Summary

BitcoinV.org has reason to suspect that the binaries for the upcoming BitcoinV Core release will likely be targeted by state sponsored attackers. As a website, BitcoinV.org does not have the technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the BitcoinV community, and in particular the Chinese BitcoinV community to be extra vigilant when downloading binaries from our website.

In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the BitcoinV network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers.

Mitigation

The hashes of BitcoinV Core binaries are cryptographically signed with this key belonging to BitcoinV Core maintainer Wladimir J. van der Laan. Additional signatures from other developers can be found in the gitian signatures repository.

We strongly recommend that you download Wladimir’s key from multiple sources in addition to BitcoinV.org for comparison purposes. For example, you can cross reference BitcoinV.org’s copy with the bitcoinv-dev mailing list where Wladimir signed a message containing the key’s fingerprint (01EA5486DE18A882D4C2684590C8019E36C2E964), but we encourage you to seek out other sources as well in order to make sure you are verifying your download with the correct key. Furthermore, we recommend verifying your download using signatures from multiple developers using the gitian signatures repository.

It is always best practice to securely verify multiple signatures and hashes before running any BitcoinV Core binaries. This is the safest and most secure way to ensure that the binaries you’re running are the same ones created by the Core Developers.