In a lengthy text published this Tuesday (8), a group of developers warns of a major security flaw found in Bitcoin wallets since 2014. Basically, the generation of wallets has low entropy, allowing access to funds by the 3rd.
called from ‘bx seed’is the generation method so famous that it was already presented in the book Mastering Bitcoin, which is considered the second most important document on the cryptocurrency, behind only the white paper written by Satoshi Nakamoto himself.
Furthermore, the developers point out that the flaw also affects wallets of other cryptocurrencies, including giants like Ethereum.
“Victims discovered that their Bitcoin (BTC) investments were not the only ones stolen. The attackers also extracted Ethereum and other cryptocurrencies from the same wallets.”
The attack is also related to a Trust Wallet vulnerability that was revealed in April this year. US$170,000 (R$830,000) was stolen on that date, but the amount may be greater. According to new data, the thefts are around $900,000 (R$4.4 million) and may continue.
Also in April of that year, the live coins reported that several veteran cryptocurrency users had their money stolen. At the time, a developer claimed that the only link between the thefts was the date the wallets were generated, between 2014 and 2022, which fits this pattern. More than 5,000 ETH was stolen, equivalent to BRL 45.6 million today.
Bitcoin Wallet Vulnerability Report Hastily Released
The main reason for the fuss is that the attacks are already underway. That is why the team has chosen not to collaborate with other developers, but to immediately disclose the vulnerability of the wallets. Although the information also reached the hackers, many of them were already aware of the flaw.
“If we want to give affected users a chance to recover their money, we should publish in days, not months. In that situation, time is on the side of the attackers and not on the side of the victims.”
According to the team, there were reports of thefts of Bitcoin (BTC), Ethereum (ETH), Ripple (XRP), Dogecoin (DOGE), Solana (SOL), Litecoin (LTC), Bitcoin Cash (BCH) even before publication. ) and Zcash (ZEC). “Probably many more types of coins are involved”add the text.
Milk Sad: Bitcoin wallet flaw worries community
Basically, the developers point out that the flaw is related to a low level of entropy in a well-known and old method of generating Bitcoin wallets. That is, a second person could easily get the same private key or seed phrase, since the randomness in generating it was almost zero.
“An essential tool involved in the creation of the wallet in both cases was the Libbitcoin Explorer in version 3.x, via its ‘bx’ binary”said the team. “The Libbitcoin project has been around for a long time (2011!), it’s open source and ‘bx’ has everything it takes to generate an offline wallet in a self-contained binary.”
The name of the vulnerability, milk sad, was chosen precisely for that reason. When creating two wallets in two different environments, the team found the same seed phrase, starting with the words “milk sad pay cup… ‘, even at 24 words, the set was the same and offered no security.
“In terms of securing a cryptocurrency wallet, this is a pretty catastrophic situation.”
After this, the text references a thread on Reddit. Dated July 24, a user points to a “massive theft of over 1,000 bitcoin wallets”. In a lengthy explanation, the victim says that he had best security practices, that is, he made no mistakes.
“The fact that this revocation affected more than 1,200 addresses in a single transaction led me to believe that this was some kind of planned event, which could be the result of a vulnerability in a library, or even a backdoor opened by an attacker. was used. carry out this theft.”
The developers claim that the user above was one of the victims of Milk Sad, just like everyone else.
They go further and also report that they disclosed their findings with the FBI prior to the release of the report. One of the reasons would be the possible cooperation by exchanges that could monitor the transaction flow of vulnerable addresses and then freeze balances.
The size of the error
While they have not released any numbers, the team points out that at least 2,600 Bitcoin addresses have been released. In addition, other wallets that used this method of generating addresses were also affected.
Another point noted is that many people tend to import wallets from one software to another, even in different cryptocurrencies, which can significantly increase the number of victims and stolen funds.
According to the text, the bug could still be present in version 1.x, then called ‘sx’, released in 2014. Same with version 2.0.0 through 2.1.0 (2014 – 2015). However, the vulnerability was only confirmed in versions 3.0.0 through 3.6.0, available since 2017.
“For most of our brief and frenetic disclosure, we’ve focused on Mersenne Twister-related issues in bx versions released after March 2017.”
When contacting the libbitcoin on several occasions, prior to the reveal, the team is said to have replied only (twice) that they did not believe the discovery was a bug.
How do you know if your bitcoins and other cryptocurrencies are at risk?
This portfolio generation method is famous and has already been presented in the book control Bitcoin, written by Andreas Antonopoulos. Therefore, it may have been used by many people, especially big fans of technology and Bitcoin.
“Neither Chapter 4 nor the appendix contain the disclaimer that ‘bx seed’ does not produce safe random numbers. The examples do not warn the user that wallets created in this way are insecure.”
Anyway, the developers point out that affected users are the ones who “wallets created with bx 3.0.0 or later (after about March 2017)” or “with a CLI tool and can’t remember which tool”.
The full text, with more technical information, can be found on the website created by the team that discovered the bug. A total of 13 people are mentioned as employees in the work.
Source: Live Coins
Barry Siefert is an accomplished journalist and author at The Nation View. He is known for his expertise in the field of cryptocurrency, and has written extensively on the topic. With a background in finance and economics, Barry has a deep understanding of the underlying technology and market forces that drive the crypto industry.
