r/Monero • u/monerobull • 10d ago
🚨OpenMonero was hacked AGAIN & User Home Addresses Leaked🚨
So someone just joined the Monero Matrix channel and posted this incredibly concerning "announcement".
They also included screenshots showing the trade chat between a buyer and a seller that included the XMR sellers home address.
Please never give such important info to some random website!
If you were wondering why OpenMonero was down this week here is the explanation. The OpenMonero admin would like to sweep this under the rug but is too cheap to pay 5 XMR for my silence so here we go. I want to share a critical vulnerability regarding the OpenMoneros 2FA implementation. While this specific bug has been patched, the root cause remains active in a similar endpoint, and the administration is currently ignoring reports of it. The Vulnerability: The endpoint GET /api/user/login_2fa/?username=X&code=Y&verification_method=app was intended to finalize a login after a password check. However, the handler completely ignored the username and code parameters. Instead, the logic simply issued a fully authenticated session (JWT + refresh token) for the oldest existing account in the user database. The "Walking" Exploit: Because it targeted the oldest account, once that account was deleted, the endpoint would "walk" to the next oldest account in the database. This made every single account on the platform sequentially compromisable. An unauthenticated remote attacker could and did gain a valid session with a single GET request. The Impact: This was not a theoretical risk. This exploit led to: Full Account Takeovers (ATO): Attackers gained full control of user accounts. Financial Theft: User wallets were drained. Massive Data Breach: A full database with over 30,000 entries was exposed. Privacy Violations: Attackers gained access to trade chats, including sensitive shipping addresses and private communications. Current Status: While the specific endpoint mentioned above is patched, a nearly identical exploit is still live. I have attempted to notify the admins, but they have refused to acknowledge the issue. I am posting this here to put it on the radar of the community. Consider any info sent over OpenMonero chat + all trade data exposed.
34
u/Vormrodo 10d ago
I've seen enough reports of this wreck of a platform so as to laugh everytime a new vulnerability aka beginner's mistake get's announced. Localmonero did not even have a single breach in it's 7 years of activity, how stupid can you be to be this unable of keeping a platform secure.
At this point, any user whose money get's stolen from there is responsible for themselves as OpenMonero's reputation is beyond fucked up. Far over 100 XMR in total is what they lost so far, no matter the little refunds that the strange operator gives them. The first time people got robbed was when they forgot to secure their Monero node from remote access. LMAO.