Several months ago I downloaded the mysterium dVPN app for my machine and used it as a general purpose vpn. Mostly for getting around region locks on specific content for places like Netflix and YouTube. However, once I made the transition to finances being handled through the protocol, things took a bad turn.
I was the victim of a MITM attack sometime in early February, and as a result had around $5000 in XRP fraudulently transferred to the attackers address.
Throughout my process in seeking recourse/recovery of the assets I have reached out to the team multiple times only to be stone-walled and given the bog-standard customer service replies, with little to no help in retrieving data from that day or really anything that I could use in my investigating and reporting this theft to proper authorities.
What frustrates me the most is the fact that this MITM problem has been reported before on different subreddits, and the devs obviously haven’t fixed the problem within their protocol, otherwise this wouldn’t have happened. The accounts compromised were only the ones I used while connected to Mysterium. No words or phrases were used in either the username or the password so a dictionary attack is out of the question. The only weak link in my security practice was this network. I have contacted all other parties involved in this mess, and have narrowed it down to being Mysterium as the sole reason for someone having stolen $5000 from me. I will never be using this project ever again, and will be telling everyone I know to stay as far away from it.
To pass their service off as completely secure is an exaggeration at best, and a straight-up lie at worst.