Very important warning from the Qtum team Co-founder Jordan Earlz
frankrbruno last edited by
Earlier today someone posted a link to a tool for tracking the price of Qtum on our subreddit. This tool was made by a legitimate developer, but the website linked to was setup by a malicious person. He took the tool and infected it with screen capture, keylogging, and code designed specifically to steal cryptocurrency wallets. We at Qtum did see the post, but upon first glance it appeared legitimate with an active github, real developers, etc. So, we didn't delete the post. Hours later however a report from a user came in that their coins had been stolen after downloading this tool. We then immediately deleted the post from our subreddit, and began to analyze the download to find that it was infected. We have reported the address and all known details about the attacker to exchanges, but typically there is little that can be done in these situations.
In light of this, and the massive number of people currently staking we would like to remind everyone that our recommendation is ALWAYS to store your Qtum wallet on a separate computer or raspberry pi from your normal every day computer. There are new viruses every day that get through a variety of different protection techniques and most viruses today specifically target cryptocurrency wallets like Qtum. So, we urge everyone to use a separate computer and do not store their wallet.dat file (even encrypted!) on their every day computer. In addition, if you think your machine may have been compromised, even if your wallet is encrypted, you should move all of your coins to a newly generated wallet on a secure computer! Encryption is slow to break, but it is possible with weak passwords, and if the virus also installed a keylogger, they may have logs including your password! There is no such thing as being too paranoid when thinking about the security of your wallet. This also applies to mobile wallets. We do everything we can to ensure the wallet and private key data in the mobile wallet is secure, but there is always the risk of Android or iOS exploits that allow reading this data while the wallet is running.
In order to help reduce the chances of such a situation happening again, the Qtum team and moderators will now delete any post or link saying to download any executable file or application (including mobile apps) across all communities, including Reddit, Telegram, Slack, the forum, and elsewhere. This includes price trackers, market analysis apps, portfolio trackers, and even development tools and kits if it requires running a program (source code and documentation is still ok of course).
If you have made an application for Qtum and wish to post it to one of our communities, please ask a Qtum team member to first review it and if everything looks ok we allow you post it. Posting links to your application multiple times despite it being removed and warnings given will result in a ban. Note: we might refuse to review really minor applications with limited utility due to time constraints for our team. And in addition, just because a Qtum team member reviews an application does not mean it is safe. Viruses and malware can be extremely well hidden and so we can not make any guarantees.
Thank you, and please keep security in mind when storing your Qtum!