Hackers Expose Code Of El Salvador’s Bitcoin Wallet App Chivo

Hackers exposed more information about El Salvador’s state-run Bitcoin wallet, Chivo, on April 23 after publicly leaking the personal data of its millions of users earlier this month.

Hacker group CiberInteligenciaSV released part of the software wallet’s source code on BreachForums – a black hat hacking forum.

El Salvador Hackers Strike Again

“This time I bring you the code that is inside the Bitcoin Chivo Wallet ATMs in El Salvador, remember that it is a government wallet, and as you know, we do not sell, we publish everything for free for you,” wrote the hacker group.

Cybersecurity project VenariX warned of an incoming Chivo source code data leak on Monday, citing a post from the hacker group’s Telegram channel.

El grupo #hacker #CiberInteligenciaElSalvador, anuncia en su cuenta de Telegram que publicará parte del código fuente y accesos VPN de #Chivo #Wallet (@chivowallet), la billetera oficial de #Bitcoin y #Dólar creada por el #Gobierno de #ElSalvador 🇸🇻 (@Gobierno_SV)… pic.twitter.com/AUG8PM1VN8

— VenariX en Español (@_venarixES_) April 22, 2024

“Tonight we will publish part of the source code and VPN access that belongs to Chivo Wallet, for free as always, unless one of you nosy government people wants to talk,” CiberInteligenciaSV’s Telegram post stated.

The same group released over 144 GB of data containing the personal information of 5.1 million Salvadorans who had downloaded the wallet. Though available for purchase through different channels since August, it was only leaked for download starting April 5.

The stolen information included each user’s full name, unique identifying number, date of birth, address, and an HD picture of their face.

This week’s leaked information also included the file Codigo.rar, which included code and VPN credentials on ElSalvador’s Chivo ATM network.

The nation’s government is yet to release an official statement regarding either of this month’s hacks.

El Salvador’s Wallet Rollout

El Salvador initially released Chivo in September 2021, alongside its official implementation of Bitcoin (BTC) as legal tender. The law meant that Bitcoin could be used as official currency – including for tax payments – alongside the US dollar, without realizing a capital gains tax when that Bitcoin is sold or traded.

Chivo’s rollout began with a rocky start as users reported many software bugs and technical glitches afflicting the software. Some failed to receive a free $30 for downloading the wallet that the President promised them, while others had trouble withdrawing their money from Chivo ATMs.

Late last year, the Salvadoran government revealed that it was installing lightning network technology at over 100 Chivo ATMs across the country, to be installed in Q4 2024. The technology can theoretically allow Salvadorans to cash in and out of Bitcoin faster and with lower fees.

A Salvadoran newspaper reported in October that less than 2% of the population was actually using the wallet for remittance payments, which was supposed to be one of its primary selling points.