$150K Stolen From MyEtherWallet Users in DNS Server Hijacking

The company was brief to alert customers to the threat, tweeting a warning at 7:29 a.m. EDT, within 15 minutes of when the hack started:

having said that, customers took to social media to report that they have been dropping finances.

"Went directly to myetherwallet and noticed that myetherwallet had [an] invalid connection certificates within the corner," rotistain published to the wallet's subreddit round 8:30 a.m. EDT, adding:

Micky Socaci, lead developer at BlockBits.io, defined the assault in a submit to the ethereum subreddit.

"Do now not use myetherwallet.com in case you're using Google Public DNS (eight.8.8.eight / eight.eight.four.four) at this second," he wrote, including: "It seems these DNS servers are resolving the domain to a horrific server which can scouse borrow your keys!"

His rationalization suits with MyEtherWallet's assertion that the assault became now not on their facet. area call machine (DNS) servers clear up internet site URLs to the proper IP addresses.

Moving of money :

As of press time, the affected finances are being shuffled round and damaged into smaller increments, in keeping with statistics from blockchain statistics company Etherscan.

first of all, the Etherscan block explorer confirmed 0x1d50588C0aa11959A5c28831ce3DC5F1D3120d29 as having received 179 inbound transactions starting from 7:17 a.m. and totaling 216.06 ether, or almost $152,000 at the time of writing.

The attacker sent 215 ether to some other deal with, 0x68ca85dbf8eba69fb70ecdb78e0895f7cd94da83, at 10:15 a.m. since then, the price range have been split further, with increments being divided between more than one pockets addresses.

in keeping with MyEtherWallet CEO Kosala Hemachandra, "all of the DNS servers are resolving again to accurate addresses."

"but I want to wait any other [hour] or so," he introduced at some stage in a communique on Skype.

Hemachandra stated that the hackers have been reputedly "huge enough to do a DNS poisoning assault on Google public DNS servers, which made it cache a malicious IP cope with for myetherwallet.com." Google fixed the issue "in a completely brief time," he went on to say.

"it's far virtually unfortunate, we stay in a global wherein even the maximum secured websites are prone to this type of attacks," Hemachandra told CoinDesk. "i'm sad approximately this and that i wish MEW team could be able to educate users and convince them [to] use hardware wallets and neighborhood versions of MEW