{"id":866,"date":"2026-11-04T09:35:15","date_gmt":"2026-11-04T09:35:15","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/?p=866"},"modified":"2026-11-04T09:44:12","modified_gmt":"2026-11-04T09:44:12","slug":"mew-crypto","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/","title":{"rendered":"MEW Crypto Wallet: What the Old Phishing Attacks Still Teach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>MEW crypto usually means MyEtherWallet, a free interface for Ethereum that never holds your keys, which is exactly why fake copies of it work so well. In 2018 attackers hijacked its traffic for just under two hours. Today MEW&#8217;s own help pages call typing a private key, keystore file or phrase into its website not recommended.<\/strong><\/p>\n\n\n\n<div class=\"msq-audio\" data-article=\"mew-crypto\" data-minutes=\"12\">\n<style>.msq-audio{margin:1.25em 0 1.75em;padding:16px 18px;background:#EEF3F8;border:1px solid #CBD8E6;border-radius:12px}\n.msq-audio-lead{margin:0 0 8px;font-size:.95em}.msq-audio audio{width:100%;margin:0 0 12px;display:block}\n.msq-toc-title{margin:0 0 6px;font-weight:700}.msq-toc ol{margin:0;padding:0;list-style:none}\n.msq-toc li{display:flex;gap:10px;align-items:center;padding:6px 6px;border-bottom:1px solid #CBD8E6;border-radius:8px}\n.msq-toc li:last-child{border-bottom:0}.msq-toc li.is-active{background:#fff}\n.msq-toc-play{flex:0 0 auto;width:30px;height:30px;border-radius:50%;border:0;background:#1F4E79;color:#fff;font:inherit;font-size:.72em;line-height:30px;padding:0;cursor:pointer}\n.msq-toc-play.is-playing{background:#B4531A}\n.msq-toc-time{flex:0 0 auto;min-width:3.1em;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-toc a{color:#1B1F24;text-decoration:none;line-height:1.35}.msq-toc li.is-active a{font-weight:700;color:#1F4E79}\n.msq-audio-note{margin:10px 0 0;font-size:.82em;color:#4A5560}\nh2.wp-block-heading[id]{scroll-margin-top:24px}\n.msq-hplay{display:inline-block;vertical-align:middle;width:26px;height:26px;margin:0 0 0 10px;border-radius:50%;border:0;background:#1F4E79;cursor:pointer;padding:0;position:relative;top:-2px}\n.msq-hplay::before{content:'\u25b6\ufe0e';display:block;color:#fff;font-size:11px;line-height:26px;text-align:center}\n.msq-hplay.is-playing{background:#B4531A}.msq-hplay.is-playing::before{content:'\u2016';font-size:13px;font-weight:700}\n.msq-bar{position:fixed;left:0;right:0;bottom:0;z-index:9000;display:flex;align-items:center;gap:10px;padding:8px 12px;padding-bottom:calc(8px + env(safe-area-inset-bottom));background:#FFFFFF;border-top:1px solid #CBD8E6;box-shadow:0 -4px 16px rgba(0,0,0,.08);font-size:.92em;color:#1B1F24;transition:transform .2s ease}\n.msq-bar.is-hidden{transform:translateY(130%)}\n.msq-bar-play{display:inline-flex;align-items:center;gap:8px;border:0;border-radius:999px;background:#1F4E79;color:#fff;font:inherit;font-weight:700;padding:8px 14px 8px 12px;cursor:pointer;white-space:nowrap}\n.msq-bar-play.is-playing{background:#B4531A}\n.msq-bar-icon::before{content:'\u25b6\ufe0e';font-size:12px}.msq-bar-play.is-playing .msq-bar-icon::before{content:'\u2016';font-size:14px;font-weight:700}\n.msq-bar-chapter{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n.msq-bar-time{flex:0 0 auto;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-bar-rate,.msq-bar-close{flex:0 0 auto;border:1px solid #CBD8E6;background:#fff;color:#1B1F24;font:inherit;font-size:.85em;line-height:1;border-radius:8px;padding:7px 9px;cursor:pointer}\n.msq-bar-close::before{content:'\u2715'}\n.msq-bar.msq-bar-pill{left:auto;right:14px;bottom:14px;padding:6px;padding-bottom:6px;border:1px solid #CBD8E6;border-radius:999px;box-shadow:0 6px 20px rgba(0,0,0,.15)}\n.msq-bar.msq-bar-pill .msq-bar-chapter,.msq-bar.msq-bar-pill .msq-bar-time,.msq-bar.msq-bar-pill .msq-bar-rate{display:none}\nbody.msq-has-bar{padding-bottom:76px}\n@media (max-width:600px){.msq-bar-time{display:none}.msq-bar{gap:8px;padding-left:10px;padding-right:10px}}\n.msq-s.msq-now{background:#EEF3F8;box-shadow:0 2px 0 #1F4E79;border-radius:2px}\ntr.msq-now td,tr.msq-now th{background:#EEF3F8;box-shadow:inset 0 -2px 0 #1F4E79}\n@media (hover:hover){.msq-s,tr[data-i]{cursor:pointer}.msq-s:hover{background:#EEF3F8}}<\/style>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"AudioObject\",\"@id\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#audio\",\"name\":\"MEW Crypto Wallet: What the Old Phishing Attacks Still Teach, read aloud\",\"description\":\"Synthetic voice reading of the article, recorded 4 November 2026.\",\"contentUrl\":\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-audio-202611041513.mp3\",\"encodingFormat\":\"audio\/mpeg\",\"duration\":\"PT11M46S\",\"uploadDate\":\"2026-11-04\",\"inLanguage\":\"en-GB\",\"isAccessibleForFree\":true,\"mainEntityOfPage\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/\",\"hasPart\":[{\"@type\":\"Clip\",\"name\":\"MEW Crypto Wallet: What the Old Phishing Attacks Still Teach\",\"startOffset\":0,\"endOffset\":66},{\"@type\":\"Clip\",\"name\":\"What is MEW crypto, and who actually holds the keys?\",\"startOffset\":66,\"endOffset\":150,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#what-is-mew-crypto-and-who-actually-holds-the-keys\"},{\"@type\":\"Clip\",\"name\":\"What happened when MyEtherWallet was hijacked in 2018?\",\"startOffset\":150,\"endOffset\":235,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#what-happened-when-myetherwallet-was-hijacked-in-2018\"},{\"@type\":\"Clip\",\"name\":\"How did copies of MEW keep stealing after the hijack?\",\"startOffset\":235,\"endOffset\":367,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#how-did-copies-of-mew-keep-stealing-after-the-hijack\"},{\"@type\":\"Clip\",\"name\":\"Which ways into MEW does MEW itself call not recommended?\",\"startOffset\":367,\"endOffset\":508,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#which-ways-into-mew-does-mew-itself-call-not-recommended\"},{\"@type\":\"Clip\",\"name\":\"What do MEW users who thought they were drained report?\",\"startOffset\":508,\"endOffset\":642,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#what-do-mew-users-who-thought-they-were-drained-report\"},{\"@type\":\"Clip\",\"name\":\"How do you reach the real MEW without handing over a key?\",\"startOffset\":642,\"endOffset\":706,\"url\":\"https:\/\/getbitcoin.guide\/articles\/mew-crypto\/#how-do-you-reach-the-real-mew-without-handing-over-a-key\"}],\"contentSize\":\"4.9 MB\"}<\/script>\n<p class=\"msq-audio-lead\"><strong>Listen to this article<\/strong>, about 12 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.<\/p>\n<audio class=\"msq-audio-player\" controls preload=\"metadata\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-audio-202611041513.mp3\"><\/audio>\n<nav class=\"msq-toc\" aria-label=\"In this article\"><p class=\"msq-toc-title\">In this article<\/p>\n<ol>\n<li data-start=\"0.0\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"0.0\" aria-label=\"Play from: MEW Crypto Wallet: What the Old Phishing Attacks Still Teach\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:00<\/span><a href=\"#top\">MEW Crypto Wallet: What the Old Phishing Attacks Still Teach<\/a><\/li>\n<li data-start=\"65.9\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"65.9\" aria-label=\"Play from: What is MEW crypto, and who actually holds the keys?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">1:06<\/span><a href=\"#what-is-mew-crypto-and-who-actually-holds-the-keys\">What is MEW crypto, and who actually holds the keys?<\/a><\/li>\n<li data-start=\"150.24\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"150.24\" aria-label=\"Play from: What happened when MyEtherWallet was hijacked in 2018?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">2:30<\/span><a href=\"#what-happened-when-myetherwallet-was-hijacked-in-2018\">What happened when MyEtherWallet was hijacked in 2018?<\/a><\/li>\n<li data-start=\"235.3\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"235.3\" aria-label=\"Play from: How did copies of MEW keep stealing after the hijack?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">3:55<\/span><a href=\"#how-did-copies-of-mew-keep-stealing-after-the-hijack\">How did copies of MEW keep stealing after the hijack?<\/a><\/li>\n<li data-start=\"367.32\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"367.32\" aria-label=\"Play from: Which ways into MEW does MEW itself call not recommended?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">6:07<\/span><a href=\"#which-ways-into-mew-does-mew-itself-call-not-recommended\">Which ways into MEW does MEW itself call not recommended?<\/a><\/li>\n<li data-start=\"507.9\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"507.9\" aria-label=\"Play from: What do MEW users who thought they were drained report?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">8:28<\/span><a href=\"#what-do-mew-users-who-thought-they-were-drained-report\">What do MEW users who thought they were drained report?<\/a><\/li>\n<li data-start=\"642.12\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"642.12\" aria-label=\"Play from: How do you reach the real MEW without handing over a key?