[Analysis] A closer look into 2018-2019 Electrum phishing attacks - Clain

The widely used Electrum cryptocurrency wallet has been under severe phishing attacks that are still ongoing since December 2018. The on-chain analysis firm Clain has been monitoring the situation and tracing the flow of stolen coins, concluding that the attacks can be grouped into roughly 2 rounds, "presumably orchestrated by at least 2 independently acting hackers," Clain asserts. The first group slowly aggregated funds on one address and then systematically converted the bitcoins to Monero ($XMR) in a series of transactions that never exceeded 1 BTC. The second round of phishing attacks is still running, according to Clain. These bitcoins were sent to the peer-to-peer exchange Bisq, again in amounts that didn't exceed 1 BTC. The below image is a sample of the pattern that the second hacker(s) followed to launder at least 372 BTC at the time Clain published this research.