MEW Crypto Wallet: What the Old Phishing Attacks Still Teach

MEW crypto usually means MyEtherWallet, a free interface for Ethereum that never holds your keys, which is exactly why fake copies of it work so well. In 2018 attackers hijacked its traffic for just under two hours. Today MEW’s own help pages call typing a private key, keystore file or phrase into its website not recommended.

On this page: the 2018 MyEtherWallet hijack traced from Cloudflare’s own write up, MEW’s help centre quoted on which ways in it calls not recommended, a GitHub release check dated 4 November 2026 showing where the offline build still lives, and a January 2026 account of a fake drain staged inside a browser.

Checked on 4 November 2026 against MEW’s own help centre, its public GitHub release page and the network operators who traced the 2018 attack, each linked where it is used. Not against review sites, which in this corner of the internet tend to rate a wallet five stars without ever having lost the password to one.

What is MEW crypto, and who actually holds the keys?

MEW is the short name for MyEtherWallet, a free, open source tool for Ethereum and the tokens that run on it, commonly dated to 2015. The important word is tool. MEW is not a bank and not an exchange. When you open a wallet through it, the keys either live in a device or app you control, or you type them into the page. MEW’s own servers never keep them. That makes it a genuine non custodial wallet, with the usual bargain: nobody can freeze your coins, and nobody can give them back.

That design has a sharp side effect. If the real MEW is just a web page that asks for your key, then a fake web page that asks for your key looks identical. Every major incident in MEW’s history follows from that one fact, which is why its history is worth reading even if you have never used it. Our guide to multi currency wallets covers where MEW sits beside apps that hold many chains at once.

Today MEW comes in several shapes, listed in its help article on accessing a wallet: the website, which its help centre now calls MEW Portfolio; a browser extension called Enkrypt; the MEW mobile app; and connections to hardware wallets such as Ledger and Trezor. The same help centre notes that some older hardware guides, KeepKey among them, no longer apply to the current site.

What happened when MyEtherWallet was hijacked in 2018?

On 24 April 2018 nobody broke into MEW. They broke into the internet’s directions instead. Cloudflare’s write up of the attack says that between about 11:05 and 12:55 UTC, a network numbered AS10297 announced routes for part of the address space used by Amazon’s Route 53, the DNS service that told browsers where myetherwallet.com lived. Traffic that should have reached Amazon went to a rogue DNS server, which answered queries for MEW with addresses belonging to a Russian provider.

Visitors who landed there saw a copy of MEW served with a certificate their browser did not trust. Anyone who clicked through the warning and unlocked a wallet handed the key to the copy. MEW’s own statement at the time, reported by The Register on 24 April 2018, was that a couple of DNS servers had been hijacked to send users to a phishing site, and that the fault was not on MEW’s side. Losses were reported at the time at around 216 ether, then roughly $150,000.

The lesson has aged well. The browser warning was the only visible clue, and it worked for anyone who stopped. No password, no two factor code and no clever bookmark would have helped someone who pasted a private key into the page, because the page was the attacker.

How did copies of MEW keep stealing after the hijack?

The hijack was the loud one. The quiet ones lasted longer. In May 2018 the threat intelligence firm RiskIQ, as reported by SC Media, profiled a phishing kit it named MEWKit: an unofficial copy of MEW’s code with two extra scripts that waited for a victim to unlock a wallet and then sent the funds out automatically. RiskIQ linked the servers in the April hijack to the same kit.

Two months later the problem arrived through a browser add on. On 9 July 2018 MEW warned that the Hola VPN extension for Chrome had been compromised for about five hours, according to TechCrunch’s report that day. MEW said its own site was not breached, and advised anyone who had used MEW with the extension running in the previous day to move their funds to a new wallet.

Date	What happened	Was MEW itself breached?	Where the key was lost	Source
24 Apr 2018	Route 53 traffic hijacked, fake MEW served	No, the routing was	Typed into a copy of the site	Cloudflare
May 2018	MEWKit phishing kit profiled	No, a copy of its code was used	Typed into a copy of the site	RiskIQ via SC Media
9 Jul 2018	Hola VPN extension compromised for about five hours	No, the extension was	Read from the browser	TechCrunch
Jan 2026	Malicious Firefox add on faked a drain	No, the computer was	Funds intact once found	r/ethereum

Read down the fourth column. Not one of these needed MEW’s servers. Each one needed the key to pass through a browser that someone else had a hand in.

