215 ETH: Hackers Hit Internet’s Core Infrastructure to Swindle Ethereum Users

Pratik Makadiya
  • Hackers managed to hit the internet's core infrastructure to swindle Ethereum users out of 215 ETH.
  • The attack saw MyEtherWallet's website redirect users to a fraudulent one where hackers gained access to user's private keys.

Ethereum wallet interface MyEtherWallet (MEW) recently saw its DNS redirect users to a phishing website. The redirections were traced to an IP address in St. Petersburg, Russia. Though the attack wasn't specifically targeting the cryptocurrency website, 215 Ether tokens (about $130,000) were stolen from Ethereum users.

Redditor Sounds The Alarm

A Redditor with the username u/MickySocaci notified the r/Ethereum community about the ordeal through a post titled “[WARNING] MyEtherWallet.com highjacked on Google Public DNS.”

The post warned MyEtherWallet users that they should to stay away from the service’s website as some DNS servers were resolving to another domain that would then steal their private keys. In a later update, the Redditor warned other users the problem was being fixed, and edited his thread. It reads:

“Google Public DNS is now resolving the correct IPs. Keep in mind the TTL of the old records was some 9000 seconds, we can expect some ISP’s to cache that for their clients.”

MickySocaci

MyEtherWallet confirmed the event on Twitter and assured users that things were being taken care of.

Though the MyEtherWallet platform doesn't store Ethereum wallet users’ private keys, it is still possible for cybercriminals to get them by redirecting users to a phishing website - a perfect replica of MyEtherWallet’s website – and getting them to enter their keys. Once users try to access their wallets, criminals get access to their funds

Internet Core Infrastructure Hit

The hackers didn’t specifically target MEW, but according to reports attacked the internet’s core infrastructure, and intercepted DNS requests for the wallet interface, to make sure their server appeared to be its rightful owner. Per The Verge, the hackers’ attack affected services provided by major internet companies like Google and Amazon. The publication wrote:

“Most of the affected users were employing Google’s 8.8.8.8 DNS service. However, because Google’s service is recursive, the bad listing was likely obtained through an forged communication with Amazon’s “Route 53” system.”

The Verge

On Etherscan the stolen funds were traced and the address containing them wax tagged as “Fake_Phishing899”. They were subsequently sent to a wallet with $17 million worth of Ethereum in it, which presumably belongs to a cryptocurrency exchange.