Monero’s community wallet recently fell victim to a shocking and suspicious security breach. The incident, which occurred on September 1st, was only made public on November 2nd through GitHub. The company is currently investigating the breach, as the source of the attack remains unidentified. According to Monero’s developer, Luigi, a total of 2,675.73 XMR (equivalent to approximately $460,000) was stolen. Luigi stated, “The CCS Wallet was drained of 2,675.73 XMR (the entire balance) on September 1, 2023, just before midnight. The hot wallet, used for payments to contributors, is untouched; its balance is ~244 XMR. We have thus far not been able to ascertain the source of the breach.”
Developers Investigate the Incident
The developers, Luigi and Ricardo “Fluffypony” Spagni, are the only individuals with access to the seed phase. They have released a timeline of events and potential scenarios related to the security breach. The wallet was created in 2020 as a means to fund development proposals from community members for advancing the platform. From 2020 to 2023, a single Ubuntu system was utilized to run a Monero node with a hot wallet on a Windows 10 Pro Laptop. On May 10, 2023, Luigi made the final transfer from the CCS wallet to the hot wallet. Between September 1st and September 2nd, a series of nine transactions occurred, resulting in the depletion of all assets. Luigi discovered the hack when he logged into the CCS wallet and found a mere 4.6 XMR, which had been received as a previous donation from Lovera. The team is in a state of shock over recent developments and is focused on determining how the breach occurred and assessing the future of the CCS alongside its structure. Fluffypony suggested that wider attacks, possibly stemming from compromised keys, may have played a role. He also mentioned the importance of taking precautions to ensure the safety of other wallets.
Losses and Community Response
The cryptocurrency market has experienced numerous incidents involving malicious actors resulting in the loss of clients’ funds. While some losses are eventually recovered through tracing, forensics, and negotiations with hackers, others remain irretrievable. Monero’s community has expressed shock and sadness over the security breach but remains resilient in finding effective solutions and implementing new methods to prevent future occurrences. The community members are grateful to the developers for their transparency throughout this ordeal. One community member, “lazios,” offered an alternative perspective on the incident, suggesting that Luigi makes payments from the hot wallet and occasionally tops it up from the CCS wallet via SSH. This raises concerns about the security of the CSS wallet, as the compromise may have occurred if the private keys were stored on an online Ubuntu server.
“Luigi makes payment from the hot wallet and tops it up from CSS Wallet (via SSH), occasionally as needed. Does this mean that the private keys for the CSS wallet are on an online Ubuntu server? If yes, that’s where the compromise happened.” – lazios
