Read

<div class="sg-post-des">
 Fireblocks said the vulnerabilities affecting Coinbase, Binance, and Zengo have since been fixed and has reached out to more than 12 others still at risk. 
</div> 
<div class="cointelegraph"> 
 Over 15 widely-used crypto wallet providers and projects have gaping vulnerabilities that could potentially see millions of crypto wallets drained, according to digital asset infrastructure firm Fireblocks. 
 In an Aug. 9 press release, Fireblocks said the series of vulnerabilities, dubbed BitForge, are <a rel="noopener noreferrer nofollow" title="affecting" href="https://thebittimes.com/tag/affecting.html">affecting</a> <a rel="noopener noreferrer nofollow" title="wallets" href="https://thebittimes.com/tag/wallets.html">wallets</a> using multi-party computation (MPC) technology, which allows for multiple parties to control and manage <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a>currency holdings. 
 <blockquote class="twitter-tweet"> 
 1/ The Fireblocks research team has uncovered BitForge, a set of vulnerabilities in some of the most widely adopted MPC protocols, that allow an attacker to retrieve a private key from a single device. Read on → https://t.co/xo2r9zgCvj pic.twitter.com/7q1nEeVBwO— Fireblocks (@FireblocksHQ) August 9, 2023 
 </blockquote> 
 The identified issues were disclosed as “zero day” vulnerabilities — meaning that the flaws had not previously been identified by the projects. 
 <blockquote>
 “If left unremediated, the exposures would allow attackers and malicious insiders to drain funds from the wallets of millions of retail and institutional customers in seconds, with no knowledge to the user or vendor.” 
 </blockquote> 
 The firm disclosed that the BitForge vulnerabilities affected many of the top wallet providers, including Coinbase, Zengo and Binance. Following an industry-standard “90 day disclosure period” from Fireblocks, the three firms have since resolved the identified issues. 
 In a statement, Coinbase chief information security officer Jeff Lunglhofer thanked Fireblocks for identifying and responsibly disclosing the issue, adding that Coinbase customers and funds were never at risk. Zengo CTO Tal Be'ery noted that the issue was promptly fixed and no user funds were affected. 
 <blockquote class="twitter-tweet"> 
 3/ We want to extend our gratitude to the researchers at Fireblocks for identifying this issue, conducting an ethical disclosure, and helping to improve the security of the ecosystem.— Coinbase Cloud ️ (@CoinbaseCloud) August 9, 2023 
 </blockquote> 
 Fireblocks said it has worked to identify other firms that may be implicated in similar security concerns and have reached out to them. 
 MPC <a rel="noopener noreferrer nofollow" title="wallets" href="https://thebittimes.com/tag/wallets.html">wallets</a> encrypt a user’s private key and share it between several parties — typically comprised of the <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> owner, a <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> provider, and another third party. Theoretically, no one of these entities should be able to unlock the <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> without first communicating with the others. 
 Related: Tel Aviv Stock Exchange to offer <a rel="noopener noreferrer nofollow" title="crypto" href="https://thebittimes.com/tag/crypto.html">crypto</a> services via Fireblocks pact 
 However, according to Fireblocks’ technical reports on the BitForge vulnerabilities, the vulnerabilities would have allowed hackers to “extract the full private key if they were able to compromise only one device.” 
 “While we are encouraged to see that MPC is now ubiquitous within the digital asset industry, it is evident from our findings — and our subsequent disclosure process — that not all MPC developers and teams are created equal,” said Fireblocks CTO and co-founder Pavel Berengoltz. 
 “Companies leveraging Web3 technology should work closely with security experts with the know-how and resources to stay ahead of and mitigate vulnerabilities,” he added. 
 Deposit risk: What do crypto exchanges really do with your money? 
 <template data-name="subscription_form" data-type="crypto_biz"></template> 
</div>

Fireblocks discloses massive vulnerability affecting crypto wallets

TheBitTimes

Other articles published on Aug 10, 2023

$120M Crypto Ponzi Scheme Exposed in India

HODL Weekly Roundup (Jul 31 – Aug 6): Progress and Enhancements

Could the SEC ignite the Bitcoin Rally? Good and Bad News for BTC!

Binance Labs Invests $5M in CRV and Supports Curve Deployment to BNB Chain

Altcoin Price Analysis: Can DOGE Price Replicate Shiba Inu’s 20% Weekly Upswing?

Cardano Reaches Overbought Region And Challenges $0.30 High

Join our free newsletter for daily crypto updates!