A popular platform for the physical purchase and sale of bitcoins LocalBitcoins confirmed that it was subjected to a phishing attack, as a result of which at least six of its users lost their funds. In total, they had stolen 7.95205862 BTC (about $28 000).
LocalBitcoins reported on Reddit that around 10:00 UTC on Saturday, January 26, the exchange employees discovered a security vulnerability that "an unauthorized source was able to access a number of accounts and use them to send transactions."
Representatives of LocalBitcoins said that they were able to identify the problem and stop the attack. It is claimed that it was related to a function provided by third – party software-as a result, a phishing link was posted on the platform forum.
As explained by one of the users of Reddit, when visiting the forum LocalBitcoins was redirected to a phishing page, where it was proposed to re-enter the login information, including 2FA-code. As a result, hackers were able to empty even protected accounts.
Participants in the discussion also identified the address to which the stolen funds were received. As shown by the data of the blockchain, a total of five transfers were made to it, after which the funds from this address were withdrawn.
Additional comments from LocalBitcoins has not yet been reported, but the possibility of publishing new entries on the forum still disabled due to security considerations.
Recall that at the end of 2018, users often complained about problems in the operation of the site LocalBitcoins, which at some point even forced the company to go to maintenance.