A 'Blockchain Bandit' Is Guessing Private Keys and Scoring Millions (2024)

Last summer, Adrian Bednarek was mulling over ways to steal the cryptocurrency Ethereum. He's a security consultant; at the time, he was working for a client in the theft-plagued cryptocurrency industry. Bednarek had been drawn to Ethereum, in particular, because of its notorious complexity and the potential security vulnerabilities those moving parts might create. But he started instead with the simplest of questions: What if an Ethereum owner stored their digital money with a private key—the unguessable, 78-digit string of numbers that protects the currency stashed at a certain address—that had a value of 1?

To Bednarek's surprise, he found that dead-simple key had in fact once held currency, according to the blockchain that records all Ethereum transactions. But the cash had already been taken out of the Ethereum wallet that used it—almost certainly by a thief who had thought to guess a private key of 1 long before Bednarek had. After all, as with Bitcoin and other cryptocurrencies, if anyone knows an Ethereum private key, they can use it to derive the associated public address that the key unlocks. The private key then allows them to transfer the money at that address as though they were its rightful owner.

That initial discovery piqued Bednarek's curiosity. So he tried a few more consecutive keys: 2, 3, 4, and then a couple dozen more, all of which had been similarly emptied. So he and his colleagues at the security consultancy Independent Security Evaluators wrote some code, fired up some cloud servers, and tried a few dozen billion more.

In the process, and as detailed in a paper they published Tuesday, the researchers not only found that cryptocurrency users have in the last few years stored their crypto treasure with hundreds of easily guessable private keys, but also uncovered what they call a "blockchain bandit." A single Ethereum account seems to have siphoned off a fortune of 45,000 ether—worth at one point more than $50 million—using those same key-guessing tricks.

"He was doing the same things we were doing, but he went above and beyond," Bednarek says. "Whoever this guy or these guys are, they're spending a lot of computing time sniffing for new wallets, watching every transaction, and seeing if they have the key to them."

Combing a Gazillion Beaches

To explain how that blockchain banditry works, it helps to understand that the the odds of guessing a randomly generated Ethereum private key is 1 in 115 quattuorvigintillion. (Or, as a fraction: 1/2256.) That denominator is very roughly around the number of atoms in the universe. Bednarek compares the task of identifying a random Ethereum key to choosing a grain of sand on a beach, and later asking a friend to find that same grain among a "billion gazillion" beaches.

But as he looked at the Ethereum blockchain, Bednarek could see evidence that some people had stored ether at vastly simpler, more easily guessable keys. The mistake was probably the result, he says, of Ethereum wallets that cut off keys at just a fraction of their intended length due to coding errors, or let inexperienced users choose their own keys, or even that included malicious code, corrupting the randomization process to make keys easy to guess for the wallet's developer.

Bednarek and his ISE colleagues eventually scanned 34 billion blockchain addresses for those sorts of weak keys. They called the process ethercombing, like beachcombing but for more guessable grains of sand among Ethereum's vast entropy. They ultimately found 732 guessable keys that at one point held ether but had since been emptied. Though some of those transfers were no doubt legitimate, Bednarek guesses that 732 is still only a small fraction of the total number of weak keys from which ether has been stolen since the currency launched in 2015.

A 'Blockchain Bandit' Is Guessing Private Keys and Scoring Millions (2024)

FAQs

What are the chances of guessing a private key? ›

Conversation. Odds of guessing a bank PIN: 1/10,000. Odds of guessing a bitcoin private key: 1/10,000,000,000,000,000,000,000,000,000,000,000,000.

Is it possible for someone to guess a private key to a Bitcoin wallet and steal the coins? ›

Because private keys are stored in application and device wallets, hackers can access them and steal your cryptocurrency.

Can hackers guess private keys? ›

Text prediction makes it easy for cybercriminals to attack you, and steal your crypto wallet. Predictive typing can guess your cryptocurrency wallet's private keys, making your phone prone to cyber-attacks.

What is the key role of private key in blockchain? ›

A private key is an extremely large number that is used in cryptography, similar to a password. Private keys are used to create digital signatures that can easily be verified, without revealing the private key. Private keys are also used in cryptocurrency transactions in order to show ownership of a blockchain address.

How many private keys does a wallet have? ›

In total, this means there are a total of (almost) 2^256 combinations of private keys. This number can also be expressed as 10^77 for simplicity. For rounding purposes these numbers are almost the same. Once again, it is fortunate that most wallets can generate you a list of private keys at the push of a button.

