Exodus Bitcoin Wallet: $490k swindle
popey.com
Exodus Bitcoin Wallet: $490k swindle
1–10 of 297 posts
Re: Exodus Bitcoin Wallet: $490k swindle
#2A rather hilariously appropriate app name.
Re: Exodus Bitcoin Wallet: $490k swindle
#3Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.
Re: Exodus Bitcoin Wallet: $490k swindle
#4Well, that's really unfortunate. I would never just go download a random crypto app, not even from the Apple App Store. But the "Safe" marker is a massive UI risk. It makes me think it was signed and verified in some way.
Re: Exodus Bitcoin Wallet: $490k swindle
#5What I don't get about the Snap store is why there's no verified link back to a website?
If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record.
That way the Snap store could say "This app came from this website."
OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give normal users a chance to check out who the author is.
That seems to be how Flathub works. It shows a verified domain, or prominently says that it is a community released app.
Re: Exodus Bitcoin Wallet: $490k swindle
#6Even the real version is the app is a software wallet right? If you have almost 500k in BTC and do not have it on a hardware wallet and use their official software for it, I have to say it's at least partially on you if you lose it.
It wouldn't matter. If your seed phrase is exposed, you lose all funds.
Re: Exodus Bitcoin Wallet: $490k swindle
#7[flagged]
Re: Exodus Bitcoin Wallet: $490k swindle
#8One point I would make:
> it connects to some API at https://www.exchangerate-api.com/
This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated.
You also said:
> Visiting one of those IPs redirects to https://www.exchangerate-api.com/
It is common for malicious sites to redirect to legitimate sites to help evade detection, so it is possible that exchangerate-api.com is an unrelated and legitimate site.
Re: Exodus Bitcoin Wallet: $490k swindle
#9This is scary and even a hardware wallet might not help.
When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses.
But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And since I and most people mainly check the address we are sending to but don’t pay close attention to the change address, we could end up having our funds stolen that way.
I’ve been thinking about moving to a multisig setup instead, that would have multiple computers independently used for checking and signing the transactions.
So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. But now I think moving to a multisig setup is something me and more people should do sooner rather than later.
Re: Exodus Bitcoin Wallet: $490k swindle
#10[flagged]
Clearly you didn't RTFA. This mistake was on Canonical / is due to a lack of vetting in the Ubuntu app store.