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">10:42<\/span><a href=\"#how-do-you-reach-the-real-mew-without-handing-over-a-key\">How do you reach the real MEW without handing over a key?<\/a><\/li>\n<\/ol><\/nav>\n<p class=\"msq-audio-note\">Recorded 4 November 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.<\/p>\n<script>var MSQ_SENT = [[0.0,\"h\",\"mewcryptowalletwhattheol\",50],[4.68,\"p\",\"mewcryptousuallymeansmye\",122],[13.32,\"p\",\"in2018attackershijackedi\",53],[17.84,\"p\",\"todaymewsownhelppagescal\",90],[25.32,\"p\",\"onthispagethe2018myether\",249],[45.64,\"p\",\"checkedon4november2026ag\",139],[57.64,\"p\",\"notagainstreviewsiteswhi\",114],[65.9,\"h\",\"whatismewcryptoandwhoact\",41],[70.06,\"p\",\"mewistheshortnameformyet\",105],[80.14,\"p\",\"theimportantwordistool\",22],[82.62,\"p\",\"mewisnotabankandnotanexc\",29],[85.38,\"p\",\"whenyouopenawalletthroug\",92],[92.1,\"p\",\"mewsownserversneverkeept\",27],[94.62,\"p\",\"thatmakesitagenuinenoncu\",104],[101.7,\"p\",\"thatdesignhasasharpsidee\",29],[104.18,\"p\",\"iftherealmewisjustawebpa\",92],[111.18,\"p\",\"everymajorincidentinmews\",111],[119.3,\"p\",\"ourguidetomulticurrencyw\",82],[125.02,\"p\",\"todaymewcomesinseveralsh\",213],[143.3,\"p\",\"thesamehelpcentrenotesth\",94],[150.24,\"h\",\"whathappenedwhenmyetherw\",46],[153.92,\"p\",\"on24april2018nobodybroke\",31],[158.88,\"p\",\"theybrokeintotheinternet\",42],[161.32,\"p\",\"cloudflareswriteupofthea\",200],[179.96,\"p\",\"trafficthatshouldhaverea\",121],[188.4,\"p\",\"visitorswholandedtheresa\",80],[193.84,\"p\",\"anyonewhoclickedthrought\",72],[198.2,\"p\",\"mewsownstatementatthetim\",157],[211.68,\"p\",\"losseswerereportedatthet\",60],[218.32,\"p\",\"thelessonhasagedwell\",20],[220.48,\"p\",\"thebrowserwarningwastheo\",68],[224.96,\"p\",\"nopasswordnotwofactorcod\",125],[235.3,\"h\",\"howdidcopiesofmewkeepste\",43],[238.46,\"p\",\"thehijackwastheloudone\",22],[240.14,\"p\",\"thequietoneslastedlonger\",24],[242.3,\"p\",\"inmay2018thethreatintell\",207],[260.74,\"p\",\"riskiqlinkedtheserversin\",50],[264.98,\"p\",\"twomonthslatertheproblem\",51],[268.26,\"p\",\"on9july2018mewwarnedthat\",122],[278.3,\"p\",\"mewsaiditsownsitewasnotb\",127],[287.54,\"t\",\"24apr2018\",148],[305.02,\"t\",\"may2018\",150],[321.58,\"t\",\"9jul2018\",153],[339.9,\"t\",\"jan2026\",140],[357.46,\"p\",\"readdownthefourthcolumn\",23],[359.58,\"p\",\"notoneoftheseneededmewss\",30],[362.54,\"p\",\"eachoneneededthekeytopas\",65],[367.32,\"h\",\"whichwaysintomewdoesmewi\",47],[371.24,\"p\",\"mewisunusuallybluntabout\",46],[375.48,\"p\",\"itshelparticleexplaining\",221],[392.8,\"p\",\"italsowarnsthatkeystorep\",64],[397.36,\"p\",\"itsaccessguiderecommends\",54],[401.64,\"t\",\"enkryptbrowserextension\",108],[411.76,\"t\",\"mewmobileappbyqrcode\",80],[419.64,\"t\",\"hardwarewalletledgertrez\",102],[429.12,\"t\",\"privatekeytypedintothesi\",86],[437.6,\"t\",\"keystorefilepluspassword\",84],[445.32,\"t\",\"mnemonicphrasetypedintot\",90],[453.76,\"p\",\"hereisthedatedcheckthatn\",42],[456.64,\"p\",\"mewsusingmewofflineartic\",123],[466.88,\"p\",\"on4november2026mewsgithu\",188],[489.48,\"p\",\"sotheofflinerouteismaint\",65],[493.68,\"p\",\"mewsprivatekeyarticleadd\",114],[502.04,\"p\",\"thephraseisthemaster\",20],[503.16,\"p\",\"thatisthesameruleourreco\",61],[507.9,\"h\",\"whatdomewuserswhothought\",45],[511.3,\"p\",\"wereadthetrustpilotrevie\",149],[524.74,\"p\",\"thetrustpilotsetismostly\",173],[537.98,\"p\",\"nonedescribedthe2018hija\",26],[540.66,\"p\",\"whatfollowsiswhatpeopler\",57],[545.38,\"p\",\"theclearestaccountisasin\",41],[548.82,\"p\",\"inrmyetherwalleton12janu\",124],[560.34,\"p\",\"withinadayinafollowupinr\",123],[569.42,\"p\",\"theoutgoingtransactionap\",163],[580.78,\"p\",\"removingafirefoxaddontha\",89],[587.3,\"p\",\"theuserreaditasanattempt\",110],[593.74,\"p\",\"amemberofthemewteamrepli\",185],[607.06,\"p\",\"athirdcommenterrecommend\",79],[612.98,\"p\",\"onemorepatternfromthesam\",113],[620.46,\"p\",\"nothingonethereumcanreve\",122],[627.66,\"p\",\"wheretheseaccountsagreew\",92],[635.26,\"p\",\"wheretheygofurtherisinsh\",91],[642.12,\"h\",\"howdoyoureachtherealmeww\",45],[645.64,\"p\",\"typetheaddressyourselfor\",104],[652.64,\"p\",\"ourguidetofindingtheoffi\",104],[660.28,\"p\",\"afterthatthebestprotecti\",61],[665.84,\"p\",\"ahardwarewalletconnectio\",112],[674.4,\"p\",\"ifyouholdanoldkeystorefi\",103],[682.32,\"p\",\"neverpasteaprivatekeyora\",110],[690.12,\"p\",\"ifyouoncemadeapaperwalle\",88],[697.2,\"p\",\"thesamegoesforanyotherap\",113]];\n(function(){\n  function init(){\n  var root = document.querySelector('.msq-audio'); if (!root) { return; }\n  var audio = root.querySelector('audio'), items = Array.prototype.slice.call(root.querySelectorAll('.msq-toc li'));\n  var starts = items.map(function(li){ return parseFloat(li.getAttribute('data-start')) || 0; });\n  var names = items.map(function(li){ return li.querySelector('a').textContent; });\n  var anchors = items.map(function(li){ var h = li.querySelector('a').getAttribute('href') || ''; return (h.charAt(0) === '#' && h !== '#top') ? document.getElementById(h.slice(1)) : null; });\n  var article = root.getAttribute('data-article') || location.pathname, minutes = root.getAttribute('data-minutes') || '';\n  var marks = {}, started = false, pausedAt = -1, closed = false, ended = false;\n  var RATES = [1, 1.25, 1.5], rate = 1;\n  try { var saved = parseFloat(localStorage.getItem('msq-audio-rate')); if (RATES.indexOf(saved) >= 0) { rate = saved; } } catch (e) {}\n  audio.playbackRate = rate;\n  function track(name, extra){ try { if (typeof gtag === 'function') { var p = { article: article }; for (var k in extra) { p[k] = extra[k]; } gtag('event', name, p); } } catch (e) {} }\n  function current(){ var t = audio.currentTime, idx = 0; for (var i = 0; starts.length > i; i += 1) { if (t + 0.25 >= starts[i]) { idx = i; } } return idx; }\n  function onScreen(){\n    var line = window.innerHeight \/ 3, idx = 0;\n    for (var i = 0; anchors.length > i; i += 1) { var el = anchors[i]; if (el && line >= el.getBoundingClientRect().top) { idx = i; } }\n    return idx;\n  }\n  function fmt(s){ s = Math.max(0, Math.round(s || 0)); var m = Math.floor(s \/ 60), r = s % 60; return m + ':' + (10 > r ? '0' : '') + r; }\n  function play(from, source){\n    if (from !== null) { audio.currentTime = from; }\n    var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n    track(from === null ? 'audio_resume' : 'audio_chapter', { chapter: names[current()], start: Math.round(audio.currentTime), source: source });\n  }\n  var hbtns = anchors.map(function(el, i){\n    if (!el) { return null; }\n    var b = document.createElement('button'); b.type = 'button'; b.className = 'msq-hplay'; b.setAttribute('aria-label', 'Play this section: ' + names[i]);\n    b.addEventListener('click', function(){\n      if (!audio.paused && current() === i) { audio.pause(); track('audio_pause', { source: 'heading' }); return; }\n      play(starts[i], 'heading');\n    });\n    el.appendChild(b); return b;\n  });\n  var bar = document.createElement('div'); bar.className = 'msq-bar msq-bar-pill is-hidden'; bar.setAttribute('role', 'region'); bar.setAttribute('aria-label', 'Audio player');\n  var playBtn = document.createElement('button'); playBtn.type = 'button'; playBtn.className = 'msq-bar-play';\n  var icon = document.createElement('span'); icon.className = 'msq-bar-icon'; icon.setAttribute('aria-hidden', 'true');\n  var label = document.createElement('span'); label.className = 'msq-bar-label';\n  playBtn.appendChild(icon); playBtn.appendChild(label);\n  var chap = document.createElement('span'); chap.className = 'msq-bar-chapter';\n  var clock = document.createElement('span'); clock.className = 'msq-bar-time';\n  var rateBtn = document.createElement('button'); rateBtn.type = 'button'; rateBtn.className = 'msq-bar-rate'; rateBtn.setAttribute('aria-label', 'Playback speed');\n  var closeBtn = document.createElement('button'); closeBtn.type = 'button'; closeBtn.className = 'msq-bar-close'; closeBtn.setAttribute('aria-label', 'Close the audio bar');\n  bar.appendChild(playBtn); bar.appendChild(chap); bar.appendChild(clock); bar.appendChild(rateBtn); bar.appendChild(closeBtn);\n  document.body.appendChild(bar);\n  function showRate(){ rateBtn.textContent = (rate === 1 ? '1' : String(rate)) + 'x'; }\n  showRate();\n  rateBtn.addEventListener('click', function(){\n    rate = RATES[(RATES.indexOf(rate) + 1) % RATES.length]; audio.playbackRate = rate; showRate();\n    try { localStorage.setItem('msq-audio-rate', String(rate)); } catch (e) {}\n    track('audio_rate', { rate: rate });\n  });\n  closeBtn.addEventListener('click', function(){\n    closed = true; if (!audio.paused) { audio.pause(); } paint(); track('audio_bar_close', {});\n  });\n  function mode(){\n    if (!audio.paused) { return 'pause'; }\n    if (ended) { return 'again'; }\n    if (!started) { return 'listen'; }\n    return (pausedAt === onScreen()) ? 