In November 2019, modified Monero command-line (CLI) wallet binaries were briefly served through an official download source. Monero’s warning told people who downloaded a CLI wallet during the stated check window to verify its hash, delete any mismatching file, download a clean copy, and never run the compromised binary. The public record does not establish how the download path was breached or how many people were affected.
What happened to Monero’s wallet downloads?
On November 19, 2019, Monero community member ErCiccione published an official warning that an investigation had found compromised CLI wallet binaries being served. The announcement said the problem had been fixed and downloads were being served from another source. ErCiccione wrote: “Do not run the compromised binaries for any reason.” (Monero’s November 19 warning.)
The incident was a software supply-chain compromise: the downloaded wallet software itself had been altered to include cryptocurrency-stealing code. The warning concerned CLI wallet binaries; it should not be broadened to claim that every Monero download or wallet was compromised.
Which dates and times matter?
Monero’s warning asked people who downloaded a CLI wallet between November 18 at 02:30 and 16:30 UTC to check the file’s hash. That was a precautionary window for users to check—not evidence that malicious files were served continuously for all 14 hours.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors#1 Best Overall
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
A November 23 community meeting log gave a narrower account: the file-integrity monitor’s last log entry was at 16:04 UTC, a GitHub issue was created at 16:21, site administrators were privately informed at 16:30, and traffic failed over to a backup source at 16:40. Participants described approximately 35 minutes as the maximum period malicious binaries could have been served. The log also said CDN binaries were not affected and described the direct source as the fallback. These details are in the November 23 meeting record.
After failover, administrators observed fewer than 10 wallet downloads per hour from the direct source. That was a post-failover download rate, not a count of malicious downloads or victims.
Rank #2
- 【Military‑grade EAL6+ security&Easy to Use】Safnect crypto wallet eatures the top-tier EAL6+ security technology and a sealed secure-element chip — No Bluetooth. No Wi‑Fi. No battery. No seed phrase to manage. Your cryptocurrencies stay strongly protected from online attackers, it is immune to remote hacks and effortless for first-time users.
- 【3-Pack Backup = Double Secure】This 100% offline hardware wallet not just a 3‑pack. It's a breakthrough in key management.You can store these three cold crypto wallets in separate locations for safer, decentralized asset protection.
- 【Instant Tap Connection&Friendly for Begginer】Simply tap the crypto wallet card against your mobile device to pair with the Safnect App in seconds. Effortlessly buy, sell and transfer crypto assets safely through the app. Experience the fast convenience of a hot wallet, paired with the robust security of genuine cold storage.
- 【Multi-Chain & Multi-Account Management】 The Safnect cold crypto wallet seamlessly manages Bitcoin, Ethereum, Solana, and over 2,800 tokens across 54+ mainstream blockchains, giving you complete multi-chain and multi-account control.You can buy, sell, swap, stake, and spend cryptocurrency directly any time any way.
- 【Basically Indestructible&Easy to Carry】Only 2 mm thin with a credit-card sized design, this crypto wallet features IP66 waterproofing and bend-resistant construction. If you're a crypto holder who travels for work or just moves around a lot, you already know the struggle: Safnect crypto wallet that actually fits your life.
What did the malware do, and what losses were reported?
The November 23 meeting notes describe analyses that characterized the malware as a simple coin stealer. A November 26 CERT-EU memo reported a claim that at least one user lost about $7,000, while noting that the method of compromise was unclear. That figure is an attributed report of a user’s loss—not a verified total for the incident. The available records do not establish a complete victim count or aggregate amount stolen. (CERT-EU’s November 26 memo.)
How were the binaries found, and how was the site compromised?
The first warning followed a hash mismatch: the file did not match the expected integrity information. The public accounts establish that this discrepancy prompted investigation and that compromised binaries were being served, but they do not establish how the attackers gained access to the server or download path. The November 23 meeting record says participants could not yet answer how the website had been compromised and that security professionals were investigating; CERT-EU likewise said the method was unclear. No specific exploit, stolen credential, or other entry route is established in those sources.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How to verify a Monero download before using it
Monero’s verification guide says to verify a download before extracting or using it. The guide’s cryptographic checks are designed to confirm both that the published hash list is signed by a trusted maintainer and that the downloaded archive matches the hash on that list. Follow the current Monero binary-verification guide for live release details, fingerprints, and commands.
- Import and check the maintainer’s public-key fingerprint. Compare the fingerprint with the value published in the official guide; do not assume a key is trustworthy merely because it was downloaded alongside the wallet.
- Verify the signature on Monero’s hash list. The guide says core developers sign the list and identifies binaryFate as a core developer who signs releases. A valid signature establishes that the list matches the signing key; the fingerprint check is what helps establish that the key is the intended maintainer’s.
- Calculate the SHA-256 hash of the downloaded archive. Use the command or method specified in the current guide, and compare the result with the entry for the exact release and filename.
- Stop if the check fails. Do not extract or run an archive whose hash does not match the signed list. Investigate the mismatch and obtain a fresh download through an official source before trying again.
Does downloading the GUI wallet mean you were affected?
The 2019 warning and the meeting record identify compromised CLI wallet binaries, not GUI wallet downloads. They do not establish that the GUI was affected. If you are checking a download from that period, distinguish the product you downloaded and use the relevant official integrity information; do not infer exposure from the CLI incident alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
