Electrum: £4,450 STOLEN ON ELECTRUM HACK!!

[Jack-Jordan]

I started my computer, started Electrum, and I noticed immediately that the Electrum program asked me to update to version 4.0. So of course I allowed this update version. Immediately afterwards, I see that a transaction has started, been signed for, and is in progress to transfer out ALL my entire balance of bitcoin which was worth £4500, all being transferred out, by some hacker asshole because the Electrum Wallet allowed this to happen.
So, Electrum, how are you going to make this right? You owe me 1.3bitcoin as of 25/02/2019. So how is this being resolved? More details are available if you want to see it.
FIX THE SITUATION - PAY ME WHAT YOU OWE ME!

[QBall59]

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

[SomberNight]

There is no Electrum version 4.0. Where did you download from?

-------- Original Message --------
On 25 Feb 2019, 21:53, QBall59 wrote:

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[Jack-Jordan]

Unplug your internet NOW and system restore to when you installed electrum, then reinstall and use 12 word seed recovery

Sent from my iPhone

On 25 Feb 2019, at 20:53, QBall59 <[email protected][e-mail]> wrote:

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467178430, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa0JNoMVlgAMWndSHCA0lY2wxfZvFks5vRE05gaJpZM4bQuM6.

[Jack-Jordan]

Exactly. I opened Electrum as normal, But then a pop-up screen said I needed to upgrade to 4.0, so I did that. That clearly was the scam

Sent from my iPhone

On 25 Feb 2019, at 20:53, QBall59 <[email protected][e-mail]> wrote:

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467178430, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa0JNoMVlgAMWndSHCA0lY2wxfZvFks5vRE05gaJpZM4bQuM6.

[QBall59]

It was just a window that popped-up when I opened the wallet to send btc. I updated it and now I’ve been ripped off.

From: ghost43 [mailto:[email protected]]
Sent: Monday, February 25, 2019 5:59 PM
To: spesmilo/electrum
Cc: QBall59; Comment
Subject: Re: [spesmilo/electrum] £4,450 STOLEN ON ELECTRUM HACK!! (#5158)

There is no Electrum version 4.0. Where did you download from?

-------- Original Message --------
On 25 Feb 2019, 21:53, QBall59 wrote:

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub https://github.com/spesmilo/electrum/issues/5158#issuecomment-467180434 , or mute the thread https://github.com/notifications/unsubscribe-auth/AtxOxkuwa4v_u3ooCmzBz2jFprwxj13Xks5vRE6agaJpZM4bQuM6 . https://github.com/notifications/beacon/AtxOxjQNFnsgxPEp6t7DsSt8_hVM07oSks5vRE6agaJpZM4bQuM6.gif

[Jack-Jordan]

They owe us payback! For real we should start a campaign

Sent from my iPhone

On 25 Feb 2019, at 21:00, QBall59 <[email protected][e-mail]> wrote:

It was just a window that popped-up when I opened the wallet to send btc. I updated it and now I’ve been ripped off.

From: ghost43 [mailto:[email protected]]
Sent: Monday, February 25, 2019 5:59 PM
To: spesmilo/electrum
Cc: QBall59; Comment
Subject: Re: [spesmilo/electrum] £4,450 STOLEN ON ELECTRUM HACK!! (#5158)

There is no Electrum version 4.0. Where did you download from?

-------- Original Message --------
On 25 Feb 2019, 21:53, QBall59 wrote:

Same thing just happened to me! I went to transfer a much smaller amount of btc and it has remained in "unconfirmed" mode for several hours now. Plus, an inbound payment that I received was immediately transferred out of my account! I'm out about USD 800. WTF Electrum?!??

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub https://github.com/spesmilo/electrum/issues/5158#issuecomment-467180434 , or mute the thread https://github.com/notifications/unsubscribe-auth/AtxOxkuwa4v_u3ooCmzBz2jFprwxj13Xks5vRE6agaJpZM4bQuM6 . https://github.com/notifications/beacon/AtxOxjQNFnsgxPEp6t7DsSt8_hVM07oSks5vRE6agaJpZM4bQuM6.gif

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467181009, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa9az7Z2GZyz6YCZHPmPt6jDN9ydWks5vRE7_gaJpZM4bQuM6.

[SomberNight]

There is no Electrum version 4.0. Where did you download from?

It was just a window that popped-up when I opened the wallet to send btc. I updated it and now I’ve been ripped off.

You avoided the question though. I assume you went to some website. There is no version 4.0 on the official website. What you downloaded is not Electrum; it's malware.