'resume' : 'section';\n  }\n  playBtn.addEventListener('click', function(){\n    var m = mode();\n    if (m === 'pause') { audio.pause(); track('audio_pause', { source: 'bar' }); return; }\n    if (m === 'again') { ended = false; play(0, 'bar'); return; }\n    if (m === 'resume') { play(null, 'bar'); return; }\n    play(starts[onScreen()], 'bar');\n  });\n  function paint(){\n    var idx = current(), playing = !audio.paused, m = mode();\n    items.forEach(function(li, i){\n      var on = (i === idx) && playing, b = li.querySelector('.msq-toc-play'), a = li.querySelector('a');\n      li.classList.toggle('is-active', on); b.classList.toggle('is-playing', on);\n      b.textContent = on ? '\u2016' : '\u25b6\ufe0e';\n      b.setAttribute('aria-label', (on ? 'Pause: ' : 'Play from: ') + a.textContent);\n    });\n    hbtns.forEach(function(b, i){ if (b) { var on = (i === idx) && playing; b.classList.toggle('is-playing', on); b.setAttribute('aria-label', (on ? 'Pause this section: ' : 'Play this section: ') + names[i]); } });\n    playBtn.classList.toggle('is-playing', playing);\n    label.textContent = m === 'pause' ? 'Pause' : m === 'again' ? 'Play again' : m === 'resume' ? 'Resume' : m === 'section' ? 'Play this section' : 'Listen, ' + minutes + ' min';\n    playBtn.setAttribute('aria-label', label.textContent);\n    chap.textContent = started ? names[(playing || m === 'resume') ? idx : onScreen()] : '';\n    clock.textContent = started ? fmt(audio.currentTime) + ' \/ ' + fmt(audio.duration) : '';\n    bar.classList.toggle('msq-bar-pill', !started);\n    var show = !closed && (started || 0 > root.getBoundingClientRect().bottom);\n    bar.classList.toggle('is-hidden', !show);\n    document.body.classList.toggle('msq-has-bar', show);\n  }\n  root.addEventListener('click', function(e){\n    var b = e.target.closest ? e.target.closest('.msq-toc-play') : null; if (!b) { return; }\n    var li = b.parentNode, s = parseFloat(b.getAttribute('data-start')) || 0;\n    if (!audio.paused && current() === items.indexOf(li)) { audio.pause(); track('audio_pause', { source: 'index' }); return; }\n    play(s, 'index');\n  });\n  audio.addEventListener('play', function(){ ended = false; closed = false; if (!started) { started = true; track('audio_play', { minutes: Math.round((audio.duration || 0) \/ 60) }); } paint(); });\n  audio.addEventListener('pause', function(){ pausedAt = current(); paint(); });\n  audio.addEventListener('timeupdate', function(){\n    paint();\n    if (audio.duration > 0) {\n      var pct = Math.floor(audio.currentTime \/ audio.duration * 100);\n      [25, 50, 75].forEach(function(m){ if (pct >= m && !marks[m]) { marks[m] = true; track('audio_progress', { percent: m }); } });\n    }\n  });\n  audio.addEventListener('ended', function(){ ended = true; track('audio_complete', {}); paint(); });\n  var ticking = false;\n  function onScroll(){ if (ticking) { return; } ticking = true; setTimeout(function(){ ticking = false; paint(); }, 80); }\n  window.addEventListener('scroll', onScroll, { passive: true }); window.addEventListener('resize', onScroll);\n  paint();\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', init); } else { init(); }\n})();\n\n(function(){\n  function start(){\n    var root = document.querySelector('.msq-audio'), audio = root ? root.querySelector('audio') : null;\n    var map = (typeof MSQ_SENT !== 'undefined') ? MSQ_SENT : [];\n    if (!root || !audio || !map.length) { return; }\n    var scope = root.closest('main') || root.closest('article') || root.closest('.entry-content') || document.body;\n    var SKIP = '.msq-audio,.msq,.msq-tool,.msq-end,.msq-bar,script,style,noscript,figcaption,#rank-math-faq,.rank-math-block,nav,header,footer';\n    function norm(s){ return s.toLowerCase().replace(\/[^a-z0-9]+\/g, ''); }\n    var nodes = [], stream = '', walker = document.createTreeWalker(scope, NodeFilter.SHOW_TEXT, null), n;\n    while ((n = walker.nextNode())) {\n      var el = n.parentElement; if (!el || el.closest(SKIP)) { continue; }\n      var raw = n.nodeValue, keep = [], norms = '';\n      for (var i = 0; raw.length > i; i += 1) { var c = raw.charAt(i).toLowerCase(); if (\/[a-z0-9]\/.test(c)) { keep.push(i); norms += c; } }\n      if (!norms) { continue; }\n      nodes.push({ node: n, a: stream.length, b: stream.length + norms.length, keep: keep });\n      stream += norms;\n    }\n    var segs = [], cursor = 0, lastRow = null;\n    map.forEach(function(m, idx){\n      var kind = m[1], f = m[2], len = m[3];\n      if (kind === 't') {\n        var rows = scope.querySelectorAll('tr'), after = !lastRow;\n        for (var r = 0; rows.length > r; r += 1) {\n          var tr = rows[r];\n          if (!after) { if (tr === lastRow) { after = true; } continue; }\n          var cell = tr.querySelector('td,th');\n          if (cell && norm(cell.textContent).indexOf(f) === 0) { tr.setAttribute('data-i', idx); lastRow = tr; break; }\n        }\n        return;\n      }\n      var p = stream.indexOf(f, cursor); if (0 > p) { return; }\n      segs.push({ i: idx, a: p, b: Math.min(p + len, stream.length) }); cursor = p + len;\n    });\n    var si = 0;\n    nodes.forEach(function(nd){\n      var frag = document.createDocumentFragment(), raw = nd.node.nodeValue, rawPos = 0, any = false;\n      for (var k = si; segs.length > k; k += 1) {\n        var sg = segs[k]; if (sg.a >= nd.b) { break; } if (nd.a >= sg.b) { continue; }\n        var s = Math.max(sg.a, nd.a), e = Math.min(sg.b, nd.b);\n        var rs = nd.keep[s - nd.a], re2 = nd.keep[e - nd.a - 1] + 1;\n        if (rs > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos, rs))); }\n        var span = document.createElement('span'); span.className = 'msq-s'; span.setAttribute('data-i', sg.i); span.textContent = raw.slice(rs, re2);\n        frag.appendChild(span); rawPos = re2; any = true;\n        if (sg.b > nd.b) { break; }\n      }\n      while (segs.length > si && nd.b >= segs[si].b) { si += 1; }\n      if (!any) { return; }\n      if (raw.length > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos))); }\n      nd.node.parentNode.replaceChild(frag, nd.node);\n    });\n    var starts = map.map(function(m){ return m[0]; }), curIdx = -1, lastUser = 0, timer = null, autoUntil = 0, dragging = false;\n    function idxAt(t){ var lo = 0, hi = starts.length; while (hi > lo + 1) { var mid = (lo + hi) >> 1; if (t + 0.15 >= starts[mid]) { lo = mid; } else { hi = mid; } } return (t + 0.15 >= starts[0]) ? lo : -1; }\n    function setNow(i){\n      if (i === curIdx) { return; }\n      Array.prototype.forEach.call(scope.querySelectorAll('.msq-now'), function(el){ el.classList.remove('msq-now'); });\n      curIdx = i; if (0 > i) { return; }\n      var els = scope.querySelectorAll('[data-i=\"' + i + '\"]'); if (!els.length) { return; }\n      Array.prototype.forEach.call(els, function(el){ el.classList.add('msq-now'); });\n      var r = els[0].getBoundingClientRect(), now = Date.now();\n      if (!dragging && now > lastUser + 2500 && (80 > r.top || r.bottom > window.innerHeight - 140)) {\n        var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;\n        autoUntil = now + (reduce ? 400 : 1600);\n        els[0].scrollIntoView({ block: 'center', behavior: reduce ? 'auto' : 'smooth' });\n      }\n    }\n    function tick(){ if (!audio.paused) { setNow(idxAt(audio.currentTime)); } }\n    function userScrolled(){ lastUser = Date.now(); }\n    ['wheel', 'touchmove', 'keydown'].forEach(function(ev){ window.addEventListener(ev, userScrolled, { passive: true }); });\n    window.addEventListener('scroll', function(){ if (Date.now() > autoUntil) { userScrolled(); } }, { passive: true });\n    window.addEventListener('mousedown', function(e){ if (e.clientX >= document.documentElement.clientWidth) { dragging = true; userScrolled(); } }, { passive: true });\n    window.addEventListener('mouseup', function(){ if (dragging) { dragging = false; userScrolled(); } }, { passive: true });\n    audio.addEventListener('play', function(){ if (timer) { clearInterval(timer); } timer = setInterval(tick, 150); tick(); });\n    audio.addEventListener('pause', function(){ if (timer) { clearInterval(timer); timer = null; } });\n    scope.addEventListener('click', function(e){\n      if (e.target.closest('a, button, input, select, textarea, label, summary, .msq, .msq-tool, .msq-end, .msq-audio, .msq-bar')) { return; }\n      var sel = window.getSelection ? String(window.getSelection()) : '';\n      if (sel && sel.trim()) { return; }\n      var el = e.target.closest('[data-i]'); if (!el) { return; }\n      var i = parseInt(el.getAttribute('data-i'), 10); if (isNaN(i)) { return; }\n      if (!audio.paused && i === curIdx) { return; }\n      lastUser = Date.now();\n      audio.currentTime = starts[i];\n      var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n      try { if (typeof gtag === 'function') { gtag('event', 'audio_chapter', { article: location.pathname, source: 'sentence', start: Math.round(starts[i]) }); } } catch (err) {}\n    });\n    audio.addEventListener('seeked', tick);\n    audio.addEventListener('ended', function(){ setNow(-1); });\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', start); } else { start(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"msq-hook wp-block-paragraph\">On this page: the 2018 MyEtherWallet hijack traced from Cloudflare&#8217;s own write up, MEW&#8217;s help centre quoted on which ways in it calls not recommended, a GitHub release check dated 4 November 2026 showing where the offline build still lives, and a January 2026 account of a fake drain staged inside a browser.