1/ Speculations for IOTA user Trinity wallet coin stolen attack
Due to the recent coin theft of many users' Trinity wallets, IOTA has suspended the mainnet coordinator for ceasing the attack, investigating, and repairing specific problems. @evilcos @iotatoken
Due to the recent coin theft of many users' Trinity wallets, IOTA has suspended the mainnet coordinator for ceasing the attack, investigating, and repairing specific problems. @evilcos @iotatoken
2/ This is a classic attack that is underestimated. The official claims did not disclose specific details of the attack, but through our analysis, we can make some important speculations. First of all, a few points can be made clear:
3/ 1st, It's not a problem of the IOTA blockchain protocol; it's a problem of IOTA's Trinity desktop wallet (from official claims, believe it first).
4/ 2nd, This desktop wallet is based on Electron (a framework for building desktop applications using JavaScript as the core), meaning that the core code is written in JavaScript.
5/ 3rd, When doing a diff analysis of the new and old version of the wallet, It was found that MoonPay, a built-in exchange function module, was removed.
6/ The key point was to remove a terrifying piece of code:
const script = document.createElement ('script');
script.src = 'https//cdn.moonpay.io/moonpay-sdk.js';
document.write (script.outerHTML);
const script = document.createElement ('script');
script.src = 'https//cdn.moonpay.io/moonpay-sdk.js';
document.write (script.outerHTML);
7/ If this third-party JavaScript link was malicious or hacked for malicious purposes, then it can be considered that the desktop wallet had completely fallen into enemy hands. At this point, we have reasons to believe that this is a large time bomb.
8/ If this time bomb has really already exploded, then it is in line with some official speeches and explanations, such as: upgrade to the new version of Trinity desktop wallet as soon as possible and change the password as quickly as possible.
9/ Transfer assets to a secure seed as soon as possible, etc. We can wait and see the official follow-up disclosure.
