Partnered With:

Nearly 1,000 people have their identities stolen as hackers target $30 Bitcoin 'wool' in El Salvador

Read this article in 12 Minutes

In other identity theft cases, $30 was transferred to other hacked accounts rather than the hacker's own wallet.

Hackers target El Salvador's $30 Bitcoin wool

Source: Yahoo Finance

Bai Ze Research Institute

The Chivo wallet is a national digital wallet launched by the Government of El Salvador on September 7 to promote the Bitcoin law. To this end, El Salvador promises users who download and authenticate the Chivo wallet will receive $30 in Bitcoin. The move helped the Official Salvadoran wallet reach more than 2 million users within a month.

Nayib Bukele, El Salvador's president, said: "We seem to be able to provide banking services to more people in a month than traditional banks were nationalised and privatised in 40 years."

With the adoption of Bitcoin, Bukler has put his country at the center of a "global discussion about the future of money." Article 7 of the Bitcoin Act stipulates that all merchants must accept Bitcoin as a form of payment when their customers offer it.

萨尔瓦多的 30 美元比特币羊毛被黑客盯上，大量居民身份被盗用

The hackers targeted the Chivo wallet

Cynthia Gutierrez, a Salvadoran citizen, initially refused to download Chivo, but she finally decided to open the wallet on Oct. 16 after learning from fellow Salvadorans that hackers had stolen their identities and activated wallets linked to their IDS.

"It's happening more and more and it's in my close circle," Gutierrez said in an interview.

When Gutierrez entered her personal information, a window popped up in Chivo's wallet saying her id number had been linked to the wallet.

萨尔瓦多的 30 美元比特币羊毛被黑客盯上，大量居民身份被盗用

Gutierrez's identity theft case is one of hundreds reported by Salvadorans since September. Between October 9 and October 14, El Salvador's human rights organization Cristosal received 755 notices of Salvadorans reporting identity theft from Chivo's wallet.

The massive identity theft was based on one motive: Each wallet contained $30 worth of Bitcoin, provided by the government of President Nayib Bukele of El Salvador to encourage citizens to use the cryptocurrency.

Chivo's system was flawed

According to Chivo's website, opening an account requires a person's car driver's license to be scanned front and back, followed by face recognition to verify the identity of the registrant. But some Salvadorans have reported evidence that the system is flawed.

Adam Flores, a youtuber in El Salvador, heard about the identity theft case, remembered that his grandmother had not registered the Chivo wallet and decided to test it out on the spot. Even though Flores only had a copy of his grandmother's car driver's license, he gave it a try and, surprisingly, Chivo accepted the application.

Flores went through the verification process and was then asked to perform real-time facial recognition. So he took a picture of a poster on the wall of his room featuring Sarah Connor, a character from the Terminator movies. After a few seconds of facial-recognition testing, the poster's photo passed and a $30 reward was handed out.

Flores then made another attempt, using a coffee cup as a substitute for a car's driver's license, to fool Chivo's wallet's facial recognition.

萨尔瓦多的 30 美元比特币羊毛被黑客盯上，大量居民身份被盗用

Salvadorans don't always try to open their own accounts. According to human rights group Cristosal, most of the 700 Salvadorans who reported identity theft asked acquaintances to try to transfer money through Chivo by putting their id number in the receiver, but they found the address "ready to receive the transfer." In other words, their ID numbers have been illegally registered.

Worried about being impersonated, Another Salvadoran, Ramon Esquivel, asked an acquaintance on Oct. 11 to wire money to a wallet using his car driver's license. To his surprise, the transfer worked, even though he had never activated his account. After the incident, he filed a complaint with the attorney general's office: "I was furious and I realized that my identity had been used by hackers. I was being used to engage in money laundering that was registered under my identity and compromised my integrity."

Smart hacker

In other identity theft cases, hackers have even transferred $30 to other hacked accounts instead of the hacker's own wallet.

Two weeks ago, Gabriela Sosa, a multimedia host in Salva, tried to activate her Chivo wallet with her driver's license, but an error message popped up on the screen telling her she had registered. Sosa immediately called Chivo's official number and was told she had to go to Chivo's local station. So she went to the help center and finally got her account back, but the $30 had been transferred.

Sosa tweeted the details of the account to which the $30 had been transferred, in the name of Michael Santacruz.

A few days later, Santa Cruz received a message from Twitter, but he had never activated his Chivo account before. He tried to open his wallet, but the system showed that the driver's license had been registered. Like Sousa, he approached the Chivo help center, and after restoring his account, he realized that the wallet had been used to receive funds from other hacked accounts.

萨尔瓦多的 30 美元比特币羊毛被黑客盯上，大量居民身份被盗用

Photo: A transaction with Santa Cruz's wallet

After Humberto Saenz, president of Accion Ciudadana, and Eduardo Escobar, a director of Accion Ciudadana, a non-profit organization specializing in auditing, discovered that hackers had registered their Chivo wallets, A notice was filed with the Attorney-general's Office (FGR) on 12 October.

Accion Ciudadana said that so far, two weeks after submitting the application, there has been no response from the attorney general's office.

Laura Nathape Hernandez, a technology lawyer at Legal Novis in El Salvador, has been receiving requests from identity theft victims for help with Chivo wallets. According to Hernandez, a Chivo wallet should be the first resort to detect identity theft. "But we also don't have much information about who's in charge, we don't know who's running it. There's no transparency."

Chivo is not responsible for this, and there is no clear resolution process

According to the terms of use of the Chivo Wallet, the authorization of the account is conditional on the KYC process performed by Chivo SA de CV to create and activate the wallet by the government. The verification process "includes providing the information and documentation required to fully comply with the process."

It also states that users agree "not to disclose or divulge any information, identity information, passwords or codes used to access the site to third parties." It is not responsible for any loss or damage caused to users by unauthorized third party access to your account as a result of hacking or loss of passwords.

Reporters interviewed Chivo staff and asked: "Who was responsible for the hack when the real account owner did not provide information?" But the staff did not answer.

Sosa, a salva multimedia host, eventually withdrew her $30 bitcoin and stressed that her complaint was not against President Bukler, but simply that she wanted to raise awareness of the issue.

Gutierrez has yet to recover her money. "I tried to contact customer service, but they didn't get back to me, nor did any agency have a clear process to follow in such cases."

Esquivel said he wasn't interested in a $30 reward or a government app. "If I were to use bitcoin entirely, I would use a wallet to hold my money."