Electrum vulnerability can lead to all your Bitcoin stolen
Users who have a wallet created in the Electrum Software should close the application immediately, because a very serious vulnerability has been found in this utility.
This is very important information for all those who use a wallet based on Electrum software and it is that an important vulnerability has been found, which potentially allows any random web page to steal the capital that is available in an Electrum wallet using JavaScript . This very important security problem not only affects the wallet, but also the derivative Altcoins, such as Electron Cash. Those users who do not use Electrum or any derivative for cryptocurrencies, are not affected and do not have to fear.
The steps to follow are the following:
- If you are running Electrum, you should shut it down immediately.
- Upgrade Electrum to version 3.0.4, making sure to verify the PGP signature.
We must not run to update either, since in cases like this, it may even be prudent to wait some time to update and operate again, to verify that the problem has been completely resolved. The most important thing is that old wallets to the mentioned version are not used. Before reopening the wallet, we must update it.
If at some point in the past you have opened Electrum without entering the established password and had an open website, it is possible that the wallet you are using is compromised, although there is no security in this regard. It is not necessary that you go crazy either, since if you have Bitcoin in an Electrum wallet and you have not been stolen, it is possible that no one has accessed, although you can also send the capital to a wallet in a pool, momentarily for security.
The problem has been fixed a few hours ago. The Electrum developer, known as ecdsa on GitHub, will release new information and more detailed instructions shortly in the near future.
More information has been given and it is that apparently if there is no password, it is possible that the theft has occurred, but if we had a secure password, it is possible that the attacker could only have access to basic information, such as the address of the wallet or transactions, as well as changing Electrum settings, the latter of which appears to have a high probability of being exploitable. This takes away some of the fears that you may have.
Source: BitcoinTalk
