Loading story…
Electrum developers disclosed and patched a critical vulnerability that allowed malicious websites to steal bitcoin from users of the popular wallet. Reports said the flaw affected older versions and could be triggered through website interaction, prompting urgent calls for users to upgrade to a fixed release.
The risk persisted well beyond the initial patch cycle. Later reporting linked an old Electrum weakness to the theft of 1,400 BTC from a user, while newer campaigns targeting Electrum wallets reportedly infected more than 150,000 hosts and stole over $4.6 million. The incidents show that outdated wallet software and continued malware activity remained a significant threat to Electrum users even after the original vulnerability was addressed.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
A user reportedly lost 1,400 BTC due to an old Electrum vulnerability, showing that exploitation of legacy Electrum weaknesses continued years after the original disclosure and patch. The loss was reported in August 2020.
A later report said attacks targeting Electrum wallets were still ongoing, with more than 150,000 hosts infected and over $4.6 million stolen. This marked a major escalation in the scale and persistence of Electrum-related theft activity.
Electrum developers announced that the critical vulnerability had been fixed, addressing the issue that allowed websites to steal funds from affected wallets. Multiple outlets reported the remediation on or around January 8, 2018.
Reports described a critical vulnerability in the Electrum Bitcoin wallet that could allow malicious websites to steal users' bitcoins. The issue was publicly covered in early January 2018 before or alongside the fix becoming widely known.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
itsec.ru
Open sourcebits.media
Open sourceforklog.com
Open sourcebits.media
Open source2bitcoins.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in **COLDCARD** hardware wallet firmware made some recovery seeds predictable, and attackers used the weakness to steal about **594.48 BTC**—roughly **$38 million**—from around **500 wallets** in a coordinated sweep lasting about **25 minutes**. Reporting tied the theft to wallets created on affected devices, with the losses spread across roughly 500 transactions in three blocks and most of the stolen funds—about **562 BTC**—later consolidated into a single address. The targeted wallets were reportedly **single-signature** wallets holding more than **0.15 BTC** each, and many had been dormant for years. The weakness was traced to firmware logic that failed to properly use the device hardware random number generator and instead relied on a predictable fallback with a **32-bit reseed** mechanism, reducing entropy in generated seeds. Coinkite said the issue affects **Mk3** devices running firmware **4.0.1 and later**, and also affects **Mk4, Mk5, and Q** devices that generated seeds before fixed firmware was released; the company urged users to update firmware, create entirely new seeds, and move funds because updating alone does not repair already weak seeds. Coinkite added that wallets protected with sufficient independent dice-roll entropy or a strong **BIP-39 passphrase** are better protected, while **TAPSIGNER**, **SATSCARD**, and **OPENDIME** are not affected.
Aug 11, 2026
Attackers exploited a weakness dubbed **"Milk Sad"** in the `Libbitcoin Explorer 3.x` library to steal more than **$900,000** from cryptocurrency wallets whose seeds were generated with the `bx seed` command. Researchers said the flaw came from weak randomness during wallet-seed generation, allowing private keys to be guessed and funds drained; one reported theft exceeded **$278,318**. The issue was identified by the Distrust team, reported to the vulnerability database, and later publicized by blockchain security firm **SlowMist**, which said it worked with exchanges in an attempt to block the attacker’s address. The incident put renewed scrutiny on the long-running **Libbitcoin** project and raised concerns that exposure could extend beyond Bitcoin wherever the library was used to create accounts. Libbitcoin Institute member **Eric Voskuil** said the vulnerable command was not intended for production wallet use, and reports indicated the project could strengthen warnings or remove the feature. The thefts highlighted how insecure seed generation in developer tooling can translate directly into large-scale wallet compromise.
Jun 29, 2026
Multiple forms of cryptocurrency-related fraud and theft continue to impact individuals and organizations. Ongoing email and web-based scams promise large Bitcoin payouts, luring victims to fake chatbot sites and requiring them to pay conversion fees to criminal-controlled wallets. These campaigns often abuse platforms like telegra[.]ph and Google Forms to create convincing phishing pages. Meanwhile, the FBI reports a significant and rising trend in Bitcoin ATM fraud, with Americans losing at least $333 million in 2025, and scammers frequently targeting older victims. Law enforcement actions have included lawsuits against ATM providers accused of enabling or profiting from fraudulent transactions. In addition to direct scams, sophisticated attacks have leveraged previous data breaches to facilitate cryptocurrency theft. Investigations have traced ongoing wallet-draining attacks to the 2022 LastPass breach, where attackers obtained encrypted password vaults containing private keys and seed phrases. Victims with weak master passwords have been especially vulnerable, with stolen funds laundered through Russian exchanges. These incidents highlight the evolving tactics of cybercriminals in exploiting both technical vulnerabilities and social engineering to steal cryptocurrency assets.
Jun 29, 2026