IOTA Foundation released a series of blog posts to explain the roots, the nature and the aftermath of a recent attack. Furthermore, the blockchain team developed a unique seed (account) migration tool and invited the affected users to utilize it in order to keep their funds safe.
Migration tool released
This dramatic attack was carried out via a third-party dependency from the Moonpay payment provider. Attackers released an illicit version of the Moonpay software development kit (SDK) that decrypted the user’s seed and sent the seed and password to a server controlled by the attacker once the wallet was unlocked by its owner.
Analysis of the attackers' network activity proved that the hack had been prepared since November, 2019 or since the very early days of the IOTA x Moonpay collaboration. IOTA Foundation unveiled that at least 50 independent seeds were compromised during the attack with $2.3M combined losses.
On February 29, 2020, the IOTA Foundation released a migration tool, a software required to transfer the funds from a vulnerable account to a safe one. Every Trinity user who unlocked his/her wallet within the last four months, needs to follow the instructions and claim the transfer of assets.
Coordinator for safety
When eliminating the results of this attack, the IOTA Foundation stopped the instrument that operates the distributed ledger, the Coordinator. According to the official press release by IF shared with U.Today, this fact shouldn't be treated as evidence of network centralization.
The Coordinator is currently in place as a safety mechanism to protect users. The Coordinator acts as training wheels for the network until it reaches full production maturity - which is achieved through our very clearly defined Chrysalis
The IF is planning to finalize the transition with a Migration Tool within 10 days from its launch.
Alex Dovbnya
Arman Shirinyan
