Monero’s community wallet loses all funds after attack

A recent hack destroyed the entire balance of 2,675.73 Monero XMR, or about $460,000, in Monero's community crowdfunding wallet.

Though it happened on September 1, Monero developer Luigi didn't reveal the event until November 2, he disclosed the information on github. He said that it is yet unknown where the breach originated.

The CCS Wallet was drained of 2,675.73 XMR (the entire balance) on September 1, 2023, just before midnight. The hot wallet, used for payments to contributors, is untouched; its balance is ~244 XMR. We have thus far not been able to ascertain the source of the breach.”

Monero’s Community Crowdfunding System (CCS) funds development proposals from its members. “This attack is unconscionable, as they’ve taken funds that a contributor might be relying on to pay their rent or buy food,” noted in the thread Monero’s developer Ricardo “Fluffypony” Spagni. 

Access to the wallet seed phrase was limited to Luigi and Spagni alone. In 2020, the CCS wallet and a Monero node were installed on an Ubuntu system, according to Luigi's post.

Luigi used a hot wallet that has been installed on a Windows 10 Pro desktop since 2017 in order to send money to other community members. The CCS wallet provided funding for the hot wallet when needed. Nonetheless, nine transactions were made using the CCS wallet on September 1. The core group of Monero is requesting that its existing liabilities be paid for by the General Fund.

“It’s entirely possible that it’s related to the ongoing attacks that we’ve seen since April, as they include a variety of compromised keys (including Bitcoin wallet.dats, seeds generated with all manner of hardware and software, Ethereum pre-sale wallets, etc.) and include XMR that’s been swept,” Spagni noted in the thread.

Other developers speculate that the wallet keys' open availability on the Ubuntu server may have been the source of the leak.

“I wouldn’t be surprised if Luigi’s Windows machine was already part of some undetected botnet and its operators performed this attack via SSH session details on that machine (by either stealing the SSH key or live using trojan’s remote desktop control capability while the victim was unaware). Compromised developers’ Windows machines resulting into big corporate breaches is not something uncommon,” noted pseudonymous developer Marcovelon.