I originally posted this on Reddit: https://www.reddit.com/r/ethtrader/comments/7l5yi7/warning_etherdelta_dns_system_has_been/ - you can check the original thread for updates.
Since the last updates it has been confirmed that EtherDelta's DNS configuration was hijacked and currently EtherDelta is pointed to a malicious fake side.
Many users have had their balances drained already.
It was also pointed out that there are ways to directly interact with the smart contract and to remove your funds and so I am highlighting those here.
What We Know Currently:
- If you haven't logged into EtherDelta at all today, your balances are likely fine.
- If you have logged into EtherDelta earlier today and successfully made a trade it is likely that your balance is fine but you may want to take extra precautions any way.
- If you visited EtherDelta but did not input your private key or sign a transaction your balance should be fine.
- If you visited EtherDelta using MetaMask or Trezor but did not sign a transaction or enter your private key your balance should be fine.
Steps to Recover Assets:
The EtherDelta mods previously posted this guide to interacting with the smart contract without logging into EtherDelta. (Please compare the original guide to the one below to ensure all addresses are the same and that this post has not been edited)
I was able to manually recover my funds via MyEtherWallet and so am posting this guide here. (Even when a mod posts a guide like this, please double check contract addresses are legitimate, use only the official ABI, and only enter your private key to sign the transaction).
Requirements:
- The EtherDelta contract address 0x8d12A197cB00D4747a1fe03395095ce2A5CC6819 .
- The EtherDelta contract ABI, found on the etherscan page of the contract here https://etherscan.io/address/0x8d12a197cb00d4747a1fe03395095ce2a5cc6819#code
- You'll also need the address of a token which can be found on EtherScan. If you want to withdraw your ETH then use "0" as the token address. You can check the MyEtherWallet Token List for common token contracts.
Step 1: Access the Contract
- Go to MyEtherWallet and click the contracts tab. (Manually type it in to prevent phishing)
- Double check to make sure it is the real site and not a phishing copy.
- Once on the contracts tab paste in the contract address and ABI and then click "Access"
- A dropdown menu should appear offering you to 'select a function'
Step 2: Gettting your balance in wei
The contract counts all balances in Wei so you will need to query the balance for each token you hold.
- Select 'balanceOf' and enter the token address of the token you want to withdraw (if you want to withdraw ETH then enter "0") then enter your wallet address and click "Read".
- This gives you how much you have in EtherDelta, in wei. (1 ETH = 1000000000000000000 wei) Copy this number.
Step 3: Withdrawing Tokens
- Select 'withdrawToken', enter the token contract address again and the amount of wei that you just copied above.
- Unlock your wallet with your private key, click "write" and "accept the transaction".
- The ETH value sent in the transaction popup should be 0, gas limit is filled automatically.
Step 4: Withdraw ETH
- Select 'withdrawToken', enter "0" for the contract address and the amount of ETH you have in Wei.
- Click "write" and accept the transaction.
- The gas should be filled automatically.
Step 5: Just in case - new wallet
- Just in case you were compromised via private key on the withdrawal wallet, consider making a new wallet via MyEtherWallet and transferring your assets safely to that new wallet.
What Happens Next?
Rumors have been posted saying that this was not a hack and EtherDelta was just changing hosts. This has been confirmed as not true. EtherDelta was compromised.
It is unclear what will happen next. Even if the EtherDelta site seems to be online, we should avoid using it until a PGP signed message from the admins has provided full details and remedied the situations.