Disclaimer: This article is intended to convey more market information and does not constitute any investment advice. The article only represents the views of the author and does not represent the official position of Mars Finance.
Editor: Remember to pay attention
Source: DeFi Shirasawa Research Institute
Source | Yahoo Finance
Compile the | Shirasawa Research Institute
Chivo Wallet is a national digital wallet released by the Salvadoran government on September 7 to implement the Bitcoin Bill, for which El Salvador promised that Chivo Wallet users who download and authenticate will receive a $30 Bitcoin reward. The move brought the official El Salvadoran wallet over 2 million users in a month.
President Nayib Bukele of El Salvador said: "Compared to the nationalization and privatization of traditional banks in 40 years, it seems that we can bank more people in a month." ”
With the adoption of Bitcoin, Buchler put his country at the center of "a global discussion about the future of money." In Article 7 of the Bitcoin Act, it is stipulated that all merchants must accept Bitcoin as a payment method when offering Bitcoin payments to customers.
<h2>Hackers targeted the Chivo wallet</h2>
At first, Salvadoran citizen Cynthia Gutierrez refused to download Chivo, but she eventually decided to open the wallet on October 16 after she learned from her fellow Salvadorans that hackers had stolen their identity information and activated the wallet associated with their ID cards.
Gutierrez said in an interview: "This situation is getting more and more, entering my intimate circle. ”
When Gutierrez entered her personal information, a window popped up inside Chivo's wallet saying that her ID number had been associated with the wallet.
Gutierrez's identity theft is one of hundreds of cases reported by Salvadorans since September. Between October 9 and October 14, Cristosal, an Salvadoran human rights group, received 755 notifications about Salvadorans reporting that Chivo wallet identity theft had been stolen.
The hackers carried out the massive identity theft operation based on a single motive: Each wallet contained $30 worth of bitcoin, provided by the government of Salvadoran President Nayib Bukele to encourage citizens to use the cryptocurrency.
<h2>Chivo's system is flawed</h2>
According to the official website of Chivo Wallet, opening an account requires scanning the front and back of an individual's car driver's license, and then face recognition to check the identity of the registrant. But some Salvadorans have reported evidence of deficiencies in the system.
Adam Flores, a YouTube user in El Salvador, who heard about the hacker's identity theft case, remembered that his grandmother did not register the Chivo wallet and decided to test it out in the field. Although Flores only had a copy of his grandmother's car driver's license, he tried it anyway, and surprisingly, Chivo accepted the validity of the application.
Flores completes the verification process and is then asked for real-time facial recognition. So a picture of a poster was taken on the wall of his room with Sarah Connor, a character from the Terminator movie series. After a few seconds of verification by the facial recognition system, the poster's photo passed the verification and a reward of $30 was awarded.
Subsequently, Flores made another attempt, using a coffee cup that was enough to replace the car driver's license, deceiving the face recognition of Chivo's wallet.
Salvadorans don't always try to open their own accounts. According to human rights group Cristosal, of the 700 Salvadorans who reported identity theft, most asked acquaintances to try to transfer money through Chivo by placing their ID number in the recipient, but they found that the address was "ready to receive the transfer." In other words, their ID numbers have been illegally registered.
Fearing impersonation, another Salvadoran citizen, Ramón Esquivel, asked an acquaintance to wire money into a wallet on Oct. 11 with his car driver's license. To his surprise, the transfer was successful, even though he never activated his account. After the incident, he filed a complaint with the Attorney General's Office: "I was furious that I realized that the hackers had used my identity information. I was used to engage in money laundering that was registered in my capacity and undermined my integrity. ”
<h2>Savvy hackers</h2>
In other identity thefts, hackers even transferred $30 to other hacked accounts instead of the hackers' own wallets.
Two weeks ago, Salvadoran media host Gabriela Sosa tried to activate her Chivo wallet with her driver's license, but an error message popped up on the screen informing her that she had registered. Immediately after the incident, Sousa called Chivo's official number and was told that she had to go to Chivo's local site. So she went to the help center and finally got her account back, but $30 was transferred.
So Sosa tweeted the details of the account to which $30 was transferred, and the user's name was Michael Santa Cruz.
A few days later, Santa Cruise received a message from Twitter, but he had never activated his Chivo account before. So he tried to open his wallet, but the system showed that the driver's license had been registered. Like Sosa, he also approached the Chivo Help Center, and after restoring his account, he realized that the wallet had been used to receive funds in other hacked accounts.
Image: Transactions made with Santa Cruz's wallet.
Acción Ciudadana, a nonprofit organization specializing in auditing, filed a notice with the Attorney General's Office (FGR) on October 12 after the group's president, Humberto Sáenz, and director Eduardo Escobar discovered that the hackers had registered their Chivo wallet.
Acción Ciudadana said that as of now, two weeks after filing the application, the Attorney General's Office has not responded.
Laura Nathalie Hernández, a technical attorney at Salvadoran company Legal Novis, has been receiving requests for help from identity theft victims about Chivo wallets. According to Hernández, the discovery of identity theft should first turn to the Chivo wallet. "But we also don't have a lot of information about who's in charge, and we don't know who's managing it." There is no transparency in between. ”
<h2>Chivo is not responsible for this and there is no clear resolution process</h2>
In accordance with the Terms of Use of the Chivo Wallet, the authorization of the account is conditional on the KYC process performed by CHIVO SA de CV, which is created and launched by the government. The verification process "includes providing the information and documents required to fully comply with the process. ”
The clause also stipulates that the user agrees not to disclose or disclose to third parties any information, identity information, password or any code used to access the website." "It is not responsible for any loss or damage caused to users as a result of hacking or loss of passwords resulting from unauthorized third parties accessing your account."
The reporter interviewed Chivo staff and asked the question: "Who is responsible for the hack without the information provided by the real account owner?" But the staff did not answer.
El Salvadoran media host Sousa eventually withdrew her $30 in bitcoins and stressed that her complaint was not directed against President Buukler, but rather that she wanted to raise awareness of the issue.
Gutierrez has yet to take back her money. "I tried to contact customer service, but they didn't give me a reply, nor did any agency specify the process that should be followed in this case."
Esquiville said he wasn't interested in a $30 reward or government app. "If I use Bitcoin entirely, I will use a wallet to keep my money."
Risk Warning:
According to the Notice on Further Preventing and Disposing of the Speculation Risk of Virtual Currency Transactions issued by the central bank and other departments, the content of this article is only used for information sharing, and does not promote and endorse any business and investment behaviors, and readers are requested to strictly abide by the laws and regulations of the region and not participate in any illegal financial acts.