Ancient Bug Discovered by Unciphered
An old cryptocurrency wallet bug has been discovered by Unciphered, a crypto cybersecurity firm. This bug affects browser-based wallets that were generated between 2011 and 2015. The bug could potentially allow malicious actors to steal up to $2.1 billion from wallets on various networks, including Bitcoin (BTC), Dogecoin (DOGE), Litecoin (LTC), and Zcash (ZEC).
Discovering An Ancient Bug
During an interview with the Wall Street Journal, the Unciphered team revealed that they stumbled upon the bug while attempting to recover a lost Bitcoin investment for entrepreneur Nick Sullivan. Sullivan had created his Bitcoin wallet in 2014 using Blockchain.info, and later lost access after wiping his computer’s memory without saving his private key.
Unciphered discovered that the code for creating random wallet keys – BitcoinJS – did not make all the wallets random enough, potentially leaving many users exposed to vulnerabilities.
It was found that wallets created between 2011 and 2015 contain billions of dollars in assets, which could potentially be vulnerable to hacking.
Cryptographers discovered flaws in wallet generation randomness back in 2014 and have since improved their methods. Unciphered claims that no wallets generated after 2016 were found to suffer from weak randomness.
How to Tell Victims?
Unciphered has been quietly warning affected users for months, but has recently made the vulnerability public. The challenge was convincing millions of victims to move their funds without revealing the vulnerability to potential thieves.
Blockchain.com, the site Sullivan used to create his wallet, sent out emails to over 1.1 million affected wallets, and found a way to update the wallets of anyone who visited its site automatically.
However, many affected users still haven’t been directly warned since the sites they used to create their wallets are no longer in operation.
Hot Take
It is crucial to be aware of potential vulnerabilities in cryptocurrency wallets, especially if they were created between 2011 and 2015. Stay vigilant and take appropriate action if you believe your wallet may be affected by this decade-old bug.
By
By
By
By
