Ethereum

Bitcoin Cash

Bitcoin

Zcash

Read

A vulnerability in the Libbitcoin Explorer 3.x library has led to the theft of over $900,000 from Bitcoin users. 
Blockchain security firm SlowMist reported the issue. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 🚨SlowMist Security Alert🚨 Recently, <a href="https://twitter.com/hashtag/Distrust?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#Distrust</a> discovered a severe vulnerability affecting cryptocurrency wallets using the <a href="https://twitter.com/hashtag/Libbitcoin?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#Libbitcoin</a> Explorer 3.x versions. This vulnerability allows attackers to access wallet private keys by exploiting the Mersenne Twister pseudo-random…— SlowMist (@SlowMist_Team) <a href="https://twitter.com/SlowMist_Team/status/1689593659606630400?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">August 10, 2023</a> 
 </blockquote> 
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div> 
</figure> 
It could also affect users of other digital currencies like Ethereum (<a href="https://crypto.news/price/ethereum/" data-type="link" data-id="https://crypto.news/price/ethereum/" rel="noopener noreferrer nofollow">ETH</a>), Ripple (<a href="https://crypto.news/price/xrp/" data-type="link" data-id="https://crypto.news/price/xrp/" rel="noopener noreferrer nofollow">XRP</a>), Dogecoin (<a href="https://crypto.news/price/dogecoin/" rel="noopener noreferrer nofollow">DOGE</a>), Solana (<a href="https://crypto.news/price/solana/" data-type="link" data-id="https://crypto.news/price/solana/" rel="noopener noreferrer nofollow">SOL</a>), Litecoin (<a href="https://crypto.news/price/litecoin/" data-type="link" data-id="https://crypto.news/price/litecoin/" rel="noopener noreferrer nofollow">LTC</a>), Bitcoin Cash (<a href="https://crypto.news/price/bitcoin-cash/" data-type="link" data-id="https://crypto.news/price/bitcoin-cash/" rel="noopener noreferrer nofollow">BCH</a>), and Zcash that employ Libbitcoin to create accounts. 
Libbitcoin is a Bitcoin wallet implementation used by various applications, including Airbitz, Bitprim, Blockchain Commons, and Cancoin. SlowMist did not specify which applications are affected by the vulnerability. 
The vulnerability, known as the “Milk Sad,” was first discovered by the cybersecurity team “Distrust” and <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39910" target="_blank" rel="noopener noreferrer nofollow">reported </a>to the CEV cybersecurity vulnerability database on Aug. 7. It involves a faulty key generation mechanism in the Libbitcoin Explorer, which allows attackers to guess private keys. 
 You might also like: <a href="https://crypto.news/an-8-year-vulnerability-affecting-bitcoin-signing-process-identified-over-900-addresses-affected/" rel="noopener noreferrer nofollow"> An 8-year vulnerability affecting Bitcoin signing process identified, over 900 addresses affected </a> 
The attackers exploited this vulnerability to steal over $900,000 worth of crypto, including a single attack that siphoned away over $278,318 
SlowMist claims to have “blocked” the address, implying that they have contacted exchanges to prevent the attacker from cashing out the funds. They will also be monitoring the address in case funds are moved elsewhere. 
The Distrust team and eight freelance security consultants have set up an informational website <a href="https://milksad.info/" target="_blank" rel="noopener noreferrer nofollow">explaining</a> the vulnerability. They have found that the vulnerability occurs when users generate a wallet seed using the “bx seed” command, which lacks sufficient randomness and can produce the same seed for multiple users. 
The vulnerability was discovered when a Libbitcoin user reported missing BTC on July 21. More digging showed that other users were having their Bitcoin stolen similarly. 
Eric Voskuil, a member of the Libbitcoin Institute, stated that the “bx seed” command is not intended for production wallets, and changes may be made to strengthen the warning against its use or remove the command altogether. 
Wallet vulnerabilities remain a problem for crypto users in 2023, with over $100 million lost in a hack of the Atomic Wallet in June. <a href="https://cer.live/post/crypto-wallet-security-rating-report-key-insights-findings" target="_blank" rel="noopener noreferrer nofollow">According </a>to the wallet security rankings released by CER in July, nly six out of 45 wallet brands employ penetration testing to discover vulnerabilities. 
 Read more: <a href="https://crypto.news/atomic-wallets-hack-statement-raises-user-concerns-amid-100m-losses/" rel="noopener noreferrer nofollow"> Atomic Wallet’s hack statement raises user concerns amid $100m losses </a>

Libbitcoin vulnerability leads to $900k theft from Bitcoin wallets

crypto.news

Other articles published on Aug 11, 2023

Shytoshi Kusama Clarifies His Jab at Elon Musk's X, Here's Why He Did It

Glassnode Co-Founders Predict Bitcoin’s Next Rise Trigger

Daily Active Users On Coinbase’s Layer 2 Network Base Tops 100,000

CRV Whales Take Advantage of the Price Drop to Accumulate

Blockchain Event onXDC Live Debuts in Austin, Texas on August 25-26

Alchemy Pay Joins Hands with YouSUI: A New Era of Fiat-Crypto Conversions

Join our free newsletter for daily crypto updates!