<\/p>\n\n\n\n<div class=\"msq\" id=\"ms-quiz\" data-slug=\"mew-crypto\" data-category=\"wallets\" data-list=\"1\">\n<style>.msq,.msq-hook,.msq-box,.msq-end,.msq-tool{--msq-accent:#1F4E79;--msq-accent-text:#FFFFFF;--msq-line:#CBD8E6;--msq-warn:#B4531A;--msq-muted:#4A5560;--msq-tint:#EEF3F8;--msq-base:#FFFFFF}\n.msq{margin:1.25em 0 1.75em}\n.msq-hook{border-left:3px solid var(--msq-accent);padding:6px 14px;color:var(--msq-muted);font-size:.97em}\n.msq-box{background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px;padding:0}\n.msq-box>summary{cursor:pointer;list-style:none;padding:14px 18px;font-weight:700;color:var(--msq-accent)}\n.msq-box>summary::-webkit-details-marker{display:none}\n.msq-box>summary::before{content:\"+\";display:inline-block;width:1.1em;font-weight:800}\n.msq-box[open]>summary::before{content:\"\\00d7\"}\n.msq-body{padding:2px 18px 18px}\n.msq-intro{margin:0 0 12px;font-size:.95em;color:var(--msq-muted)}\n.msq-list{margin:0;padding:0;list-style:none}\n.msq-q{margin:0 0 18px;padding:0}\n.msq-question{font-weight:700;margin:0 0 8px}\n.msq-options{display:flex;flex-direction:column;gap:8px}\n.msq-opt{text-align:left;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;padding:10px 12px;font:inherit;font-size:.95em;color:inherit;cursor:pointer;line-height:1.35}\n.msq-opt:hover{border-color:var(--msq-accent)}\n.msq-opt[disabled]{cursor:default}\n.msq-opt.is-right{border-color:var(--msq-accent);background:var(--msq-line);font-weight:700}\n.msq-opt.is-wrong{border-color:var(--msq-warn);color:var(--msq-warn)}\n.msq-explain{margin:8px 0 0;font-size:.92em;padding:10px 12px;border-left:3px solid var(--msq-accent);background:var(--msq-base);border-radius:0 8px 8px 0}\n.msq-explain[hidden]{display:none}\n.msq-verdict{font-weight:700}\n.msq-result{margin-top:14px;padding:14px 16px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:10px}\n.msq-result[hidden]{display:none}\n.msq-result h3{margin:0 0 6px;font-size:1.1em}\n.msq-result p{margin:0 0 8px}\n.msq-jump{margin:0 0 8px;padding-left:1.2em}\n.msq-form{margin-top:10px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}\n.msq-form input[type=email]{flex:1 1 220px;padding:10px 12px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-btn{background:var(--msq-accent);color:var(--msq-accent-text);border:0;border-radius:8px;padding:11px 18px;font:inherit;font-weight:700;cursor:pointer}\n.msq-btn:hover{filter:brightness(.92)}\n.msq-btn[disabled]{opacity:.7;cursor:default}\n.msq-no{font-size:.9em;color:var(--msq-muted);margin-left:4px}\n.msq-privacy{margin:6px 0 0;font-size:.82em;color:var(--msq-muted);flex-basis:100%}\n.msq-hp{position:absolute;left:-5000px;width:1px;height:1px;overflow:hidden}\n.msq-msg{margin:8px 0 0;font-size:.92em}\n.msq-end{margin:1.5em 0;padding:18px;border:1px solid var(--msq-accent);border-radius:12px;text-align:center;background:var(--msq-tint)}\n.msq-end p{margin:0 0 12px}\n.msq-end .msq-body{text-align:left;padding:16px 0 0}\n.msq-end .msq-start-test[hidden]{display:none}\n.msq-tool{margin:1.5em 0;padding:18px 20px;background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px}\n.msq-tool h3{margin:0 0 6px;font-size:1.15em}\n.msq-tool p{margin:0 0 10px}\n.msq-tool .msq-note{font-size:.85em;color:var(--msq-muted);margin:10px 0 0}\n.msq-check label{display:flex;gap:10px;align-items:flex-start;padding:9px 0;border-bottom:1px solid var(--msq-line);cursor:pointer;line-height:1.4}\n.msq-check label:last-of-type{border-bottom:0}\n.msq-check input{margin-top:5px;flex:0 0 auto;width:18px;height:18px;accent-color:var(--msq-accent)}\n.msq-check-count{font-weight:700;margin:10px 0 0}\n.msq-verdict-box{margin:12px 0 0;padding:10px 14px;border-radius:8px;background:var(--msq-base);border-left:3px solid var(--msq-warn)}\n.msq-verdict-box[hidden]{display:none}\n.msq-calc{display:grid;grid-template-columns:1fr 1fr;gap:10px 16px}\n.msq-calc label{display:flex;flex-direction:column;gap:4px;font-size:.92em}\n.msq-calc input,.msq-calc select{padding:8px 10px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-calc-out{grid-column:1 \/ -1;margin-top:6px;padding:12px 14px;background:var(--msq-base);border-radius:8px;border:1px solid var(--msq-line)}\n.msq-calc-out strong{font-size:1.15em}\n.msq-choose label{display:block;padding:9px 12px;margin:0 0 8px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;cursor:pointer}\n.msq-choose input{margin-right:8px;accent-color:var(--msq-accent)}\n.msq-choice-result{margin-top:10px;padding:12px 14px;background:var(--msq-base);border-left:3px solid var(--msq-accent);border-radius:0 8px 8px 0}\n.msq-choice-result[hidden]{display:none}\n@media (max-width:600px){.msq-calc{grid-template-columns:1fr}}\nh2.wp-block-heading[id]{scroll-margin-top:24px}<\/style>\n<noscript><style>.msq-explain{display:block !important}<\/style><\/noscript>\n<details class=\"msq-box\">\n<summary>Think you already know this? Five questions, one minute.<\/summary>\n<div class=\"msq-body\">\n<p class=\"msq-intro\">Every answer is on this page. Answer from what you know now; the page fills in the rest.<\/p>\n<ol class=\"msq-list\">\n<li class=\"msq-q\" data-q=\"1\" data-answer=\"a\" data-title=\"What is MEW crypto, and who actually holds the keys?\" data-section=\"#what-is-mew-crypto-and-who-actually-holds-the-keys\">\n<p class=\"msq-question\">1. Which of these ways into MEW does its help article list on the connect screen?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 1 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Enkrypt, the MEW mobile app and hardware wallets such as Ledger and Trezor<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">A MEW account with email and password that MEW can reset<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">A custodial MEW balance held on MEW&#8217;s servers<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>MEW&#8217;s <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5377855-how-to-access-your-wallet-with-mew-portfolio\" target=\"_blank\" rel=\"noopener\">help article on accessing a wallet<\/a> lists Enkrypt, MEW mobile and hardware wallets. MEW never holds your keys, so there is nothing for it to reset. <a class=\"msq-section\" href=\"#what-is-mew-crypto-and-who-actually-holds-the-keys\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"2\" data-answer=\"b\" data-title=\"What happened when MyEtherWallet was hijacked in 2018?\" data-section=\"#what-happened-when-myetherwallet-was-hijacked-in-2018\">\n<p class=\"msq-question\">2. According to Cloudflare, what did the attackers actually take over on 24 April 2018?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 2 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">MEW&#8217;s own web servers<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Internet routes to part of Amazon&#8217;s Route 53 DNS service<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">The Ethereum network itself<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/blog.cloudflare.com\/bgp-leaks-and-crypto-currencies\/\" target=\"_blank\" rel=\"noopener\">Cloudflare&#8217;s write up<\/a> says AS10297 announced routes for Route 53 address space between about 11:05 and 12:55 UTC, so a rogue DNS server answered for MEW. <a class=\"msq-section\" href=\"#what-happened-when-myetherwallet-was-hijacked-in-2018\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"3\" data-answer=\"c\" data-title=\"How did copies of MEW keep stealing after the hijack?\" data-section=\"#how-did-copies-of-mew-keep-stealing-after-the-hijack\">\n<p class=\"msq-question\">3. What was MEWKit, as RiskIQ described it in May 2018?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 3 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">An official MEW security update<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">A hardware wallet made for MEW<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">An unofficial copy of MEW&#8217;s code with added scripts that drained unlocked wallets<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/www.scmagazine.com\/news\/mewkit-phishing-campaign-steals-myetherwallet-credentials-to-perform-automated-fund-transfers\" target=\"_blank\" rel=\"noopener\">SC Media&#8217;s report on RiskIQ&#8217;s findings<\/a> describes a copied MEW front end with two extra scripts that moved funds out automatically. <a class=\"msq-section\" href=\"#how-did-copies-of-mew-keep-stealing-after-the-hijack\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"4\" data-answer=\"a\" data-title=\"Which ways into MEW does MEW itself call not recommended?\" data-section=\"#which-ways-into-mew-does-mew-itself-call-not-recommended\">\n<p class=\"msq-question\">4. Which access methods does MEW label not recommended for use online?