MyEtherWallet Hola VPN Compromised, User Accounts Exposed

On July 9, MyEtherWallet reported a security breach to its Hola VPN service that left user accounts exposed.

MyEtherWallet, a globally renowned cryptocurrency management tool and web wallet, experienced a security breach to its Hola VPN browser extension that left user accounts exposed for approximately five hours on July 9.

MEW's Hola VPN is a free browser extension with nearly 50 million users.

During the security breach, hackers were able to access and monitor user accounts who toggled the VPN on and were actively using MEW. Regular users of MEW were not affected by the hack, as the core platform itself remained uncompromised.

Taking to Twitter, MEW warned Hola users of the security issue and advised them to transfer funds to a new account.

We received a report that suggest Hola chrome extension was hacked for approximately 5 hrs and the attack was logging your activity on MEW. - MyEtherWallet.com July 10, 2018.

"The safety and security of MEW users is our priority. We'd like to remind our users that we do not hold their personal data, including passwords so they can be assured that the hackers would not get their hands on that information if they have not interacted with the Hola chrome extension in the past day."

Two months ago, MEW experienced a DNS hijack resulting in 215 ether stolen from users' wallets.

Although MEW claims the issue derived from "Vulnerabilities in public-facing DNS servers"- not its own security infrastructure, the event marks the first of two security breaches to occur in 2018 so far.

Users are reminded to use secure browser extensions that provide safeguards against potential phishing and scams.