With IOTA-wallet stolen $4 million
Two days ago, the members of the IOTA community reported the thefts totaling "a minimum of $3.94 million." All of them have used the services of sites to generate a seed phrase, which is perhaps the scammers and received information to access the wallets.
When you open a new IOTA-wallet users create 81-digit seed-phrase, and this function is not built into the wallet. The website HelloIOTA describes a few helper methods including IPFS-generator or key generation using a Mac - and Linux terminals. However, all these services are quite user-friendly, that is difficult for beginners, so they are forced to use online generators.
Many users who lost their money, established their seed-phrase on the website iotaseed.io. The website asks users to move the cursor to "random generate", and then provides a seed-a phrase that meets the requirements of the IOTA-wallet. After the news about the attack this website ceased operations.
In a post on Medium under the title "What happened last night at IOTA" explains that the hackers have carried out DDoS-attack on certain nodes IOTA, thus not giving users the ability to save their money. Moreover, the attackers knew all the seed-phrase.
Currently, the community operators full gcd discusses various strategies for protecting the public nod from such DDoS attacks in the future, and IOTA-community urged users to change seed data. Also, the community noted that the vulnerability had nothing to do with the technology of IOTA, and is provoked by the seed services-generators.
22 Jan
The Wolf
@WolfOfPoloniex
Never liked IOTA...https://www.ccn.com/a-number-of-iota-wallets-emptied-by-hackers-due-to-online-seed-generators/ …
Bullion Baron
@BullionBaron
Why?
If people were putting their private key for a Bitcoin wallet into some other website they found randomly, would you blame Bitcoin?
8:25 - 22 Jan. Two thousand eighteen
3 3 answer 1 Retweet 1 58 58 marks "Like»
Information about advertising in Twitter and privacy
"If you send your private key from bitcoin wallet on a randomly selected site, then also to blame bitcoin?»
However, the network was divided, and many blamed for what happened to the purse, saying that the generator is really needed and should be built. According to one of the users, the seed generator is included in the planned enhancements of the platform:
22 Jan
Victor Pinho
@Vict_r
Reply to user @BullionBaron @WolfOfPoloniex
This is next-level bad UX, their wallet should have a built-in generator, how hard was that? Add that to the fact that it's unsecure to use an IOTA address more than once.
Bullion Baron
@BullionBaron
The wallet definitely needs improving and is underway, including a seed generator.
The single use address (only if sending from) is a FEATURE i.e. Winternitz one-time signatures are expected to Quantum-proof the network.
8:35 - Jan 22. Two thousand eighteen
3 3 1 1 retweet 9 9 marks "Like»
Information about advertising in Twitter and privacy
"The wallet is definitely need improvement and work on them is already underway, including seed-generator".