Famous Ethereum wallet interface MyEtherWallet was recently compromised by a Domain Name System (DNS) theft attack that allowed a hacker to fool users to a mischievous version of the website thus making it possible to steal secret information from customers’ accounts.
The incident was first posted on social media by users saying the breach is also affecting the platform, and MyEtherWallet responded on Twitter saying, “Couple of DNS servers were hijacked to resolve myetherwallet.com users to be redirected to a phishing site,” the company said. “This is not on @myetherwallet side; we are in the process of verifying which servers to get it resolved ASAP.”
It is still not known how the hackers were able to access MyEtherWallet’s Domain Name System, but this has not the first occasion for such attacks to occur on cryptocurrency-related websites.
In earlier attacks, the hackers made use of users’ private information to access their MyEtherWallet client.
From the look of things, the attacker got away with close to 215 ETH ($150,000) from the attack which went on for about several hours. For one unlucky user, about 85 ETH ($60,000) was stolen.
Coins that were hijacked during the attack have been channeled into a wallet, which has about $17 million in ETH and has been connected to past attacks.
Users who entered the illegal website with a hardware wallet such as Trezor were safe from the private key attack, even though the website could have taken over the real address they were trying to send their coins with a fake one operated by the hacker.
For users to be safe, it is advised that they download a browser extension that keeps a blacklist of mischievous websites.