The cryptocurrency industry has always been targeted by criminals and hackers. This new form of money can be moved around the world without too much friction, which makes for an appealing opportunity. It now seems a new Electrum wallet is making the rounds on GitHub, albeit one that has nothing to do with the official cryptocurrency project. As such, users are advised to tread with caution.
Another Fake Cryptocurrency Wallet
Most cryptocurrency enthusiasts and veterans will know not every type of software on the internet can be trusted. There have been dozens of attempts to create fake wallets capable of stealing users’ funds. It seems that trend is not coming to an end anytime soon, as researchers have discovered a malicious Electrum wallet client which resides on GitHub.
⚠️ There is a fake @ElectrumWallet website with exe's hosted on @github – exe contacts a RU host e-xodus[dot]com
Fake site: electrum[dot]onehttps://t.co/bs0H5C20bghttps://t.co/cZPQLrXdcO#cryptocurrency
cc: @Cloudflare @GoDaddy pic.twitter.com/a2huqw0QUz— {harry,whg}.eth 🦊💙 (@sniko_) January 13, 2019
For those who are unaware, Electrum is an open source cryptocurrency wallet solution. Its genuine code can be found on GitHub and be copied by anyone who wants to put their own spin on this particular project. In the case of this allegedly Russian clone, it seems the main purpose is to steal user funds, rather than create a genuine wallet solution for cryptocurrency users. Why anyone would purposefully try to defraud users, is incomprehensible.
According to one researcher, it seems this face Electrum wallet is hosted on a Russian web host known as E-Xodus. The fake Electrum website uses the “.one” domain extension, rather than the regular “.org” one. It is possible the Russian web host in question has been compromised somehow, although there may be more to this malicious intent than users may realize. The GitHub repository is also aptly named “Electrvm” instead of “Electrum”, further indicating there is genuine malicious intent.
Thankfully, it would appear both Metamask and EthAddrLookup have already blacklisted the website in question. That should ensure the fake Electrum client cannot be downloaded by most people, although it remains to be seen if anyone will lose money because they simply ignore this blatantly fake wallet. As is usually the case, a lot of novice users will not be familiar with what is going on behind the scenes and why not every repository on GitHub may be legitimate.
Now that this wallet has become public knowledge, it will be interesting to see how long this particular offering will remain available. Considering how the fake Electrum.one domain was registered several months ago, it is possible this fake wallet may have been around for a lot longer than originally anticipated. Even so, there are no known victims of this scam to date.
Unfortunately, it seems unlikely this will be the final scam attempt affecting cryptocurrency users. Criminals have shown a tendency to explore many different options when it comes to this particular industry. Malicious wallets are nothing new under the sun in this regard, nor is it the first time Electrum is being targeted in this regard. For the time being, users need to remain vigilant when it comes to exploring cryptocurrency wallets.