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 4 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Private key, keystore file and mnemonic phrase<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Enkrypt and the MEW mobile app<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Ledger and Trezor hardware wallets<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>MEW&#8217;s <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5377921-mew-says-not-recommended-when-i-access-my-wallet-why\" target=\"_blank\" rel=\"noopener\">not recommended explainer<\/a> says all three software methods lead to one key that gives full control of the wallet. <a class=\"msq-section\" href=\"#which-ways-into-mew-does-mew-itself-call-not-recommended\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"5\" data-answer=\"b\" data-title=\"What do MEW users who thought they were drained report?\" data-section=\"#what-do-mew-users-who-thought-they-were-drained-report\">\n<p class=\"msq-question\">5. In the January 2026 account, what made the apparent drain disappear?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 5 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">MEW support reversing the transaction<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Removing a malicious Firefox add on<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Waiting for more block confirmations<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The user&#8217;s <a href=\"https:\/\/www.reddit.com\/r\/ethereum\/comments\/1qbg5s3\/i_believe_a_malicious_actor_tried_to_exploit_me\/\" target=\"_blank\" rel=\"noopener\">follow up in r\/ethereum<\/a> reports the transaction existed only in one browser and vanished once the add on was removed. This is one person&#8217;s report, not a finding. <a class=\"msq-section\" href=\"#what-do-mew-users-who-thought-they-were-drained-report\">Read the section<\/a><\/p>\n<\/li>\n<\/ol>\n<div class=\"msq-result\" hidden><\/div>\n<\/div>\n<\/details>\n<script>(function(){\n  if (window.__msqInit) { return; }\n  window.__msqInit = true;\n  var root = document.getElementById('ms-quiz');\n  if (!root) { return; }\n  var meta = { slug: root.getAttribute('data-slug'), category: root.getAttribute('data-category'),\n               list: root.getAttribute('data-list') || '1' };\n  function qs(el, s){ return el.querySelector(s); }\n  function qsa(el, s){ return Array.prototype.slice.call(el.querySelectorAll(s)); }\n  function track(name, params){\n    try { if (typeof gtag === 'function') { var p = params || {}; p.article = meta.slug; gtag('event', name, p); } } catch (e) {}\n  }\n  function jumpList(missed){\n    if (!missed.length) { return ''; }\n    return '<ul class=\"msq-jump\">' + missed.map(function(q){\n      return '<li><a href=\"' + q.getAttribute('data-section') + '\">' + q.getAttribute('data-title') + '<\/a><\/li>';\n    }).join('') + '<\/ul>';\n  }\n  function emailForm(){\n    return '<div class=\"msq-sub\"><p><strong>Get the next one.<\/strong> We publish new articles on ' + meta.category\n      + ' most weeks and recheck this page on Sundays. Email me when a new article goes up or this page changes.<\/p>'\n      + '<form class=\"msq-form\" method=\"post\" action=\"\/mail\/form.php\" novalidate>'\n      + '<input type=\"hidden\" name=\"list\" value=\"' + meta.list + '\">'\n      + '<input type=\"hidden\" name=\"name\" value=\"\">'\n      + '<label class=\"msq-hp\" aria-hidden=\"true\">Leave this empty<input type=\"text\" name=\"website\" tabindex=\"-1\" autocomplete=\"off\"><\/label>'\n      + '<input type=\"email\" name=\"email\" placeholder=\"you@example.com\" required aria-label=\"Email address\" autocomplete=\"email\">'\n      + '<button type=\"submit\" class=\"msq-btn\">Email me the updates<\/button>'\n      + '<a href=\"#\" class=\"msq-no\">No thanks<\/a>'\n      + '<p class=\"msq-privacy\">We store your email and this page\\'s topic, nothing else. Unsubscribe any time.<\/p>'\n      + '<\/form><p class=\"msq-msg\" aria-live=\"polite\"><\/p><\/div>';\n  }\n  \/* The autoresponder always answers 200 with its own page. A \".msg.err\" box means the\n     address was rejected, \"You're subscribed\" means accepted, and a redirect only happens\n     after a successful subscribe. Same reading as the landing pages on the other sites. *\/\n  function sendForm(form){\n    return fetch(form.getAttribute('action'), { method: 'POST', body: new FormData(form), credentials: 'same-origin', redirect: 'manual' })\n      .then(function(res){\n        if (res.type === 'opaqueredirect') { return { status: 'ok' }; }\n        if (res.status === 404) { return { status: 'notlive' }; }\n        if (!res.ok) { throw new Error('HTTP ' + res.status); }\n        return res.text().then(function(t){\n          var doc = new DOMParser().parseFromString(t, 'text\/html');\n          var err = doc.querySelector('.msg.err');\n          if (err) {\n            var m = err.textContent.trim();\n            if (\/something went wrong\/i.test(m)) { throw new Error(m); }\n            return { status: 'rejected', message: m };\n          }\n          if (\/you.re subscribed\/i.test(doc.body.textContent)) { return { status: 'ok' }; }\n          return { status: 'unknown' };\n        });\n      });\n  }\n  function wireForm(sub){\n    var form = qs(sub, '.msq-form'), msg = qs(sub, '.msq-msg');\n    qs(form, '.msq-no').addEventListener('click', function(e){\n      e.preventDefault();\n      sub.innerHTML = '<p class=\"msq-msg\">No problem. The Sunday refresh keeps this page current either way.<\/p>';\n      track('quiz_email', { result: 'declined' });\n    });\n    form.addEventListener('submit', function(e){\n      e.preventDefault();\n      var input = qs(form, 'input[name=email]'), btn = qs(form, '.msq-btn');\n      var email = input.value.trim(); input.value = email;\n      if (!\/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)) { msg.textContent = 'That email does not look right.'; return; }\n      btn.disabled = true; btn.textContent = 'Sending';\n      function reset(){ btn.disabled = false; btn.textContent = 'Email me the updates'; }\n      sendForm(form).then(function(r){\n        if (r.status === 'ok' || r.status === 'unknown') {\n          sub.innerHTML = '<p class=\"msq-msg\"><strong>Done.<\/strong> We will email you when the next article on ' + meta.category\n            + ' goes up and when this page changes. If a confirmation email arrives, click it.<\/p>';\n          track('quiz_email', { result: r.status });\n          if (r.status === 'ok') { track('generate_lead', { method: 'quiz' }); }\n        } else if (r.status === 'notlive') {\n          msg.textContent = 'Sign up is not switched on yet for this site. Nothing was stored.'; reset();\n          track('quiz_email', { result: 'notlive' });\n        } else {\n          msg.textContent = r.message || 'Please check the email address and try again.'; reset();\n          track('quiz_email', { result: 'rejected' });\n        }\n      }).catch(function(){\n        msg.textContent = 'Could not reach the sign up service just now. Nothing was stored.'; reset();\n        track('quiz_email', { result: 'error' });\n      });\n    });\n  }\n  function finish(container, mode, score, total, missed){\n    var result = qs(container, '.msq-result');\n    track('quiz_complete', { mode: mode, score: score, total: total });\n    var h;\n    if (mode === 'pre') {\n      h = '<h3>You knew ' + score + ' of ' + total + ' before reading.<\/h3>';\n      h += (score === total) ? '<p>All of them. Read on anyway; the sections below carry the detail behind each answer.<\/p>'\n                             : '<p>The rest is below. Jump straight to what you missed:<\/p>' + jumpList(missed);\n      try { sessionStorage.setItem('msq-pre-' + meta.slug, String(score)); } catch (e) {}\n    } else {\n      var pre = null;\n      try { pre = sessionStorage.getItem('msq-pre-' + meta.slug); } catch (e) {}\n      h = '<h3>You got ' + score + ' of ' + total + '.<\/h3>';\n      if (pre !== null) { h += '<p>Before reading you had ' + pre + ' of ' + total + '.<\/p>'; }\n      if (missed.length) { h += '<p>Worth a second look:<\/p>' + jumpList(missed); }\n      h += emailForm();\n    }\n    result.innerHTML = h; result.hidden = false;\n    if (mode !== 'pre') { wireForm(qs(result, '.msq-sub')); }\n    result.scrollIntoView({ behavior: 'smooth', block: 'nearest' });\n  }\n  function setup(container, mode){\n    var qEls = qsa(container, '.msq-q'), answered = 0, score = 0, missed = [];\n    qEls.forEach(function(q){\n      var answer = q.getAttribute('data-answer'), opts = qsa(q, '.msq-opt'), explain = qs(q, '.msq-explain');\n      q.removeAttribute('data-done'); explain.hidden = true; qs(explain, '.msq-verdict').textContent = '';\n      opts.forEach(function(b){ b.disabled = false; b.classList.remove('is-right', 'is-wrong'); });\n      opts.forEach(function(b){\n        b.addEventListener('click', function(){\n          if (q.getAttribute('data-done')) { return; }\n          q.setAttribute('data-done', '1');\n          var ok = b.getAttribute('data-opt') === answer;\n          opts.forEach(function(o){ o.disabled = true; if (o.getAttribute('data-opt') === answer) { o.classList.add('is-right'); } });\n          if (ok) { score += 1; } else { b.classList.add('is-wrong'); missed.push(q); }\n          qs(explain, '.msq-verdict').textContent = ok ? 