The news began to circulate with a post on reddit published a few hours ago by monero's core team; according to what is learned the download on the official website has been compromised and the users who download it seriously risk to see their coins stolen. Confirmation also came via GitHub, where a user named Serhack confirmed that the server was compromised and that the distributed software is malicious and stated that:

"I can confirm that the malicious track is stealing coins. About 9 hours after running the track, a single transaction emptied the wallet. I downloaded the build yesterday around 6:00 pm Pacific Time

The anomaly emerged comparing the hash code of the downloaded file and comparing it with the one expected, the mismatch between the two codes confirms that the downloaded file is different from the one expected and that therefore the version distributed by the server has a malicious nature. Through Reddit users confirm that the flaw has been corrected and that the malicious software has been distributed for about 35 minutes, however users who have downloaded it in the last 24 hours are invited to check the hash of the downloaded file and in case of mismatch. it is essential not to perform the download and remove it from the machine. Although the malicious version of the program has been distributed for just half an hour, the fact is still quite serious, however it also shows how fast and efficient the community has become in finding this kind of anomalies and in warning less knowledgeable users, who usually do not perform compliance check on hash codes. For now there are no further news on the incident and it is not possible to verify whether the malicious code actually did damage or possibly the amount of damage generated; we will be able to return to the topic in the coming days if new information emerges.