Which ways into MEW does MEW itself call not recommended?

MEW is unusually blunt about this, which is to its credit. Its help article explaining the not recommended label says the three software methods, a private key, a keystore file and a mnemonic phrase, all lead back to one underlying key, and that whoever gets that key in any of those forms gets full, permanent control of the wallet. It also warns that keystore passwords can be brute forced relatively easily. Its access guide recommends these methods only with MEW offline.

Way in	Where the key lives	MEW’s label
Enkrypt browser extension	Inside the extension, behind its password	Offered on the connect screen
MEW mobile app, by QR code	On the phone	Offered on the connect screen
Hardware wallet (Ledger, Trezor)	On the device; you confirm there	Offered on the connect screen
Private key typed into the site	In the browser tab	Not recommended online
Keystore file plus password	In the browser tab	Not recommended online
Mnemonic phrase typed into the site	In the browser tab	Not recommended online

Here is the dated check that no review site carries. MEW’s Using MEW Offline article says the latest versions are version 7, which lack the offline feature, so the last version 6 build is the one that has it. On 4 November 2026 MEW’s GitHub release page showed v7.8.0, released on 29 October 2026, as the newest build, and v6.9.28, released on 16 October 2026, still shipping a separate Offline package with a signature file and a SHA256 checksum. So the offline route is maintained, not abandoned, and it lives on the older line.

MEW’s private key article adds one more fact worth knowing: a private key can be worked out from a recovery phrase, but not the other way round. The phrase is the master. That is the same rule our recovery phrase guide builds everything else on.

What do MEW users who thought they were drained report?

We read the Trustpilot reviews of MyEtherWallet, 12 of the 13 that page shows, averaging 1.9 stars, and two linked Reddit threads from January 2026 with about 25 comments between them. The Trustpilot set is mostly about support: slow replies, tokens that did not show in the wallet, and one review from February 2022 in which the company blamed a malicious contract for tokens that left an account. None described the 2018 hijack. What follows is what people report, not proof of what happened to them.

The clearest account is a single story told twice. In r/MyEtherWallet on 12 January 2026, a user who opened their wallet with a keystore file posted a block explorer screenshot showing their ether gone. Within a day, in a follow up in r/ethereum, they described how a recruiter on LinkedIn had asked them to install software for a crypto job a month earlier. The outgoing transaction appeared only in their main Firefox session, vanished in a private window and in other browsers, and a commenter who checked the address found no such transaction on chain. Removing a Firefox add on that was reading data for MEW and the block explorer made the fake drain disappear.

The user read it as an attempt to make them panic and rush into unlocking the wallet, which is how the key would actually have been taken. A member of the MEW team replied in the first thread that the computer may still be compromised, that a new wallet was the safer course, and that MEW’s own warnings say using a keystore or private key directly is not best practice. A third commenter recommended reformatting the machine and moving funds only from a clean one.

One more pattern from the same thread: weeks later, an unrelated account replied praising a recovery service reached through Instagram. Nothing on Ethereum can reverse a confirmed transaction, so a stranger offering to recover funds is offering something the network does not allow. Where these accounts agree with MEW’s guidance is the core of it: the danger was in the browser, not on MEW’s servers. Where they go further is in showing that the attack can be a fake loss designed to make you type the key in a hurry.

How do you reach the real MEW without handing over a key?

Type the address yourself, or use a bookmark you saved the first time, and never arrive from a search advert or a link in a message. Our guide to finding the official Trezor site walks through the same habit for another brand; the method transfers unchanged.

After that, the best protection is not to need the page to see your key at all. A hardware wallet connection or the MEW mobile app keeps the key off the website, which is the whole point of the methods MEW offers first. If you hold an old keystore file or a phrase from years ago, MEW’s own advice is to move to a wallet created by one of those methods. Never paste a private key or a recovery phrase into any web page, form, chat or support ticket, including one that looks exactly like MEW.

If you once made a paper wallet on the old MEW site, the printout is a private key, and the same rules apply to it. The same goes for any other app that asks for your words: our MetaMask seed phrase guide covers the fake support messages that ask for them.

Frequently asked questions

---

This article is general information about wallet security and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything, or to use or avoid any service. Speak to a suitably qualified professional about your own situation, and remember that in self custody the security decisions are yours alone.