'Right. ' : 'Not quite. ';\n          explain.hidden = false;\n          answered += 1;\n          track('quiz_answer', { mode: mode, question: q.getAttribute('data-q'), correct: ok ? 1 : 0 });\n          if (answered === qEls.length) { finish(container, mode, score, qEls.length, missed); }\n        });\n      });\n    });\n  }\n  var box = qs(root, '.msq-box');\n  setup(root, 'pre');\n  if (box) { var skipFirst = box.hasAttribute('data-default-open'); box.addEventListener('toggle', function(){ if (!box.open) { return; } if (skipFirst) { skipFirst = false; return; } track('quiz_open', { mode: 'pre' }); }); }\n  \/* The end block sits far below this script, so it does not exist yet while this runs\n     during parsing. A delegated listener finds it at click time. *\/\n  document.addEventListener('click', function(e){\n    var startBtn = (e.target && e.target.closest) ? e.target.closest('.msq-start-test') : null;\n    if (!startBtn) { return; }\n    var end = startBtn.closest('.msq-end');\n    if (!end) { return; }\n    var mount = qs(end, '.msq-mount');\n    var clone = qs(root, '.msq-body').cloneNode(true);\n    var intro = qs(clone, '.msq-intro');\n    if (intro) { intro.textContent = 'The same five questions, now that you have read the page.'; }\n    var res = qs(clone, '.msq-result'); if (res) { res.hidden = true; res.innerHTML = ''; }\n    mount.innerHTML = ''; mount.appendChild(clone);\n    setup(mount, 'test');\n    startBtn.hidden = true;\n    track('quiz_open', { mode: 'test' });\n    mount.scrollIntoView({ behavior: 'smooth', block: 'start' });\n    var first = qs(mount, '.msq-opt'); if (first) { first.focus({ preventScroll: true }); }\n  });\n  \/* Shared tool behaviour: checklists remember their ticks on this device, and a chooser\n     shows the result for the option picked. Calculators carry their own small script. *\/\n  function initTools(){\n    qsa(document, '.msq-check').forEach(function(box){\n      var key = 'msq-check-' + meta.slug + '-' + (box.getAttribute('data-id') || 'x');\n      var boxes = qsa(box, 'input[type=checkbox]'), count = qs(box, '.msq-check-count');\n      var yes = qs(box, '.msq-verdict-yes'), no = qs(box, '.msq-verdict-no');\n      var saved = {};\n      try { saved = JSON.parse(localStorage.getItem(key) || '{}'); } catch (e) {}\n      boxes.forEach(function(cb, i){ if (saved[i]) { cb.checked = true; } });\n      function refresh(){\n        var n = boxes.filter(function(cb){ return cb.checked; }).length, state = {};\n        boxes.forEach(function(cb, i){ if (cb.checked) { state[i] = 1; } });\n        try { localStorage.setItem(key, JSON.stringify(state)); } catch (e) {}\n        if (count) { count.textContent = n + ' of ' + boxes.length + (box.getAttribute('data-verb') || ' done'); }\n        if (yes && no) { yes.hidden = n === 0; no.hidden = n !== 0; }\n      }\n      boxes.forEach(function(cb){ cb.addEventListener('change', function(){ refresh(); track('tool_check', { tool: box.getAttribute('data-id') }); }); });\n      refresh();\n    });\n    qsa(document, '.msq-choose').forEach(function(box){\n      var results = qsa(box, '.msq-choice-result');\n      qsa(box, 'input[type=radio]').forEach(function(r){\n        r.addEventListener('change', function(){\n          results.forEach(function(el){ el.hidden = el.getAttribute('data-for') !== r.value; });\n          track('tool_choose', { tool: box.getAttribute('data-id'), choice: r.value });\n        });\n      });\n    });\n  }\n  \/\/ read progress: how far down the article the reader has scrolled, fired once per quarter\n  (function(){\n    var art = root.closest('article') || root.parentNode, fired = {};\n    function check(){\n      var top = art.getBoundingClientRect().top + window.pageYOffset, h = art.offsetHeight || 1;\n      var seen = (window.pageYOffset + window.innerHeight - top) \/ h * 100;\n      [25, 50, 75, 100].forEach(function(m){ if (seen >= m && !fired[m]) { fired[m] = true; track('read_progress', { percent: m }); } });\n    }\n    window.addEventListener('scroll', check, { passive: true }); window.addEventListener('load', check);\n  })();\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initTools); } else { initTools(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Checked on 4 November 2026 against MEW&#8217;s own help centre, its public GitHub release page and the network operators who traced the 2018 attack, each linked where it is used. Not against review sites, which in this corner of the internet tend to rate a wallet five stars without ever having lost the password to one.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-mew-crypto-and-who-actually-holds-the-keys\">What is MEW crypto, and who actually holds the keys?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MEW is the short name for MyEtherWallet, a free, open source tool for Ethereum and the tokens that run on it, commonly dated to 2015. The important word is tool. MEW is not a bank and not an exchange. When you open a wallet through it, the keys either live in a device or app you control, or you type them into the page. MEW&#8217;s own servers never keep them. That makes it a genuine <a href=\"https:\/\/getbitcoin.guide\/articles\/non-custodial-crypto-wallet\/\">non custodial wallet<\/a>, with the usual bargain: nobody can freeze your coins, and nobody can give them back.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That design has a sharp side effect. If the real MEW is just a web page that asks for your key, then a fake web page that asks for your key looks identical. Every major incident in MEW&#8217;s history follows from that one fact, which is why its history is worth reading even if you have never used it. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/multi-currency-wallet\/\">guide to multi currency wallets<\/a> covers where MEW sits beside apps that hold many chains at once.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Today MEW comes in several shapes, listed in its <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5377855-how-to-access-your-wallet-with-mew-portfolio\" target=\"_blank\" rel=\"noopener\">help article on accessing a wallet<\/a>: the website, which its help centre now calls MEW Portfolio; a browser extension called Enkrypt; the MEW mobile app; and connections to hardware wallets such as Ledger and Trezor. The same help centre notes that some older hardware guides, KeepKey among them, no longer apply to the current site.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-happened-when-myetherwallet-was-hijacked-in-2018\">What happened when MyEtherWallet was hijacked in 2018?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On 24 April 2018 nobody broke into MEW. They broke into the internet&#8217;s directions instead. <a href=\"https:\/\/blog.cloudflare.com\/bgp-leaks-and-crypto-currencies\/\" target=\"_blank\" rel=\"noopener\">Cloudflare&#8217;s write up of the attack<\/a> says that between about 11:05 and 12:55 UTC, a network numbered AS10297 announced routes for part of the address space used by Amazon&#8217;s Route 53, the DNS service that told browsers where myetherwallet.com lived. Traffic that should have reached Amazon went to a rogue DNS server, which answered queries for MEW with addresses belonging to a Russian provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Visitors who landed there saw a copy of MEW served with a certificate their browser did not trust. Anyone who clicked through the warning and unlocked a wallet handed the key to the copy. MEW&#8217;s own statement at the time, reported by <a href=\"https:\/\/www.theregister.com\/2018\/04\/24\/myetherwallet_dns_hijack\/\" target=\"_blank\" rel=\"noopener\">The Register on 24 April 2018<\/a>, was that a couple of DNS servers had been hijacked to send users to a phishing site, and that the fault was not on MEW&#8217;s side. Losses were reported at the time at around 216 ether, then roughly $150,000.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The lesson has aged well. The browser warning was the only visible clue, and it worked for anyone who stopped. No password, no two factor code and no clever bookmark would have helped someone who pasted a private key into the page, because the page was the attacker.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-did-copies-of-mew-keep-stealing-after-the-hijack\">How did copies of MEW keep stealing after the hijack?