Reports said the software available for download on the official website of Monero (XMR) would have been compromised in order to steal cryptos. This information was made public by the currency development team which suspects that the command terminal tools available on getmonero.org have been compromised in the last 24 hours. The team relied on the fact that the hashing of the binary files available on the platform was different from the original.
To confirm this impression, a professional auditor named Serhack stated on Github that the software available after the server compromise was actually malicious: "I am able to confirm that the malicious file actually steals from cryptos. Only 9 hours after the script was executed, only one transaction emptied the portfolio."
A warning has, therefore, been sent to Reddit, which published the first article on hacking, for the attention of all users: "If you have downloaded binary files in the last 24 hours, check the integrity of the files. If the hashes do not match the ones expected, do nothing."
Time for strict security approach
Hashes are non-reversible mathematical functions. In this case, they are used to generate alphanumeric strings from a file. If the file is modified, the result of the hash is different. It is common practice in open-source communities to save the generated hash from downloaded software and keep it on a separate server. This allows users to generate the hash from the downloaded file and compare it to the expected hash.
If the hash generated from the file is different, there is a high probability that the version available for download has been replaced by a possible illegal variant. It should be noted that, in order to strengthen the reliability of blockchain networks, some organizations have initiated premium systems ("Bounty") to reward White-Hat hackers who would make public the discovered vulnerabilities.
It is currently impossible to estimate the number of users affected and the amounts that may have been stolen. Funds that will probably never be recovered because of the very nature of Monero. Unlike Bitcoin, which allows you to track all transactions, including the source, destination and amounts exchanged, Monero is a private cryptocurrency. Only the sender knows the details of the transaction. One of the features that has made its success, Monero is in the 13th position of the most important cryptocurrencies in terms of capitalization, which is about $1 billion.
