<blockquote>
<p>How is this possible? What happened to allow for this?</p>
</blockquote>
<p>The same way that any website can be hacked. Bitcoin.org isn't hosted in some special way that makes it unhackable, it's a website, like every other website. As such, it can be hacked in all of those ways, including, but not limited to: web server compromise, DNS server/account compromise, registrar account compromise, etc.</p>
<p>It is probably that either the server hosting the website was compromised in some form (weak password, compromised SSH key, etc.) or the cloudflare account which is providing DDoS protection was compromised (weak password, support social engineered, etc.) and the settings changed to point to the attacker's server.</p>
<blockquote>
<p>in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL</p>
</blockquote>
<p>Bitcoin Core is no longer being uploaded to bitcoin.org anyways, at least not by the release maintainer. Bitcoin Core's official website is <a href="https://bitcoincore.org" rel="noreferrer">https://bitcoincore.org</a> and you should be getting your binaries from there. AFAIK, the owner of bitcoin.org still mirrors the binaries on bitcoin.org, but it is no longer the official place for Bitcoin Core binaries.</p>
<blockquote>
<p>them after verifying the signatures which it also gets from the same domain...</p>
</blockquote>
<p>As long as the signatures verify and were created with keys that you trust (presumably you got those keys from somewhere else and did some verification of them), then the binaries downloaded should be fine. This is, after all, the point of having signatures. An attacker who has taken over the website will be unable to create a valid signature with the release key(s) unless they have also compromised those.</p>
<p>For 22.0+, you can also check that the binary's hashes match what the guix builders have built by checking the hashes and signatures in <a href="https://github.com/bitcoin-core/guix.sigs" rel="noreferrer">https://github.com/bitcoin-core/guix.sigs</a> (with the new guix process, the signatures over the hashes actually comes from the guix builders too). For 0.21 and earlier, you can do the same check with the gitian signatures: <a href="https://github.com/bitcoin-core/gitian.sigs" rel="noreferrer">https://github.com/bitcoin-core/gitian.sigs</a>.</p>

CC BY-SA 4.0
2021-09-23T04:19:10.980Z
2021-09-23T04:19:10.980Z
Ava Chow
<p>There are no websites that represent bitcoin, as bitcoin is decentralised.</p>
<p>bitcoin.org is owned by a person and is a site that gives information about bitcoin, as many other sites do, and there is no particular connection between the security of the bitcoin.org domain name and the security of bitcoin software clients.</p>

CC BY-SA 4.0
2021-09-23T21:22:51.057Z
Specifically to address in the OP: "The main Bitcoin website has been compromised." However https://bitcoincore.org/ apparently is the "reference implementation"?
qwr
CC BY-SA 4.0
2021-09-24T02:28:43.290Z
bitcoincore.org is the website that gives information about the Bitcoin Core client. Bitcoin Core is the most used implementation. There are other bitcoin implementations. The design of the other implementations may be different, however the consensus rules they abide by are the same (to stay in consensus). Other implementations are not more or less important.  Personally, I think the term "reference implementation" that is suggesting that Bitcoin Core is the only "correct" client is an improper characterisation. All implementations that abide by the consensus rules are correct.
stackaccount
CC BY-SA 4.0
2021-09-23T04:20:44.853Z
2021-09-23T04:20:44.853Z
stackaccount
<blockquote>
<p>I'm immediately removing every single instance of &quot;bitcoin.org&quot; in my code, in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL them after verifying the signatures which it also gets from the same domain...</p>
</blockquote>
<p>No version of Bitcoin Core has ever has any contact with bitcoin.org, no version checking, no manual or automatic updates. If you have made these tools yourself and decided to add it as a trusted source for anything in particular, that is your security risk to deal with and nobody else's.</p>
<blockquote>
<p>If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.</p>
</blockquote>
<p>Well no, the point of cryptographic signatures is expressly to prevent this situation. Someone replacing the binaries can not produce valid signatures for the keys used previously.</p>

