MyEtherWallet Hack

Reported loss $150K
Access Control

What happened

On April 24, 2018, MyEtherWallet said a BGP hijack affecting Amazon DNS infrastructure redirected some visitors from the legitimate site to a phishing page. MyEtherWallet reported that the phishing operation stole about 150,000 dollars' worth of Ether from users; it did not describe a compromise of users' Ethereum accounts through an onchain contract flaw.

How it happened

  1. Attackers used a BGP hijack against Amazon DNS infrastructure to reroute some requests for the MyEtherWallet domain.
  2. Redirected visitors reached a fake MyEtherWallet phishing page.
  3. The phishing system captured wallet access material and used the victim's browser connection to make transfers to attacker-controlled wallets.
  4. MyEtherWallet later moved DNS operations to Cloudflare and described additional registrar, HSTS, CAA, and DNSSEC protections.

Protocol details

Classification Other
Protocol Type Exploit/Access control
Protocol links Website @myetherwallet

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Electrum $949K lost Trade.io $9.0M lost BlackWallet $400K lost Rubixi $7K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes