- Hackers have infiltrated El Salvador’s state-controlled Bitcoin wallet Chivo
- The malicious actors have also accessed the wallet’s code and disclosed it on dark web platforms
- The hackers said they weren’t selling the code but publishing it “for free”
Two weeks after the CiberInteligenciaSV hacking group shared a database of arrest warrants in El Salvador, the group has now accessed the code of the country’s Bitcoin wallet Chivo and its users’ information. This is after Chivo users connected the leaked data to that which they used to register to use the wallet. The group has gone a step further and shared the wallet’s code in dark web forums but said it’s offering the code “for free,” opening the door for other malicious actors to infiltrate the wallet in case the code contains any weaknesses.
Claims Denied
The hacking group even accompanied their post on the dark web forum with a statement acknowledging that the wallet is controlled by the government. The sharing of the code was after the group disclosed sensitive information of over five million Salvadorans early this month.
CiberInteligenciaSV had revealed in its Telegram channel that it will publish a section of Chivo’s code plus its “VPN access.” Although it said that anyone can access the code for free, it insinuated that it’s open to talk to the government.
El grupo #hacker #CiberInteligenciaElSalvador, anuncia en su cuenta de Telegram que publicará parte del código fuente y accesos VPN de #Chivo #Wallet (@chivowallet), la billetera oficial de #Bitcoin y #Dólar creada por el #Gobierno de #ElSalvador 🇸🇻 (@Gobierno_SV)… pic.twitter.com/AUG8PM1VN8
— VenariX en Español (@_venarixES_) April 22, 2024
The group also published the code and other information pertaining to the wallet’s ATM network. However, Chivo has denied that the wallet’s security has been compromised. In an X post, it said that the “users’ data is protected and Chivo security has not been breached.”
COMUNICADO DE PRENSA
Los datos de nuestros usuarios están protegidos y en ningún momento se ha violado la seguridad de CHIVO.
PRESS RELEASE
Our users’ data is protected and CHIVO security has not been breached. pic.twitter.com/uGq3FhJ6ld
— chivo (@chivowallet) April 24, 2024
No Need to Worry?
In an attached press release, it claimed that the data shared by the hacking group was from a “single Chivo ATM […] stolen on March 21, 2023.” It added that the “leak” doesn’t put any user’s data at risk.
The Chivo wallet saga comes roughly three years after the wallets launch was, at the time, marred with technical issues. The country’s Bitcoin-adoption mission has faced challenges including a resistance from residents who at one time burned a Chivo kiosk in the country.
With Chivo wallet, and by extension the country’s government, denying that the wallet’s security was compromised, it’s to be seen how they’ll handle complaints of users losing funds when they arise.
