A bad season for Bitcoin security

Bitcoin itself did not break. The companies, wallets, servers and people around it did.

• Coldcard, July and August. A firmware bug from 2021 meant some Coldcard hardware wallets made seeds with far less randomness than they should have. Attackers worked through the possible seeds and swept about 1,800 bitcoin from thousands of addresses. Seeds made with dice rolls were safe.
• BTCPay Server, August and November. The payment server many merchants run for themselves was hit twice: Lightning node credentials in August, then hot wallets on servers that had not been updated since, from 1 November. BTCPay's own notice points to "the rise in automated attacks using AI".
• Electrum, October. Rogue Electrum servers hid users' outgoing payments and showed them a fake, stuck payment to the attacker instead. When the user bumped the fee, they signed the theft. Electrum 4.8.3 fixed it on 24 October.
• Ledger, October. A criminal group opened genuine Ledger devices, fitted a hidden chip that read the recovery phrase during setup, and put them back on sale through resellers in South East Asia.
• Binance, 29 October. US$6.3 billion stolen from the world's largest crypto exchange. Binance says the attackers planted a fake download of an AI coding tool, ran fake job interviews, then moved through its internal AI tools to the system that authorises its wallet transactions.

The common thread is speed and scale. Attacks that once needed a skilled team and months of patience now run as AI-powered tooling, day and night, for very little cost and effort.

Bloomberg reported in October that criminals get AI models to help by telling them they are running an authorised penetration test.

What it looked like at Bitaroo

Over the past few weeks we have been attacked more than in the previous several years combined.

• Fake accounts. More than 70,000 fake accounts were opened in four days. Some used the email addresses of the people who write our articles, and phishing emails to those addresses followed.
• Stolen passwords. Lists of email addresses and passwords were tried against our sign-in, one guess per account. These lists did not come from Bitaroo. They are built from breaches at other companies and from malware that steals passwords saved on home computers. Qantas (5.7 million people), Origin Energy (900,000) and, this month, an Australian online retailer have all lost personal details. Those leaks were mostly names and email addresses, not passwords, but an email address tells an attacker where to try a password stolen somewhere else. The few right guesses we found were stopped by two-factor authentication (2FA).
• PIN guessing. One night, an automated run tried to guess app PINs on more than 150 accounts. It guessed none. Accounts it tried too often were locked until their owners contacted us. Along the way it opened accounts of its own, named "Q A", with email addresses starting with "probe". Our reading: whoever ran it told their AI it was doing quality testing on a system it was allowed to test. The AI does not seem to have known it was attacking us.
• Seed scanners. Our public Electrum server was flooded. More on that below.
• Our content website was targeted too, by everything from brute-force sign-in attempts to phishing.

Thanks to our engineering team, no user lost funds and no account was taken over.

Seed scanners, and why choosing the right Electrum server matters

A light wallet does not download the blockchain. It asks an Electrum server what each of its addresses holds. Scanners abuse that.

They generate huge numbers of candidate seeds and keys (weak ones, leaked ones, ones made by faulty software) and ask the server whether any of the matching addresses hold funds. When one does, they sweep it.

It is the Coldcard attack in miniature.

Over one weekend in October, a single tool that called itself a "sweeper hub" reached our server from about 3,600 rotating addresses.

It opened up to 1,600 connections a minute, and we turned away nearly 3 million attempts in 33 hours.

At its peak the flood overflowed the server's work queue, so honest wallets were turned away too.

Our server now refuses scanners by name and by behaviour, and limits how fast any one network can connect.

Running your own node is still best.

If you cannot, the server you choose matters. A random public server can record every address you ask about, and October's Electrum attack showed it can also lie to you about what you are signing.

Ours is the middle ground: a server run by an Australian exchange with its name on it, rather than an anonymous stranger.

The Bitaroo Wallet (available in the Bitaroo Express App) uses it by default, and any wallet that lets you choose an Electrum server can connect to it.

If you use the Electrum desktop wallet, update to 4.8.3 or later, whichever server you use.

Some of the things we did

• Signing in and signing up from VPNs, proxies and hosting networks are now blocked.
• Repeated wrong passwords or PINs lock the account.
• If an account without 2FA signs in from a new IP address, we email a sign-in code first.
• IP addresses that fail sign-ins on several accounts are blocked automatically.
• Wrong 2FA codes are now counted everywhere we ask for one, withdrawals included.
• Sign-up checks are tougher, and our sign-in services refuse malformed requests.
• Our Electrum server refuses scanners.
• Sign-in and publishing on our content website are locked down.

Most of these went live within minutes or hours, and at most days, of the attack that prompted them.

Privacy focused. Security minded.

That line is on our home page, and we mean both halves. Bitcoiners use VPNs for good reasons, and many of you do.

But VPNs, proxies and hosting networks let one attacker look like thousands of different people. Blocking sign-in and sign-up from them stopped most of the attacks above. When we had to choose between privacy and security, we chose security.

If you use a VPN, switch it off to sign in or sign up. Our Help Centre explains what you will see and what to do.

What you can do

1. Restrict your withdrawals. Approve the IP addresses that can withdraw, set a 24 hour limit, or both. Changes that loosen either one are delayed, so a thief cannot switch them off and withdraw on the spot. Here is how.
2. Use an email address only for Bitaroo. Your everyday address has very likely turned up in a leak by now. An address you use only here is on nobody's list, and any email to it that claims to be from someone else is a phish.
3. Use a strong password you use nowhere else. A password manager makes this easy. A stolen password only works where it has been reused.
4. Turn on 2FA with an authenticator app, but not Google Authenticator. Google Authenticator can sync your codes to your Google account, and anyone who signs in to that account on their own phone gets your codes too. If that account is also your Gmail, they get your password reset emails as well. Two factors become one. We have seen Bitaroo users lose bitcoin this way. Choose an app that keeps your codes on your phone, or backs them up encrypted with a password only you know. An emailed code is only as safe as your inbox.
5. Protect your email account. Give it its own strong password and its own 2FA. Whoever controls your inbox can reset almost everything else.
6. Treat unexpected emails as alarms. A sign-in code or a "new IP address" email you did not ask for means someone has your password. Change it straight away.
7. For self-custody, make your seed with dice or on a device you trust, buy hardware wallets directly from the maker, check the address on the device's own screen before you sign, and keep your wallet software up to date.

Last word

We will keep adding defences, and now and then one of them will get in your way.

We would rather explain a blocked sign-in than an empty account.

If anything on your account looks wrong, contact us through the Help Centre.

For more, read keeping your account secure.