According to a Twitter message, IOTA closed the network to deal with the attack on Trinity’s wallet.
Currently, #IOTA is working with law enforcement and cybersecurity experts to investigate a coordinated attack, resulting in stolen funds. To protect users, we have paused the Coordinator and advise users not to open Trinity until further notice. Updates: https://t.co/ME3Cvki3k9
— IOTA (@iotatoken) February 13, 2020
There’s no telling how long it’ll take for the network to fail. When the IOTA first reported the attack (February 12th), it simply advised users not to open and use their Trinity wallet. The fact that the team is suddenly taking more drastic action may suggest that the problem may not be solved too quickly.
In addition to closing the network, IOTA is investigating the situation in collaboration with law enforcement and cyber security experts. It has also used KYC information to reach the victims.
#IOTA #Trinity current situation:
6-7 reports, 1 Mac rest on Windows, all Destop no Mobile Wallet#IOTAstrong pic.twitter.com/GmPaWkd5nL— Daniel Stricker ⌛ iota.family (@dantherealm4n) February 12, 2020
Details of the attack
The effects of the attack actually affected only Trinity’s wallet. Its premiere took place in July 2019. The wallet was audited by two cyber security companies. Has the relatively short software life span caused researchers to overlook security gaps? The team suggested that early versions of Trinity could be blamed for the attack – although this has not yet been confirmed.
Of course, the IOTA revealed very little detail about the attack to prevent other attackers from doing the same exploit. So far, IOTA only suggested that attackers stole the seedy, which allows them to recover portfolios created by affected users.
The scale of the attack
As of yesterday, it was reported that about 1.6 million dollars’ worth of funds were stolen from about 10 rich IOTA wallets as a result of the attack.
These wallets are probably half of all users currently affected.
About $1.6 Million USD worth of #iota have been stolen from ~10 high-value accounts. Bug is likely in the (official) desktop wallet. Network completely stopped for nearly 24 hours now.#IOTAstrong just keeps on giving. pic.twitter.com/CMwyRRtYy0
— 00xou (@00xou) February 13, 2020
Interestingly, the zero-fee approach still allows for data transactions during network downtime, even if the financial dimension of the transaction remains unavailable.
Other controversies around IOTA
IOTA security has already been the subject of several discussions. The best known potential vulnerabilities in IOTA security became the subject of debate in 2018, when IOTA developers and the DCI MIT team began questioning the security of the IOTA shortcut function.
In an unrelated event, a hacker stole $11 million in IOTA during a phishing attack in 2018. The attacker managed to set up a fake website that disseminated its own addresses as new network addresses. This is unfortunately a fairly simple line of attack, which is also common in address generators for Bitcoin and other cryptocurrencies.
The IOTA network also faces a recurring problem of lack of availability. It was closed in December for about 15 hours. In that case, however, the closure was due to technical problems, not a security risk.
With such a wide variety of problems, it is difficult to judge whether the IOTA is more or less secure than other blockchain projects.
In the face of the current attack a special Discord channel was created. IOTA calls for any news related to the attack to be communicated through this channel, which will help to restore the network to working order as soon as possible. There is also an official website with updates about the problem (here).
