Bitcoin Cash

Bitcoin

Zcash

Security

Read

<div class="cryptonews"> 
 <p class="is-style-lead">A vulnerability in the Libbitcoin Explorer 3.x library has led to the theft of over $900,000 from Bitcoin users.</p> 
 <p>Blockchain security firm SlowMist reported the issue.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"> 
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
    <p lang="en" dir="ltr">SlowMist Security Alert<br><br>Recently, #Distrust discovered a severe <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> affecting cryptocurrency <a rel="noopener noreferrer nofollow" title="wallets" href="https://thebittimes.com/tag/wallets.html">wallets</a> using the #Lib<a rel="noopener noreferrer nofollow" title="bitcoin" href="https://thebittimes.com/tag/bitcoin.html">bitcoin</a> Explorer 3.x versions. This <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> allows attackers to access <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> private keys by exploiting the Mersenne Twister pseudo-random…</p>— SlowMist (@SlowMist_Team) August 10, 2023 
   </blockquote> 
  </div> 
 </figure> 
 <p>It could also affect users of other digital currencies like Ethereum (ETH), Ripple (XRP), Dogecoin (DOGE), Solana (SOL), Litecoin (LTC), Bitcoin Cash (BCH), and Zcash that employ Libbitcoin to create accounts.</p> 
 <p>Libbitcoin is a Bitcoin wallet implementation used by various applications, including Airbitz, Bitprim, Blockchain Commons, and Cancoin. SlowMist did not specify which applications are affected by the vulnerability.</p> 
 <p>The vulnerability, known as the “Milk Sad,” was first discovered by the cybersecurity team “Distrust” and reported to the CEV cybersecurity vulnerability database on Aug. 7. It involves a faulty key generation mechanism in the Libbitcoin Explorer, which allows attackers to guess private keys.</p> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> An 8-year vulnerability affecting Bitcoin signing process identified, over 900 addresses affected 
 </div> 
 <p>The attackers exploited this <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> to steal over $900,000 worth of crypto, including a single attack that siphoned away over $278,318</p> 
 <p>SlowMist claims to have “blocked” the address, implying that they have contacted exchanges to prevent the attacker from cashing out the funds. They will also be monitoring the address in case funds are moved elsewhere.</p> 
 <p>The Distrust team and eight freelance security consultants have set up an informational website explaining the <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a>. They have found that the <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> occurs when users generate a <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> seed using the “bx seed” command, which lacks sufficient randomness and can produce the same seed for multiple users.</p> 
 <p>The vulnerability was discovered when a Libbitcoin user reported missing BTC on July 21. More digging showed that other users were having their Bitcoin stolen similarly.</p> 
 <p>Eric Voskuil, a member of the Libbitcoin Institute, stated that the “bx seed” command is not intended for production wallets, and changes may be made to strengthen the warning against its use or remove the command altogether.</p> 
 <p>Wallet vulnerabilities remain a problem for crypto users in 2023, with over $100 million lost in a hack of the Atomic Wallet in June. According to the wallet security rankings released by CER in July, nly six out of 45 wallet brands employ penetration testing to discover vulnerabilities.</p> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> Atomic Wallet’s hack statement raises user concerns amid $100m losses 
 </div> <span class="google-news-banner__label">Follow Us on Google News</span> 
</div>

Libbitcoin vulnerability leads to $900k theft from Bitcoin wallets

TheBitTimes

Other articles published on Aug 11, 2023

Keurig Dr. Pepper Stock Price Prediction: Will KDP Break 200 SMA?

Binance Seeks Regulatory Approval in Taiwan

Ripple CTO Reacts to New Fed Requirements for PayPal Stablecoin PYUSD

SEC Delays Ark Invest Spot Bitcoin ETF Application

Ethereum Statement from Payment Giant Visa!

Gemini Cofounder Slams Gary Gensler Over XRP Lawsuit

Join our free newsletter for daily crypto updates!