[Jack-Jordan]

Let me make this very clear for your simple simple mind to grasp.
I double clicked electrum just like normal, just like every day, and this time instead of electrum opening, it opened in the background but in the foreground was a pop-up that said I needed to upgrade/update before I could open the program. So, like 99% of everybody else, I downloaded the so-called update.
It was only until I start the transaction that I did not authorise that I became suspicious and checked the version of program, and realised there is no 4.0.
Is that simple enough for your mind to grasp?

Sent from my iPhone

On 25 Feb 2019, at 21:22, ghost43 <[email protected][e-mail]> wrote:

There is no Electrum version 4.0. Where did you download from?

It was just a window that popped-up when I opened the wallet to send btc. I updated it and now I’ve been ripped off.

You avoided the question though. I assume you went to some website. There is no version 4.0 on the official websitehttps://electrum.org/#download. What you downloaded is not Electrum; it's malware.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467188515, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa2Vk7kG2y2UhijYZkPdDTs2lJjy-ks5vRFQpgaJpZM4bQuM6.

[mdspawn]

It's a well known malware, allowing anonymous servers to show rich text messages is irresponsible in my opinion. Here is a Reddit post: https://www.reddit.com/r/Bitcoin/comments/anycg2/electrum_targeted_phishing_malware_warning/

[SomberNight]

I double clicked electrum just like normal, just like every day, and this time instead of electrum opening, it opened in the background but in the foreground was a pop-up that said I needed to upgrade/update before I could open the program.

"Let me make it very clear for you." There is no mechanism* in Electrum that would allow it to prompt you to update directly after opening, so what you had been using must not have been Electrum to start with.

(*except the one added in 3.3.3 which directs you to electrum.org, where there is no version 4.0)

[SomberNight]

It's a well known malware, allowing anonymous servers to show rich text messages

That is not what @Jack-Jordan described. He said the popup was shown directly after opening.

[QBall59]

Well, the plot thickens. I uninstalled the Electrum 4.0.0 wallet from my system. I then downloaded and installed, from Electrum.org, the official wallet 3.3.4. All good, except when I went to run the program, I got a fatal error message "failed to execute script run-electrum"... :-(

[SomberNight]

@QBall59 what operating system is this and exactly how did you "install" electrum?

[QBall59]

Windows 10. I downloaded the windows installer package from electrum.org and ran it.

[SomberNight]

can you please take a screenshot of the error message?

[QBall59]

[QBall59]

well @SomberNight, what do you make of this?

[SomberNight]

@QBall59 exactly when does this popup appear? Is it when launching Electrum before anything else appears?
Please try renaming the folder at %appdata%/Electrum to something else, and see if it works then.

[QBall59]

It appears as soon as I click on the Electrum link, that was installed on my desktop, to open the program

[Jack-Jordan]

You have been hacked my friend

Sent from my iPhone

On 25 Feb 2019, at 22:47, QBall59 <[email protected][e-mail]> wrote:

It appears as soon as I click on the Electrum link, that was installed on my desktop, to open the program

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467215475, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa079izgUb_sKNy1PGyatRJo0iDlLks5vRGfngaJpZM4bQuM6.

[QBall59]

This is a _vicious_ piece of malware...

I can't delete the files, the folder or anything. Plus, if I try to install the real program in a different folder, I get the same error message.

[QBall59]

OK. I got rid of the corrupted folder and all its files. I re-installed Electrum and it worked. However, I've still lost all the BTC in the corrupt wallet.

Question (and I know I'm probably dreaming here..): is there any way to recover stolen BTC?

[SomberNight]

I got rid of the corrupted folder and all its files.

Which folder was it specifically?

is there any way to recover stolen BTC?

No.

[QBall59]

Program Files (x86)/Electrum

[Jack-Jordan]

Search online for “stolen btc recoverers “ . I am doing it now via Skype with Igo

Sent from my iPhone

On 25 Feb 2019, at 23:11, ghost43 <[email protected][e-mail]> wrote:

I got rid of the corrupted folder and all its files.

Which folder was it specifically?

is there any way to recover stolen BTC?

No.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467222561, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMayhBG8Rmg-t_LQMshe84APBqlRjzks5vRG21gaJpZM4bQuM6.

[QBall59]

who or what is Igo? Also, I've got the complete transaction records for both thefts from blockexplorer.info, if that's of any use...

[SomberNight]

Search online for “stolen btc recoverers “ . I am doing it now via Skype with Igo

be careful not to get scammed twice in a row :/

[QBall59]

@SomberNight I don't think I downloaded a corrupted or hacked version of the wallet. I installed it on my computer 6 months ago, and had made other transactions with no problems whatsoever. What happened today is somehow, some way, a pop-up window managed to force me to install the malware 4.0.0 version of the wallet. This security breach needs to be identified and fixed ASAP.