How do I claim unclaimed Bitcoins? ›

How Can I Recover Lost Bitcoin? There is no way to recover bitcoin that is truly lost. Some mistaken transactions have been refunded, but only when the counterparty personally knows the sender, which is infrequent. If a private key is lost, then bitcoin belonging to that key is unspendable.

Can you crack Bitcoin private key? ›

A Bitcoin private key is essentially just a 256-bit number, which can be represented as a 64-digit hexadecimal. So what do we find out if we enter such a number into the app to estimate password cracking times? Infiniti! So all we really find out is that a Bitcoin private key is almost impossible to brute force.

Can someone steal my Bitcoin if they have my wallet address? ›

It is not possible to steal digital currency with a public address alone. The only way someone could access your funds would be if they had access to your Coinbase account, or in the case of a non-hosted wallet, your private key.

Does every Bitcoin address have a private key? ›

Every Bitcoin wallet contains one or more private keys, which are saved in the wallet file. The private keys are mathematically related to all Bitcoin addresses generated for the wallet. Because the private key is the "ticket" that allows someone to spend bitcoins, it is important that these are kept secret and safe.

How do hackers get private key? ›

If the platform is hacked, your keys are at risk of being stolen through the internet. Clicking on a malicious link could provide the hacker with remote access to your device and extract things such as your private key or your seed phrase.

What happens if someone knows my private key? ›

By posting your private keys or recovery phrase, or giving it to someone else, you're handing them your wallet. They can then recover your wallet and send your funds or NFTs to themselves. There would be no way to reverse any of these transactions and you'd likely have no legal recourse available to you.

How long to crack a Bitcoin private key? ›

“Let's calculate how much time you need to crack one Bitcoin-address on your machine. You said that your performance is 9 million BTC-addresses per second, i.e. approximately 2^23 BTC-addresses per second. Thus the brute forcing will take 2^160-23 = 2^137seconds!

What is an example of a private key? ›

Public and private keys: an example

Bob wants to send Alice an encrypted email. To do this, Bob takes Alice's public key and encrypts his message to her. Then, when Alice receives the message, she takes the private key that is known only to her in order to decrypt the message from Bob.

How do I get my private key from Blockchain wallet? ›

To get the private keys for your main wallet addresses:

login to blockchain.info. Click Settings > Security > Backup Recovery Phrase > write down your phrase with exact order to import it later using Electrum wallet.

How is a blockchain private key generated? ›

Private and Public Keys

The private key (k) is a number, usually picked at random. From the private key, we use elliptic curve multiplication, a one-way cryptographic function, to generate a public key (K). From the public key (K), we use a one-way cryptographic hash function to generate a bitcoin address (A).

What does a BTC private key look like? ›

A private key is a secure code that enables the holder to make cryptocurrency transactions and prove ownership of their holdings. Bitcoin keys specifically feature a 256-bit string displayed as a combination of letters and numbers.

How do you lose your keys without losing your wallet? ›

Read on to find out how you can prevent a lost or stolen wallet!
  1. Always Place Your Wallet in the Same Place. ...
  2. Use a Purse or Satchel to Hold Your Wallet. ...
  3. Don't Put All of Your Valuable in the Same Place. ...
  4. Try Using a Wallet Tracker. ...
  5. Be Cautious in Crowds to Avoid a Stolen Wallet. ...
  6. Keep Your Wallet Safe and Secure.
Jun 8, 2021

Can you recover wallet with private key? ›

If the private key is ever lost or destroyed, the recovery phrase can regenerate the key, and restore the wallet on ANY device. It is strongly recommended to create physical copies of your private key and/or recovery phrase, and store them both in a secure location.

How do I recover my lost Bitcoin before the scammer gets away with it? ›

Here are the approaches you should pursue when trying to recover stolen Bitcoin.
  1. File a Police Report.
  2. Check Your Devices for Malware.
  3. Contact Your Bank, Exchange, and Wallet Provider.
  4. Change Your Login Details.
  5. Track the Money.
May 16, 2022

Can stolen crypto be recovered? ›

Once your virtual currency has been stolen it is incredibly unlikely that you will be able to recover it.

What happens if you don't report Bitcoin to IRS? ›

After an initial failure to file, the IRS will notify any taxpayer who hasn't completed their annual return or reports. If, after 90 days, you still haven't included your crypto gains on Form 8938, you could face a fine of up to $50,000.

How long would it take to guess a private key? ›

private key is a secret, alphanumeric password/number used to spend/send your bitcoins to another Bitcoin address. It is a 256-bitlong number that is picked randomly as soon as you make a wallet. So how long would these take to crack? The bad news is that a 4-digit PIN would take 5 milliseconds to crack.

