicious servers on Electrum's open server network, which lets wallets connect to servers run by third parties.
- The victim ran an old Electrum version and connected to one of these servers. When they tried to send a transaction, they got a pop-up prompting them to install a "security update".
- The victim downloaded and installed the fake update, a backdoored wallet from the attackers' site instead of electrum.org.
- The malicious wallet transferred the full balance of about 1,400 BTC to attacker-controlled addresses.
Protocol details
Evidence
- report Report cointelegraph.com
- analysis Website reference 8btc.com
- analysis Website reference hacked.slowmist.io
- analysis Bitcoin Holder Loses $16 Million in BTC to Well-Known Scam decrypt.co
- analysis Someone Just Lost $16M in Bitcoin by Using a Malicious Install of the Electrum Wallet coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
