Bitcoin (BTC) wallet service Electrum is facing an ongoing Denial-of-Service (DoS) attack on its servers, the company reported on Twitter on April 7.
According to tech news website The Next Web, the new attack has caused users to lose estimatedly millions of dollars to date, with a single person alone reportedly losing about $140,000.
The ongoing DoS attack was allegedly launched by a malicious botnet of more than 140,000 machines, and aims to steal users’ Bitcoin by referring them to fake versions of Electrum software. Citing an unnamed security researcher, the article says that the recent DoS attack is deployed on a new level and was launched about a week ago.
According to The Next Web, the attackers have even implemented their own Electrum servers hosting compromised Electrum versions in order to realize the hack. After users sync their vulnerable Electrum wallet with a malicious server, they are directed to “update” their client with a hacked version, which eventually leads to an immediate loss of funds that were contained in the old versions, the report explains.
Thomas Voegtlin, lead Electrum developer, reportedly said that the firm expects to resolve the matter in the coming hours or days. He stressed that users that are at the highest risk are those who downloaded Electrum a long time ago and have not updated the software since then.
Accordingly, Electrum’s website says that the software versions older than 3.3 can no longer connect to public servers and must be upgraded, which is a measure to prevent user exposure to phishing messages. The website also urges users to not download Electrum software from any other source than electrum.org.
In the recent announcement on Twitter, Electrum recommended its users to disable the auto-connect option and select their server manually, while the company is working on a more robust version of the Electrum server in order to fix the issue.
In December 2018, Electrum faced a similar attack that led to a loss of about $937,000 worth in Bitcoin. As reported by Cointelegraph, the attack consisted of building a fake version of the wallet that tricks users into providing password information.
Recently, online video distribution giant YouTube was reported to erroneously run a malicious advertisement for Electrum wallet, which again contained a malware version of the software.
Last week, the World Economic Forum released a blockchain cybersecurity report claiming that most data breaches are caused rather by a lack of implemented security measures instead of an increased skill level of hackers.