Can you guess private key from public key? ›

It is a cryptographic algorithm that lets you send messages. In this algorithm, it is not possible to guess private key from the public key. Digital signatures are used to share a public key. The private key, on the other hand, is stored safely in the software using encryption.

Can private key be intercepted? ›

Data encrypted with a private key can only be decrypted with the matching public key and vice-versa. Looking at the protocol section of the TLS article on Wikipedia, the two ends carefully exchange just enough information during the protocol setup to lead to an encrypted connection.

Is a private key random? ›

A private key is typically a long, randomly or pseudo-randomly generated sequence of bits that cannot be easily guessed. The complexity and length of the private key determine how easily an attacker can execute a brute-force attack, where they try out different keys until the right one is found.

How long is a blockchain private key? ›

A private Bitcoin key is a 64-character string of letters and numbers.

Is it possible to hack Bitcoin private key? ›

The answer is no. Bitcoin is considered hack-proof and remains one of the most secure ways to store funds - as long as you are using a non-hosted/ non-custodial crypto wallet.

How long would it take to brute force a Bitcoin wallet? ›

You said that your performance is 9 million BTC-addresses per second, i.e. approximately 223 BTC-addresses per second. Thus the brute forcing will take 2160-23 = 2137seconds!

What can a hacker do with private key? ›

If the private key is stolen, a hacker can create a Man-In-the-Middle attack where data flowing either from the server-to-client or client-to-server is modified in-transit.

Top Articles
How to Invest Your Savings for Short-Term or Long-Term Goals - NerdWallet
Robinhood vs Acorns vs Webull: How to Choose a Microinvesting App
English Bulldog Puppies For Sale Under 1000 In Florida
Katie Pavlich Bikini Photos
Gamevault Agent
Pieology Nutrition Calculator Mobile
Hocus Pocus Showtimes Near Harkins Theatres Yuma Palms 14
Hendersonville (Tennessee) – Travel guide at Wikivoyage
Compare the Samsung Galaxy S24 - 256GB - Cobalt Violet vs Apple iPhone 16 Pro - 128GB - Desert Titanium | AT&T
Vardis Olive Garden (Georgioupolis, Kreta) ✈️ inkl. Flug buchen
Craigslist Dog Kennels For Sale
Things To Do In Atlanta Tomorrow Night
Non Sequitur
Crossword Nexus Solver
How To Cut Eelgrass Grounded
Pac Man Deviantart
Alexander Funeral Home Gallatin Obituaries
Energy Healing Conference Utah
Geometry Review Quiz 5 Answer Key
Hobby Stores Near Me Now
Icivics The Electoral Process Answer Key
Allybearloves
Bible Gateway passage: Revelation 3 - New Living Translation
Yisd Home Access Center
Home
Shadbase Get Out Of Jail
Gina Wilson Angle Addition Postulate
Celina Powell Lil Meech Video: A Controversial Encounter Shakes Social Media - Video Reddit Trend
Walmart Pharmacy Near Me Open
Marquette Gas Prices
A Christmas Horse - Alison Senxation
Ou Football Brainiacs
Access a Shared Resource | Computing for Arts + Sciences
Vera Bradley Factory Outlet Sunbury Products
Pixel Combat Unblocked
Movies - EPIC Theatres
Cvs Sport Physicals
Mercedes W204 Belt Diagram
Mia Malkova Bio, Net Worth, Age & More - Magzica
'Conan Exiles' 3.0 Guide: How To Unlock Spells And Sorcery
Teenbeautyfitness
Where Can I Cash A Huntington National Bank Check
Topos De Bolos Engraçados
Sand Castle Parents Guide
Gregory (Five Nights at Freddy's)
Grand Valley State University Library Hours
Holzer Athena Portal
Hello – Cornerstone Chapel
Stoughton Commuter Rail Schedule
Nfsd Web Portal
Selly Medaline
Latest Posts
Article information

Author: Francesca Jacobs Ret

Last Updated:

Views: 5895

Rating: 4.8 / 5 (48 voted)

Reviews: 95% of readers found this page helpful

Author information

Name: Francesca Jacobs Ret

Birthday: 1996-12-09

Address: Apt. 141 1406 Mitch Summit, New Teganshire, UT 82655-0699

Phone: +2296092334654

Job: Technology Architect

Hobby: Snowboarding, Scouting, Foreign language learning, Dowsing, Baton twirling, Sculpting, Cabaret

Introduction: My name is Francesca Jacobs Ret, I am a innocent, super, beautiful, charming, lucky, gentle, clever person who loves writing and wants to share my knowledge and understanding with you.