Monero official website was hacked. CLI binaries may have been compromised
The Monero team said on the website: “A quick investigation found that the binaries of the CLI wallet had been compromised and a malicious version was being served. It’s strongly recommended to anyone who downloaded the CLI wallet from this website between Monday 18th 2:30 AM UTC and 4:30 PM UTC, to check the hashes of their binaries. If they don’t match the official ones, delete the files and download them again.”
According to the reports and confirmations of many users on GitHub, Reddit and Twitter, the installation package provided by Monero’s official website may have malware and the mismatch of the HASH value. Currently, all binaries are clean because they are currently delivered from a secure alternate host server.
In the Reddit community, Monero subreddit moderators encourage users to “check the integrity of binary files and verify that they are signed by Fluffypony’s GPG key.” Although Windows and macOS files have not been reported to be corrupted, users of all platforms should check the hash values of all downloaded Monero binaries as they may have been switched by malicious versions.
The correct hash of all Monero binaries can be downloaded from the official website.