[Jack-Jordan]

Me too We are probably dealing with the same guy, and it seems like a scam to me

Sent from my iPhone

On 25 Feb 2019, at 23:35, ghost43 <[email protected][e-mail]> wrote:

Search online for “stolen btc recoverers “ . I am doing it now via Skype with Igo

be careful not to get scammed twice in a row :/

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467228583, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa0s9nsIG_8HPks_ZepMFUAlhXWLSks5vRHMvgaJpZM4bQuM6.

[Jack-Jordan]

Exactly

Sent from my iPhone

On 26 Feb 2019, at 00:29, QBall59 <[email protected][e-mail]> wrote:

@SomberNighthttps://github.com/SomberNight I don't think I downloaded a corrupted or hacked version of the wallet. I installed on my computer 6 months ago, and had made other transactions with no problems whatsoever. What happened today is somehow, some way, a pop-up window managed to force me to install the malware 4.0.0 version of the wallet. This security breach needs to be identified and fixed ASAP.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467241310, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa02uLryHFTxOGA-XVOJ6j-Az0sRUks5vRH_NgaJpZM4bQuM6.

[SomberNight]

What likely happened is that when you broadcasted a transaction, you got an error message. Until recently, this error message could contain arbitrary text, and some malicious servers started sending errors that told people to install malware. See https://github.com/spesmilo/electrum/issues/4968

What @Jack-Jordan described about the popup that appeared directly after opening Electrum however is something different, and I can't imagine how that could have happened.

[QBall59]

What happened to Jack-Jordan is the exact same thing that happened to me.

Also, if memory serves me correct, I downloaded Electrum from the Bitcoin.org site, so I doubt the version I got there was malware.

[SomberNight]

Do either of you know what version of Electrum you had when you saw this popup?

[Jack-Jordan]

Exactly. Some people are just low iQ, dumbasses can’t understand things. Not their fault

Sent from my iPhone

On 26 Feb 2019, at 00:51, QBall59 <[email protected][e-mail]> wrote:

What happened to Jack-Jordan is the exact same thing that happened to me.

Also, if memory serves me correct, I downloaded Electrum from the Bitcoin.orghttp://Bitcoin.org site, so I doubt the version I got there was malware.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467246368, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa0uHcg7Vv2yg22gC8J3-yo_6AQHbks5vRIT8gaJpZM4bQuM6.

[Jack-Jordan]

I had like 3.4.4 then it told me I needed to upgrade to 4.0, before they would even open the program electrum

Sent from my iPhone

On 26 Feb 2019, at 00:53, ghost43 <[email protected][e-mail]> wrote:

Do either of you know what version of Electrum did you have when you saw this popup?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467246884, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa9VOCl5eB6nURadO7HlREfP2YC17ks5vRIVygaJpZM4bQuM6.

[SomberNight]

I had like 3.4.4

There is no 3.4.4, so then you already had malware.

[Jack-Jordan]

3.3.3 whatever man jeez

Sent from my iPhone

On 26 Feb 2019, at 00:54, ghost43 <[email protected][e-mail]> wrote:

I had like 3.4.4

There is no 3.4.4, so then you already had malware.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467247257, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMawK394jRt5u2t7aTNIZemk0wWOzzks5vRIXOgaJpZM4bQuM6.

[Jack-Jordan]

I got it from bitcoin.orghttp://bitcoin.org as well or whatever

Sent from my iPhone

On 26 Feb 2019, at 00:54, ghost43 <[email protected][e-mail]> wrote:

I had like 3.4.4

There is no 3.4.4, so then you already had malware.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467247257, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMawK394jRt5u2t7aTNIZemk0wWOzzks5vRIXOgaJpZM4bQuM6.

[QBall59]

@SomberNight I had 3.3.4. installed.

[Jack-Jordan]

That’s the one. Had it also.

Sent from my iPhone

On 26 Feb 2019, at 00:56, QBall59 <[email protected][e-mail]> wrote:

@SomberNighthttps://github.com/SomberNight I had 3.3.4. installed.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467247651, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMaycHmg2UY9xPuR1gEqNNDI3hsI-Fks5vRIY7gaJpZM4bQuM6.

[SomberNight]

@Jack-Jordan lol. so far you have named three different versions. I am asking for a reason you know.

[Jack-Jordan]

I know bud. Look I’m stoned yeah, I knew there was a bunch of 3’s and a 4 in there. But not 4.0
Kitkat time - give me a break

Sent from my iPhone

On 26 Feb 2019, at 00:57, ghost43 <[email protected][e-mail]> wrote:

@Jack-Jordanhttps://github.com/Jack-Jordan lol. so far you have named three different versions. I am asking for a reason you know.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467247918, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa9FnEaKs5g-Yv5kkNLyaGNS4ioUHks5vRIaCgaJpZM4bQuM6.