CC BY-SA 4.0
2021-09-23T04:17:20.487Z
2021-09-24T02:55:45.693Z
2021-09-24T02:55:45.693Z
Claris
<p>Sometimes it's as easy as calling the registrar or host and pretending to be the owner of the domain, almost like how attackers do SIM swaps. Hopefully most hosts and registrars are better at protecting against this type of social engineering attack these days as it has become more common.</p>

CC BY-SA 4.0
2021-09-26T03:37:32.040Z
2021-09-26T03:37:32.040Z
m1xolyd1an
<p>Suddenly:</p>
<blockquote>
<p>The Bitcoin Foundation is giving back to the community!
We want to support our users who have helped us along the years.
Send Bitcoin to this address, and we will send double the amount in return!</p>
</blockquote>
<p><a href="https://bitcoin.org/" rel="noreferrer">https://bitcoin.org/</a></p>
<p>Obvious scam. The main Bitcoin website has been compromised.</p>
<p>I'm immediately removing every single instance of &quot;bitcoin.org&quot; in my code, in particular the scripts that check for new updates of Bitcoin Core and <strong>AUTO DOWNLOAD/INSTALL</strong> them after verifying the signatures which it also gets from the same domain...</p>
<p>Sorry, but this is like a cold shower. I never thought that this of all sites would get compromised. Now I cannot trust anything or anyone. If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.</p>
<p>How is this possible? What happened to allow for this?</p>

CC BY-SA 4.0
2021-09-24T01:17:08.973Z
You're *verifying signatures*, right?  Not just checking hashes like MD5 or SHA1?
Peter Cordes
CC BY-SA 4.0
2021-09-24T10:10:38.543Z
If I tell you how bitcoin.org can be hacked, then you will be able to hack it so I'm not telling you ;p
akostadinov
CC BY-SA 4.0
2021-09-24T19:08:35.107Z
That _might_ be a joke?  Looks a little too obvious.  A more plausible scam attempt may've been something like a donation-request.
Nat
CC BY-SA 4.0
2021-09-24T19:14:12.010Z
BTW, might be a bad idea to visit a site if [it may've been hacked](https://support.google.com/websearch/answer/190597?hl=en).
Nat
CC BY-SA 4.0
2021-09-25T12:19:32.440Z
Having a script that would automatically download and install software from any website is obviously dangerous. A website is not magically hack-proof just because it's a .org.
Boann
CC BY-SA 4.0
2021-09-25T15:02:15.130Z
It's very confusing that this question states that "bitcoin.org" is the "main bitcoin website".  It says right on the site:  ***Bitcoin.org is not Bitcoin's official website***
Fattie
CC BY-SA 4.0
2021-09-25T15:41:44.230Z
FWIW, [Stack Overflow were also hacked in 2019](https://stackoverflow.blog/2021/01/25/a-deeper-dive-into-our-may-2019-security-incident/)...
Andrew T.
<bitcoin-core><security><hack><bitcoin.org><guix>
How can Bitcoin.org be hacked?
E. Siahaan
# How can Bitcoin.org be hacked?

(Asked by: username_0 on 2021-09-23)

Suddenly:

> The Bitcoin Foundation is giving back to the community!
> We want to support our users who have helped us along the years.
> Send Bitcoin to this address, and we will send double the amount in return!

<https://bitcoin.org/>

Obvious scam. The main Bitcoin website has been compromised.

I'm immediately removing every single instance of "bitcoin.org" in my code, in particular the scripts that check for new updates of Bitcoin Core and **AUTO DOWNLOAD/INSTALL** them after verifying the signatures which it also gets from the same domain...

Sorry, but this is like a cold shower. I never thought that this of all sites would get compromised. Now I cannot trust anything or anyone. If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.

How is this possible? What happened to allow for this?

**Tags:** bitcoin-core, security, hack, bitcoin.org, guix

> **Comments:**
> **username_1**: You're *verifying signatures*, right?  Not just checking hashes like MD5 or SHA1?  
> **username_2**: If I tell you how bitcoin.org can be hacked, then you will be able to hack it so I'm not telling you ;p  
> **username_3**: That _might_ be a joke?  Looks a little too obvious.  A more plausible scam attempt may've been something like a donation-request.  
> **username_3**: BTW, might be a bad idea to visit a site if [it may've been hacked](https://support.google.com/websearch/answer/190597?hl=en).  
> **username_4**: Having a script that would automatically download and install software from any website is obviously dangerous. A website is not magically hack-proof just because it's a .org.  
> **username_5**: It's very confusing that this question states that "bitcoin.org" is the "main bitcoin website".  It says right on the site:  ***Bitcoin.org is not Bitcoin's official website***  
> **username_6**: FWIW, [Stack Overflow were also hacked in 2019](https://stackoverflow.blog/2021/01/25/a-deeper-dive-into-our-may-2019-security-incident/)...  

