Announcing a Return to our Roots: The All-New Bitcoin Magazine
Verified on Created with Sketch. Verified on

Popular Ether Wallet MEW Is Hijacked in DNS Attack


        Popular Ether Wallet MEW Is Hijacked in DNS Attack
Popular Ether Wallet MEW Is Hijacked in DNS Attack

MyEtherWallet, a popular web-based wallet for storing and transmitting the cryptocurrency ether (ETH), suffered a DNS attack that rerouted unsuspecting users to a Russian scam site into which some victims fed their login credentials.

An unsigned SSL certificate warned users before entering the phony site but some bypassed the warning, resulting in a loss of funds. MyEtherWallet confirmed the attack in a statement on April 24, 2018.

Hackers did not actually hack the MyEtherWallet platform itself but went after vulnerabilities in public-facing DNS servers instead. MyEtherWallet recommends users switch to Cloudflare DNS servers for the time being.

DNS servers provide the correct IP address for an internet site’s name. If you type in “,” a DNS server will translate that into the IP address for that site. An SSL certificate protects against spoofed DNS answers by comparing the hostname you enter with the hostnames listed in the certificate. If no match is found, an SSL warning pops up.

Normally when users attempt to visit, they are directed to Amazon Web Services, which hosts the site. But this time, according to cybersecurity firm CloudFlare, they were directed instead to a set of Russian IP addresses.

According to Oracle's Internet Intelligence division, the hacker was able to hijack DNS entries after executing a BGP (short for Border Gateway Protocol) route hijack that redirected internet traffic meant for Amazon servers. BGP, a routing protocol used by the internet, is known for its vulnerabilities. Most of the affected users were employing Google’s recursive DNS service.

“Little did we know this was part of an elaborate scheme to use the inherent security weaknesses of DNS and BGP to pilfer cryptocurrency, but that remarkable scenario appears to have taken place,” Oracle’s Doug Madory wrote in a blog post.

DNS hijacks are not uncommon. Earlier this year, hackers hijacked the DNS server for, a web-based wallet for the Stellar Lumens cryptocurrency, redirecting $400,000 worth of lumens (XLM) to their own server. In late 2017, EtherDelta was also the victim of a DNS hijack, resulting in the loss of at least $267,000 in funds.


Security Researchers Reveal Wallet Vulnerabilities On Stage at 35C3

The companies behind the hardware wallets claim not to have been given an opportunity to fix the vulnerabilities via responsible disclosure practices prior to the announcement.

Jimmy Aki

A Bug Making Ethereum Transactions on Exchanges Vulnerable Has Been Fixed

A bug centering around a new Ethereum token, GasToken, which was enabling abuse on cryptocurrency exchanges, appears to have been resolved.

Nick Marinoff

Target and Google Official Twitter Accounts Hacked, Used for Crypto Scams

In what is becoming an emerging trend, Twitter accounts of popular brands are being hacked in an attempt to scam unsuspecting users out of their cryptocurrencies.

Jimmy Aki

New Exchange Security Scoring Model Offers Insurance Rates for Coin Holders

The new model will allow exchange users to cover up to 15 BTC worth of digital assets held in their exchange accounts at rates that will depend on the security level of the exchanges they choose to use.

Jimmy Aki