[SomberNight]

@QBall59

I don't think I downloaded a corrupted or hacked version of the wallet. I installed it on my computer 6 months ago,
I had 3.3.4. installed.

but 3.3.4 was only released like 2 weeks ago :/

[QBall59]

Then it was 3.3.3.

[SomberNight]

3.3.3 was released 2019-01-25

[QBall59]

I originally downloaded and installed the wallet on August 16 of last year, so it was whatever version was current at that time.

[SomberNight]

Ok. That would be 3.2.2

[AbdussamadA]

@SomberNight these two are the same person and he's trolling you. Both accounts signed up at the same time and as you can see what they are saying doesn't make sense. I suggest locking this thread.

[Jack-Jordan]

I’m pretty sure you are the theif, looking st your ip and nat.table ... idiot. Why even talk here?? Guilty conscience??

Sent from my iPhone

On 26 Feb 2019, at 12:21, Abdussamad Abdurrazzaq <[email protected][e-mail]> wrote:

@SomberNighthttps://github.com/SomberNight these two are the same person and he's trolling you. Both accounts signed up at the same time and as you can see what they are saying doesn't make sense. I suggest locking this thread.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467417658, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa4x2a-wZ4L6hyxqaZXkKSwRBmZrKks5vRSbWgaJpZM4bQuM6.

[QBall59]

@AbdussamadA I'm pretty sure SomberNight can simply look at our IP addresses and know we are not the same person. As Jack-Jordan says, you're probably the thief, except I doubt you even have a conscience...

[Jack-Jordan]

Lmfao- this guy gets it!

Sent from my iPhone

On 26 Feb 2019, at 12:39, QBall59 <[email protected][e-mail]> wrote:

@AbdussamadAhttps://github.com/AbdussamadA I'm pretty sure SomberNight can simply look at our IP addresses and know we are not the same person. As Jack-Jordan says, you're probably the thief, except I doubt you even have a conscience...

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-467422716, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMaxt2KO9fYesquMqUMR5HszPTcj7Wks5vRSsGgaJpZM4bQuM6.

[SomberNight]

pretty sure SomberNight can simply look at our IP addresses

I am not an admin at github.

In any case, there is nothing we can do regarding already stolen coins.

[QBall59]

@SomberNight Can you do anything to make sure it doesn't happen to anyone else? Are you involved with the development of Electrum? I still have no idea how this happened, and it certainly doesn't make me want to use the Electrum wallet again!

[Jack-Jordan]

funny how the 18 other comments after this last one of mine being flamed by some dork Who is in all likelyhood the theif...... just STFU and stop robbing people man. Idiot.

[Jack-Jordan]

funny how the 18 other comments that were after that last qball dork got deleted... lil suspicious? aint that a lil suspicious, just a little bit suspicious......... every single flaming you with evidence gets deleted. Prickend. Go choke on you knobcheese

[QBall59]

Jack darling… I got ripped off for about USD 850 the same way you did. I will not use the Electrum wallet ever again.

[etcrypto]

Electrum should publish about that matter.
The SAME situation Here
and this is was after downloading from the official site !!

[Jack-Jordan]

What’s the point, can’t recover so....

Sent from my iPhone

On 18 Mar 2019, at 16:19, etcrypto <[email protected][e-mail]> wrote:

Electrum should publish about that matter.
The SAME situation Here!
and this is was after downloading from the official site !!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-473986142, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa7BTGCTNNOo2nslvezhYvC2An1wtks5vX7yKgaJpZM4bQuM6.

[Jack-Jordan]

What possible good can come from publishing

Sent from my iPhone

On 18 Mar 2019, at 16:19, etcrypto <[email protected][e-mail]> wrote:

Electrum should publish about that matter.
The SAME situation Here!
and this is was after downloading from the official site !!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-473986142, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa7BTGCTNNOo2nslvezhYvC2An1wtks5vX7yKgaJpZM4bQuM6.

[etcrypto]

Informing others to not use that crappy wallet.

Personally, im going to switch to other wallets and trying to convince others to do so

[SomberNight]

and this is was after downloading from the official site !!

Please copy-paste the exact URL you've downloaded from.
Also, what exactly do you claim to have happened and when?

[Jack-Jordan]

Was a pop up when I opened my Electrum wallet to upgrade. I clicked ok. Within 6 mins my account was drained.

Sent from my iPhone

On 18 Mar 2019, at 17:12, ghost43 <[email protected][e-mail]> wrote:

and this is was after downloading from the official site !!

Please copy-paste the exact URL you've downloaded from.
Also, what exactly do you claim to have happened and when?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/spesmilo/electrum/issues/5158#issuecomment-474012658, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AtxMa2dog36SHqoGpGDUlw_smCw9yzhYks5vX8j0gaJpZM4bQuM6.