---

## 4 answers

### Answer by username_7 on 2021-09-23. Score: 23

> How is this possible? What happened to allow for this?

The same way that any website can be hacked. Bitcoin.org isn't hosted in some special way that makes it unhackable, it's a website, like every other website. As such, it can be hacked in all of those ways, including, but not limited to: web server compromise, DNS server/account compromise, registrar account compromise, etc.

It is probably that either the server hosting the website was compromised in some form (weak password, compromised SSH key, etc.) or the cloudflare account which is providing DDoS protection was compromised (weak password, support social engineered, etc.) and the settings changed to point to the attacker's server.

> in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL

Bitcoin Core is no longer being uploaded to bitcoin.org anyways, at least not by the release maintainer. Bitcoin Core's official website is <https://bitcoincore.org> and you should be getting your binaries from there. AFAIK, the owner of bitcoin.org still mirrors the binaries on bitcoin.org, but it is no longer the official place for Bitcoin Core binaries.

> them after verifying the signatures which it also gets from the same domain...

As long as the signatures verify and were created with keys that you trust (presumably you got those keys from somewhere else and did some verification of them), then the binaries downloaded should be fine. This is, after all, the point of having signatures. An attacker who has taken over the website will be unable to create a valid signature with the release key(s) unless they have also compromised those.

For 22.0+, you can also check that the binary's hashes match what the guix builders have built by checking the hashes and signatures in <https://github.com/bitcoin-core/guix.sigs> (with the new guix process, the signatures over the hashes actually comes from the guix builders too). For 0.21 and earlier, you can do the same check with the gitian signatures: <https://github.com/bitcoin-core/gitian.sigs>.


---

### Answer by username_8 on 2021-09-23. Score: 11

There are no websites that represent bitcoin, as bitcoin is decentralised.

bitcoin.org is owned by a person and is a site that gives information about bitcoin, as many other sites do, and there is no particular connection between the security of the bitcoin.org domain name and the security of bitcoin software clients.

> **Comments:**
> **username_9**: Specifically to address in the OP: "The main Bitcoin website has been compromised." However https://bitcoincore.org/ apparently is the "reference implementation"?  
> **username_8**: bitcoincore.org is the website that gives information about the Bitcoin Core client. Bitcoin Core is the most used implementation. There are other bitcoin implementations. The design of the other implementations may be different, however the consensus rules they abide by are the same (to stay in consensus). Other implementations are not more or less important.  Personally, I think the term "reference implementation" that is suggesting that Bitcoin Core is the only "correct" client is an improper characterisation. All implementations that abide by the consensus rules are correct.  

---

### Answer by username_10 on 2021-09-23. Score: 10

> I'm immediately removing every single instance of "bitcoin.org" in my code, in particular the scripts that check for new updates of Bitcoin Core and AUTO DOWNLOAD/INSTALL them after verifying the signatures which it also gets from the same domain...

No version of Bitcoin Core has ever has any contact with bitcoin.org, no version checking, no manual or automatic updates. If you have made these tools yourself and decided to add it as a trusted source for anything in particular, that is your security risk to deal with and nobody else's.

> If they can host such an obvious scam message, they can host modified EXEs and cryptographic signature files... Sigh.

Well no, the point of cryptographic signatures is expressly to prevent this situation. Someone replacing the binaries can not produce valid signatures for the keys used previously.


---

### Answer by username_11 on 2021-09-26. Score: 0

Sometimes it's as easy as calling the registrar or host and pretending to be the owner of the domain, almost like how attackers do SIM swaps. Hopefully most hosts and registrars are better at protecting against this type of social engineering attack these days as it has become more common.


---