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The hijack was the loud one. The quiet ones lasted longer. In May 2018 the threat intelligence firm <a href=\"https:\/\/www.scmagazine.com\/news\/mewkit-phishing-campaign-steals-myetherwallet-credentials-to-perform-automated-fund-transfers\" target=\"_blank\" rel=\"noopener\">RiskIQ, as reported by SC Media<\/a>, profiled a phishing kit it named MEWKit: an unofficial copy of MEW&#8217;s code with two extra scripts that waited for a victim to unlock a wallet and then sent the funds out automatically. RiskIQ linked the servers in the April hijack to the same kit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two months later the problem arrived through a browser add on. On 9 July 2018 MEW warned that the Hola VPN extension for Chrome had been compromised for about five hours, according to <a href=\"https:\/\/techcrunch.com\/2018\/07\/09\/myetherwallet-hit-by-attack-hola\/\" target=\"_blank\" rel=\"noopener\">TechCrunch&#8217;s report that day<\/a>. MEW said its own site was not breached, and advised anyone who had used MEW with the extension running in the previous day to move their funds to a new wallet.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Date<\/th><th>What happened<\/th><th>Was MEW itself breached?<\/th><th>Where the key was lost<\/th><th>Source<\/th><\/tr><\/thead><tbody><tr><td>24 Apr 2018<\/td><td>Route 53 traffic hijacked, fake MEW served<\/td><td>No, the routing was<\/td><td>Typed into a copy of the site<\/td><td><a href=\"https:\/\/blog.cloudflare.com\/bgp-leaks-and-crypto-currencies\/\" target=\"_blank\" rel=\"noopener\">Cloudflare<\/a><\/td><\/tr><tr><td>May 2018<\/td><td>MEWKit phishing kit profiled<\/td><td>No, a copy of its code was used<\/td><td>Typed into a copy of the site<\/td><td><a href=\"https:\/\/www.scmagazine.com\/news\/mewkit-phishing-campaign-steals-myetherwallet-credentials-to-perform-automated-fund-transfers\" target=\"_blank\" rel=\"noopener\">RiskIQ via SC Media<\/a><\/td><\/tr><tr><td>9 Jul 2018<\/td><td>Hola VPN extension compromised for about five hours<\/td><td>No, the extension was<\/td><td>Read from the browser<\/td><td><a href=\"https:\/\/techcrunch.com\/2018\/07\/09\/myetherwallet-hit-by-attack-hola\/\" target=\"_blank\" rel=\"noopener\">TechCrunch<\/a><\/td><\/tr><tr><td>Jan 2026<\/td><td>Malicious Firefox add on faked a drain<\/td><td>No, the computer was<\/td><td>Funds intact once found<\/td><td><a href=\"https:\/\/www.reddit.com\/r\/ethereum\/comments\/1qbg5s3\/i_believe_a_malicious_actor_tried_to_exploit_me\/\" target=\"_blank\" rel=\"noopener\">r\/ethereum<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Read down the fourth column. Not one of these needed MEW&#8217;s servers. Each one needed the key to pass through a browser that someone else had a hand in.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart.png\" alt=\"Timeline of mew crypto security incidents from 2015 to the October 2026 offline release.\" class=\"wp-image-868\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart.png 1600w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart-300x169.png 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart-1024x576.png 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart-768x432.png 768w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/mew-crypto-chart-1536x864.png 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><figcaption class=\"wp-block-image__caption\">Dates from Cloudflare, SC Media, TechCrunch and MEW&#8217;s GitHub release page, checked on 4 November 2026.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-ways-into-mew-does-mew-itself-call-not-recommended\">Which ways into MEW does MEW itself call not recommended?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MEW is unusually blunt about this, which is to its credit. Its help article <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5377921-mew-says-not-recommended-when-i-access-my-wallet-why\" target=\"_blank\" rel=\"noopener\">explaining the not recommended label<\/a> says the three software methods, a private key, a keystore file and a mnemonic phrase, all lead back to one underlying key, and that whoever gets that key in any of those forms gets full, permanent control of the wallet. It also warns that keystore passwords can be brute forced relatively easily. Its <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5377855-how-to-access-your-wallet-with-mew-portfolio\" target=\"_blank\" rel=\"noopener\">access guide<\/a> recommends these methods only with MEW offline.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Way in<\/th><th>Where the key lives<\/th><th>MEW&#8217;s label<\/th><\/tr><\/thead><tbody><tr><td>Enkrypt browser extension<\/td><td>Inside the extension, behind its password<\/td><td>Offered on the connect screen<\/td><\/tr><tr><td>MEW mobile app, by QR code<\/td><td>On the phone<\/td><td>Offered on the connect screen<\/td><\/tr><tr><td>Hardware wallet (Ledger, Trezor)<\/td><td>On the device; you confirm there<\/td><td>Offered on the connect screen<\/td><\/tr><tr><td>Private key typed into the site<\/td><td>In the browser tab<\/td><td>Not recommended online<\/td><\/tr><tr><td>Keystore file plus password<\/td><td>In the browser tab<\/td><td>Not recommended online<\/td><\/tr><tr><td>Mnemonic phrase typed into the site<\/td><td>In the browser tab<\/td><td>Not recommended online<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the dated check that no review site carries. MEW&#8217;s <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/6512619-using-mew-offline\" target=\"_blank\" rel=\"noopener\">Using MEW Offline<\/a> article says the latest versions are version 7, which lack the offline feature, so the last version 6 build is the one that has it. On 4 November 2026 MEW&#8217;s <a href=\"https:\/\/github.com\/MyEtherWallet\/MyEtherWallet\/releases\" target=\"_blank\" rel=\"noopener\">GitHub release page<\/a> showed <a href=\"https:\/\/github.com\/MyEtherWallet\/MyEtherWallet\/releases\/tag\/v7.8.0\" target=\"_blank\" rel=\"noopener\">v7.8.0, released on 29 October 2026<\/a>, as the newest build, and <a href=\"https:\/\/github.com\/MyEtherWallet\/MyEtherWallet\/releases\/tag\/v6.9.28\" target=\"_blank\" rel=\"noopener\">v6.9.28, released on 16 October 2026<\/a>, still shipping a separate Offline package with a signature file and a SHA256 checksum. So the offline route is maintained, not abandoned, and it lives on the older line.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MEW&#8217;s <a href=\"https:\/\/help.myetherwallet.com\/en\/articles\/5974280-finding-your-private-key-on-mew-web\" target=\"_blank\" rel=\"noopener\">private key article<\/a> adds one more fact worth knowing: a private key can be worked out from a recovery phrase, but not the other way round. The phrase is the master. That is the same rule our <a href=\"https:\/\/getbitcoin.guide\/articles\/your-recovery-phrase\/\">recovery phrase guide<\/a> builds everything else on.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/home-safe-for-mew-crypto-backups.jpg\" alt=\"A small steel home safe and a sealed envelope on a desk, where offline mew crypto backups belong.\" class=\"wp-image-864\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/home-safe-for-mew-crypto-backups.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/home-safe-for-mew-crypto-backups-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/home-safe-for-mew-crypto-backups-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/home-safe-for-mew-crypto-backups-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">MEW itself calls typing a key, keystore or phrase into its website not recommended.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-do-mew-users-who-thought-they-were-drained-report\">What do MEW users who thought they were drained report?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We read the <a href=\"https:\/\/www.trustpilot.com\/review\/myetherwallet.com\" target=\"_blank\" rel=\"noopener\">Trustpilot reviews of MyEtherWallet<\/a>, 12 of the 13 that page shows, averaging 1.9 stars, and two linked Reddit threads from January 2026 with about 25 comments between them. The Trustpilot set is mostly about support: slow replies, tokens that did not show in the wallet, and one review from February 2022 in which the company blamed a malicious contract for tokens that left an account. None described the 2018 hijack. What follows is what people report, not proof of what happened to them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The clearest account is a single story told twice. In <a href=\"https:\/\/www.reddit.com\/r\/MyEtherWallet\/comments\/1qbaueu\/wallet_hacked_lost_all_my_ethereum\/\" target=\"_blank\" rel=\"noopener\">r\/MyEtherWallet on 12 January 2026<\/a>, a user who opened their wallet with a keystore file posted a block explorer screenshot showing their ether gone. Within a day, in <a href=\"https:\/\/www.reddit.com\/r\/ethereum\/comments\/1qbg5s3\/i_believe_a_malicious_actor_tried_to_exploit_me\/\" target=\"_blank\" rel=\"noopener\">a follow up in r\/ethereum<\/a>, they described how a recruiter on LinkedIn had asked them to install software for a crypto job a month earlier. The outgoing transaction appeared only in their main Firefox session, vanished in a private window and in other browsers, and a commenter who checked the address found no such transaction on chain. Removing a Firefox add on that was reading data for MEW and the block explorer made the fake drain disappear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The user read it as an attempt to make them panic and rush into unlocking the wallet, which is how the key would actually have been taken. A member of the MEW team replied in the first thread that the computer may still be compromised, that a new wallet was the safer course, and that MEW&#8217;s own warnings say using a keystore or private key directly is not best practice. A third commenter recommended reformatting the machine and moving funds only from a clean one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One more pattern from the same thread: weeks later, an unrelated account replied praising a recovery service reached through Instagram. Nothing on Ethereum can reverse a confirmed transaction, so a stranger offering to recover funds is offering something the network does not allow. Where these accounts agree with MEW&#8217;s guidance is the core of it: the danger was in the browser, not on MEW&#8217;s servers. Where they go further is in showing that the attack can be a fake loss designed to make you type the key in a hurry.