Bitcoin Millionaire Loses $16 Million to a Compromised Wallet and Simple Social Engineering



bitcoin phishing attackThis brief tale of misfortune shows how unpatched software and letting your guard down – especially when $16 million is on the line – can be all that’s needed for a successful scam.

A recent post to a GitHub thread focused on phishing attacks using the Electrum digital wallet came to life recently with a user known as 1400BitcoinStolen posted about how they had been taken for 1,400 BTC that had been sitting since 2017.

According to the thread, the owner of the 1,400 Bitcoins foolishly installed an older version of Electrum – one that was well-known to have been exploited multiple times. The moment a transfer was attempted, a pop-up appears asking them to update their security before transferring funds.

Apparently that pop-up was the work of a phishing scam intent on stealing security details enough to pose as the Bitcoiner and to transfer their $16 million in BTC to another address.

There are two lessons to be learned from this story:

  • Always use the most up to date software – the makers of the Electrum digital wallet have posted the vulnerability of the earlier version of software for over two years on their website.
  • Always be suspect anytime security and credentials are involved – whenever someone is asked to provide their credentials, answer security questions, or take actions that are abnormal, the defenses should go up.

It unfortunately sounds like the former bitcoin millionaire wasn’t paying attention at all from start to finish – and got taken for it. Your organization can fall prey to the same lack of attention should users involved with the company’s finances be tricked into committing fraud, giving up credentials that provide access to email, and more.

Teaching your users to always be alert and vigilant when interacting with email and the web is critical. This is accomplished using new school Security Awareness Training. By enrolling users in this kind of training, they are taught the importance of being watchful for anything that seems out of the ordinary. Mistakes similar to the bitcoin mishap have happened to organizations costing millions and were also due to a user simply not paying attention.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing



Subscribe To Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews