Monero Security Breach Drains Entire Funds In Community Wallet: What’s Going On?

The Monero community faced a significant setback after its community crowdfunding wallet was compromised, resulting in the loss of its entire balance of 2,675.73 Monero (XMR), equivalent to approximately $460,000.

The breach, which occurred on September 1 but was disclosed only on November 2 by Monero developer Luigi, has raised concerns within the community as the source of the attack remains unidentified.

Monero’s Community Crowdfunding System (CCS) is a vital platform for funding development proposals from its members. The recent attack has elicited strong reactions from key developers, highlighting the impact on contributors who rely on these funds for essential expenses like rent and groceries.

3/11 "The #CCS Wallet was drained of 2,675.73 XMR (the entire balance) on September 1, 2023, just before midnight. The hot wallet, used for payments to contributors, is untouched; its balance is ~244 XMR. We have thus far not been able to ascertain the source of the breach."

— Web3today (@Web3today_io) November 6, 2023

Investigations revealed that Luigi and another developer, Ricardo “Fluffypony” Spagni, were the sole custodians of the wallet’s seed phrase. The CCS wallet, established in 2020 on an Ubuntu system, was utilized with a Monero node. Funds were transferred to a Windows 10 Pro desktop hot wallet, which was then used to pay community members.

The breach led to nine transactions emptying the CCS wallet, prompting Monero’s core team to consider using the General Fund. Concerns have been raised that the attack might be linked to ongoing security breaches affecting various cryptocurrencies since April.

Speculations suggest that the compromise could have been facilitated by the exposure of wallet keys on an Ubuntu server. In contrast, others imply the possibility of unauthorized access through compromised Windows machines. Despite the continued efforts to identify the source, Monero’s development community remains vigilant in securing its systems against future breaches.