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-you-reach-the-real-mew-without-handing-over-a-key\">How do you reach the real MEW without handing over a key?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Type the address yourself, or use a bookmark you saved the first time, and never arrive from a search advert or a link in a message. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/trezor-official-website\/\">guide to finding the official Trezor site<\/a> walks through the same habit for another brand; the method transfers unchanged.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/scanning-qr-code-to-access-mew-crypto-securely.jpg\" alt=\"A man securely connects to mew crypto by scanning a QR code with his mobile phone.\" class=\"wp-image-865\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/scanning-qr-code-to-access-mew-crypto-securely.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/scanning-qr-code-to-access-mew-crypto-securely-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/scanning-qr-code-to-access-mew-crypto-securely-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/11\/scanning-qr-code-to-access-mew-crypto-securely-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Mobile connections keep your private keys isolated from web browsers.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">After that, the best protection is not to need the page to see your key at all. A hardware wallet connection or the MEW mobile app keeps the key off the website, which is the whole point of the methods MEW offers first. If you hold an old keystore file or a phrase from years ago, MEW&#8217;s own advice is to move to a wallet created by one of those methods. Never paste a private key or a recovery phrase into any web page, form, chat or support ticket, including one that looks exactly like MEW.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you once made a <a href=\"https:\/\/getbitcoin.guide\/articles\/crypto-paper-wallet\/\">paper wallet<\/a> on the old MEW site, the printout is a private key, and the same rules apply to it. The same goes for any other app that asks for your words: our <a href=\"https:\/\/getbitcoin.guide\/articles\/metamask-seed-phrase\/\">MetaMask seed phrase guide<\/a> covers the fake support messages that ask for them.<\/p>\n\n\n\n<div class=\"msq-tool msq-check\" data-id=\"mew-real-site\" data-verb=\" checked\">\n<h3>Before you open MEW: real site, no key on the page<\/h3>\n<p>Tick each step. Nothing here asks for your private key or recovery phrase, and nothing ever should.<\/p>\n<label><input type=\"checkbox\">I typed the address myself or used a bookmark I saved earlier, not an advert or a message link<\/label>\n<label><input type=\"checkbox\">The browser showed no certificate warning, and I would close the tab if it did<\/label>\n<label><input type=\"checkbox\">I am connecting with a hardware wallet, Enkrypt or the MEW mobile app, not by typing a key<\/label>\n<label><input type=\"checkbox\">I have not pasted a private key, keystore password or phrase into any web page, chat or ticket<\/label>\n<label><input type=\"checkbox\">I removed browser add ons I do not recognise before opening a wallet<\/label>\n<label><input type=\"checkbox\">If a scary transaction appears, I will check the address on a second device before doing anything<\/label>\n<p class=\"msq-check-count\"><\/p>\n<p class=\"msq-note\">MEW never holds your keys, so no genuine MEW support agent needs them. Anyone who asks for your phrase or private key is trying to take the coins.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is MEW the same as MyEtherWallet?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. MEW is the short name MyEtherWallet uses for itself, and its help centre now calls the website MEW Portfolio. Enkrypt is MEW&#8217;s browser extension and the MEW mobile app is its phone wallet.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can MEW support recover my wallet if I lose my phrase or keystore password?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. MEW never holds your keys, so it has nothing to recover them from. A keystore file without its password, or a lost phrase, cannot be reset by MEW or anyone else.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Was MEW hacked in 2018?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>MEW&#8217;s servers were not. Internet routing to Amazon&#8217;s DNS service was hijacked on 24 April 2018, so some visitors were sent to a fake copy of the site, which stole the keys they typed into it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is it safe to unlock MEW with a keystore file?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>MEW itself labels keystore, private key and phrase access as not recommended online, because anyone who gets the file and password controls the wallet. It suggests those methods only with MEW offline.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does MEW still have an offline version?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, on the version 6 line. On 4 November 2026 the v6.9.28 release on MEW&#8217;s GitHub page, dated 16 October 2026, still carried an Offline package with a signature file. Version 7 does not include it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Someone says they can recover ether stolen from my MEW wallet for a fee. Is that possible?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A confirmed Ethereum transaction cannot be reversed, by MEW or anyone else. Treat any stranger offering recovery for a fee, or asking for your phrase or key to do it, as someone trying to take more.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"msq-end\" id=\"ms-quiz-end\">\n<p><strong>Finished the page?<\/strong> The same five questions from the top, to see what stuck.<\/p>\n<button type=\"button\" class=\"msq-btn msq-start-test\">Test Your Understanding of This Article<\/button>\n<div class=\"msq-mount\"><\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article is general information about wallet security and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything, or to use or avoid any service. Speak to a suitably qualified professional about your own situation, and remember that in self custody the security decisions are yours alone.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>MEW crypto usually means MyEtherWallet, a free interface for Ethereum that never holds your keys, which is exactly why fake copies of it work so well. In 2018 attackers hijacked its traffic for just under two hours. Today MEW&#8217;s own help pages call typing a private key, keystore file or phrase into its website not recommended.<\/p>\n","protected":false},"author":1,"featured_media":863,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"MEW Crypto Wallet: What the Old Phishing Attacks Still Teach","rank_math_description":"MEW crypto is MyEtherWallet, an interface where you hold the keys. What its 2018 hijack taught, and which access methods MEW itself calls risky.","rank_math_focus_keyword":"mew crypto","rank_math_canonical_url":"","rank_math_breadcrumb_title":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"","rank_math_pillar_content":"","rank_math_robots":[],"rank_math_advanced_robots":[]},"categories":[2],"tags":[],"class_list":["post-866","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallets"],"_links":{"self":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/comments?post=866"}],"version-history":[{"count":4,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/866\/revisions"}],"predecessor-version":[{"id":872,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/866\/revisions\/872"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media\/863"}],"wp:attachment":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media?parent=866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/categories?post=866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/tags?post=866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}