Bitcoin Millionaire Loses $16 Million to a Compromised Wallet and Simple Social Engineering

This brief tale of misfortune shows how unpatched software and letting your guard down – especially when $16 million is on the line – can be all that’s needed for a successful scam.

A recent post to a GitHub thread focused on phishing attacks using the Electrum digital wallet came to life recently with a user known as 1400BitcoinStolen posted about how they had been taken for 1,400 BTC that had been sitting since 2017.

According to the thread, the owner of the 1,400 Bitcoins foolishly installed an older version of Electrum – one that was well-known to have been exploited multiple times. The moment a transfer was attempted, a pop-up appears asking them to update their security before transferring funds.

Apparently that pop-up was the work of a phishing scam intent on stealing security details enough to pose as the Bitcoiner and to transfer their $16 million in BTC to another address.

There are two lessons to be learned from this story:

• Always use the most up to date software – the makers of the Electrum digital wallet have posted the vulnerability of the earlier version of software for over two years on their website.
• Always be suspect anytime security and credentials are involved – whenever someone is asked to provide their credentials, answer security questions, or take actions that are abnormal, the defenses should go up.

It unfortunately sounds like the former bitcoin millionaire wasn’t paying attention at all from start to finish – and got taken for it. Your organization can fall prey to the same lack of attention should users involved with the company’s finances be tricked into committing fraud, giving up credentials that provide access to email, and more.

Teaching your users to always be alert and vigilant when interacting with email and the web is critical. This is accomplished using new school Security Awareness Training. By enrolling users in this kind of training, they are taught the importance of being watchful for anything that seems out of the ordinary. Mistakes similar to the bitcoin mishap have happened to organizations costing millions and were also due to a user simply not paying attention.