Cyber Incident Victim: Monero
Date:
Nov 2019
Location:
United States of America
Summary
The official Monero website was compromised to distribute malware-infected cryptocurrency wallet software, leading to theft of user funds. Attackers altered a Linux binary installer available for download, with the breach discovered after a user detected a hash mismatch between the downloaded file and legitimate versions. The malicious file actively stole funds from victims' accounts, resulting in at least one confirmed loss of $7,000. The compromise occurred during a specific window of time before being mitigated, with the project team confirming the incident, advising hash verification, and restoring secure downloads through an alternative source while continuing their investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 18, 2019, the official Monero cryptocurrency website was compromised, leading to the distribution of a malware-infected file designed to steal funds from users. The breach was discovered when a user downloading the 64-bit Linux CLI binary from the site noticed a discrepancy between the SHA256 hash of the downloaded file and the legitimate hash provided on the platform. This mismatch indicated unauthorized tampering with the file. The user reported the issue on GitHub, prompting an investigation by the Monero team, who confirmed the compromise via a public tweet on November 19. The malicious binary, available for download during the attack window, replaced the genuine installer and contained code capable of siphoning cryptocurrency from victims’ wallets. The compromise occurred between 2:30 AM and 4:30 PM UTC on November 18, during which the attacker(s) altered the file hosted on the official download server.
The Monero team responded by urging users to verify file hashes before executing downloads and advising against running any suspicious files. Despite these warnings, at least one user reported a financial loss of $7,000 due to executing the compromised binary. The team redirected downloads to a fallback source, confirming that files from this alternate location were secure. An investigation into the breach remained ongoing at the time of reporting, with no additional details disclosed about the intrusion vector or perpetrator. The infected file was made available for analysis at a third-party hosting site, accompanied by a VirusTotal scan link to aid in reverse-engineering efforts. The incident underscored operational risks associated with unverified software downloads, even from trusted official sources.