The theft began before any Bitcoin transaction reached the network. In October 2019, ESET described a counterfeit, Russian-language build of Tor Browser that could rewrite a payment page on the victim’s own computer. Users saw a plausible deposit address; the attacker received the coins.
The attack chain, from download to irreversible payment
The ESET investigation described websites that presented themselves as distributors of an official Russian-language edition. The modified package retained normal browsing functions, making the deception less obvious, but changed configuration and included components that could manipulate pages.
When a targeted user opened a deposit page and requested a Bitcoin address, malicious code could swap the legitimate destination for an attacker’s address. Because cryptocurrency addresses are long and difficult to recognize, a user who checked only the beginning—or trusted what appeared on screen—could authorize an irreversible payment to the wrong recipient.
What was—and was not—compromised
The incident did not show an attacker rewriting a confirmed Bitcoin transaction. The destination was changed before the user sent it. Nor did it demonstrate that Tor’s anonymity network had been cryptographically defeated. The compromise occurred at the endpoint: a hostile application controlled what the victim saw.
That difference matters for assigning responsibility and improving defenses. A secure network cannot protect a payment instruction when the device or application presenting that instruction is already under attacker control.
Where a user could have broken the chain
The Tor Project publishes guidance for verifying Tor Browser signatures. A signature allows a user to check that a package was produced by the project and was not changed after signing. It is more meaningful than trusting a familiar filename, translated landing page or search result.
Current users should obtain Tor Browser through official Tor Project channels, keep automatic updates enabled and verify signatures where the threat model warrants it. A wallet address should also be checked on a trusted display or through an independently authenticated channel before a significant transfer. Copy and paste reduces typing errors but does not prove that clipboard or screen content is genuine.
Checking only a few characters of an address offers limited protection because attackers can generate visually similar prefixes or rely on hurried verification. For higher-value transfers, users can compare the complete address, send a small test transaction where appropriate and confirm the destination on a hardware device whose display is independent from the compromised computer.
Cryptocurrency theft is often described as an attack on a blockchain even when the attacker exploited distribution, browser extensions, clipboard access or social engineering. Precise reporting separates protocol failure from endpoint compromise.
The 2019 campaign belongs in the historical record because it combined brand impersonation, localized distribution and transaction-address substitution. Its lesson remains current: verify the software supply chain and the payment destination, not merely the interface that displays them.
The incident also shows why reports should name the distribution channel. Saying that Tor stole Bitcoin would blame the authentic project and conceal the real advantage: victims were persuaded to install a counterfeit package. Naming that boundary is part of the security guidance, not a semantic detail.
