KEY POINTS
- Hackers made available for download the data of more than 5 million Salvadorans
- A local cybersecurity project warned of the impending leak Monday
- The earlier leak was linked to a former Salvadoran government aide who died in custody in February
El Salvador's Bitcoin (BTC) wallet, 2021-launched Chivo, was hacked in April 2023, but it turns out the exploiters were not done leaking information as they published more sensitive data related to the digital wallet.
The hacking group called CiberInteligenciaSV, a "VIP user" on black hat hacking platform BreachForums, released part of the wallet's source code Tuesday. "This time I bring you the code that is inside the Bitcoin Chivo Wallet ATMs in El Salvador, remember that this is a government wallet, and as you know, we do not sell, we publish everything for free for you," the hackers said.
Multiple crypto outlets reported that the hacking group leaked the information of more than five million individuals earlier this month. A Protos report indicated that the data may have only been available for free download earlier this month, while a DataBreaches report about the leak of 5.1 million Salvadorans' information was "posted on August 21, 2023." The database was "listed for sale," as per DataBreaches.
DataBreaches said it was contacted by "someone affiliated with the hack" regarding a listing with 114GB of files that included the personal information of more than five million Salvadorans. The files included citizens' full names, birthdates, addresses, unique identity numbers, and high-definition photos.
"There was a backup in the cloud of a member of the government," the unidentified contact said, as per the report. The contact went on to reveal that the said government member was Alejandro Muyshondt, who was a former El Salvadoran national security advisor. Muyshondt was allegedly jailed before the leak "for being a double agent and allegedly leaking classified information," as per the contact cited by the report.
Blockchain author David Gerard said the leaked information was "literally the chivo signup data." He noted that he had spoken with "the guys who warned the gov weeks before Chivo launched precisely what would go wrong, and of course it did."
As of writing, the El Salvador government headed by President Nayib Bukele, a Bitcoin enthusiast, has yet to provide an official statement about the leak being linked to the pro-Bitcoin nation's BTC wallet.
It is worth noting that Salvadoran cybersecurity project VenariX on Monday took to X (formerly Twitter) to warn the public about the latest leak. "The hacker group #CiberInteligenciaElSalvador announces on its Telegram account that it will publish part of the source code and VPN access of Chivo Wallet, the official Bitcoin and Dollar wallet created by the government of El Salvador," the project wrote as per a Google translation.
The Chivo wallet was launched in September 2021, starting with bug complaints among users. At one point, it was reportedly taken down for several hours for technical maintenance.
Meanwhile, Muyshondt, died in custody in February after he accused Congressman Erick Garcia of the ruling party of corruption. His family told reporters at the time that the circumstances leading to Muyshondt's death were unclear. Bukele has said the former government aide leaked evidence against Garcia to bypass an impending probe into his alleged leaking of documents to the media.
Documents published by local media on a preliminary report of Muyshondt's death revealed he died of pulmonary edema, but his family said they were told he died at a state hospital after suffering a stroke.
