Quote from: Lucius on February 11, 2020, 10:54:37 AM

Quote from: Electrum_LedgerNS_Issue on February 10, 2020, 03:24:29 PM

Thanks for your reply.
Indeed, I searched my PC trying to find traces of the address string and I didn't get anything, thus either a script injected it then deleted itself either it was derived by Ledger somehow with a wrong derivation path.

The hardware wallet should be safe to use even on an infected computer, but it's just an assumption based on what we know, which certainly doesn't mean that some clever hacker didn't find a way to circumvent the protection that Nano S should provide.

Now that you have shown us both transactions, I can see that these are really large amounts and that you may be the victim of a very targeted attack, so you have to wonder who all knew that you owned such a significant amount of BTC.

On the other hand, when I look at the first legitimate transaction, I notice that second transaction is had fee of only 200 satoshi, compared to the first one that had a 5x higher fee. Hackers in such cases usually place a maximum fee to get confirmations as soon as possible. Considering this, it is possible that this is some kind of bug in Ledger or in Electrum, and that coins are still in your wallet, but in an address that you can't see for some reason.

I can confirm that both of the pages you cited are really blocked by MB, one because it contains exploit and the other because of phishing. If MB is blocking those sites, do you visit them or this is happening when you surf on some other site which is maybe try to redirect you to that sites?

Can you confirm that you downloaded Electrum from the official site https://electrum.org/#home , and did you maybe verify GPG signatures of downloaded files before installing?

Hi,

These "pages" seem to be Electrum servers (you can see them in your own server list probably).
When I downloaded Electrum I didn't check the PGP signature initially.
After the incident, I looked into my browser history (the link was correct), accessed the link from history, downloaded again the installer and checked the signature which verified.
It's possible my initial install was corrupted, not very probable though.
Also, I'm running an algo on an offline machine right now with the seed to derive possible addresses.
Parameters: m/bip'[0,44,48,49,84]/0'/account'[0-100]/visibility[0,1]/index[0-5000]
Will also test indexes up to 50k on 49 afterwards (based on this github.com/LedgerHQ/ledger-app-btc/pull/90).
If you have any other ideas where to look for, shoot.

Also, it is indeed possible that It was a targeted attack, but unfortunately this doesn't get me any further in understanding how it was done Sad

Thanks