​Ethereum private key is not random enough, hackers crack the private key to steal coins

Produced by Odaily

Author | Qin Xiaofeng

Editor | Lu Xiaoming

(picture fromcryptonomist）

according tosecurity evaluatorsProduced by Odaily

Editor | Lu Xiaoming

image description

(picture from

according to

News, the Independent Security Evaluation Agency (ISE) recently released a new study called Ethercombing, which focuses on the security of the private key of the Ethereum wallet.

ISE found that there are currently 732 private keys on the Ethereum blockchain that are at risk of being stolen due to their low randomness. In addition, since last year, a hacker group called "Blockchainbandit" has carried out stealing activities through low-security private keys, reaching 37,926 ETH (valued at $54 million at the time). To this day, the organization has not stopped.

secondary title

• 0x47579DA2BEA463533DBFAD6FCF8E90876C2FE9760DC1162ACC4059EE37BDDB5C

Private key randomness is not high

• 0x0000000000000000000000000000000000000000000000000000000037BDDB5C

The generation of the Ethereum public key and address depends on the private key. With the private key, the public key and address can be generated, and the Ethereum (ETH) on the corresponding address can be spent.

The private key is essentially a random number, an array of 32 bytes, 1 byte is equal to 8-bit binary, and a binary has only two values: 0 or 1. So the total number of private keys is nearly 2^(8*32)=2^256, and the probability of cracking the private key is 1/2^256.

ISE researcher Adrian Bednarek said that although there is still a possibility in theory, it is actually impossible to forcibly crack the private key. Even if we use computing resources that allow us to generate 100 trillion keys per second, it will take about a few years, and we actually don't have such computing resources at all.

However, ISE found in the experiment that due to errors in some wallet software codes that generate private keys, the generated private keys are not very random and are easily cracked by computer violence (enumerate all possibilities).

Due to a problem with the code, the integrity of the private key is truncated to 32 bits on output, resulting in the following:

For a computer, it is far less difficult to crack a 32-bit private key than a 256-bit private key.

In addition to wallet encoding errors, memory reference issues, memory corruption, random device errors, random seed reuse, object obfuscation, stack corruption, input obfuscation, entropy errors, heap corruption, or unchecked precompiled encoding errors can all cause private keys to not be random enough , the security is reduced.

ISE researchers found in experiments that there are currently 732 private keys on the Ethereum blockchain whose randomness is not strong, and there is a risk of leakage; these private keys are still active and are associated with 49,060 transactions on the chain.

To test the found low-security private key, ISE researchers transferred $1 worth of ETH to one of the addresses, and the Token was transferred away a few seconds later.

ISE tracking found that Token eventually flowed to a hacker organization wallet called "Blockchainbandit". The organization has been stealing private keys with weaker security since January 2018. At its peak, the balance of the address reached 37,926 ETH, worth $54 million at the time. To this day, the organization has not stopped.

• secondary title

• Ethereum itself has no problems

• If there is a problem with the private key, does it mean that there is a loophole in the technology of the Ethereum blockchain itself? Ethereum researcher Hu Jingyu told Odaily that the low-security private keys currently appearing are mainly wallet problems and have nothing to do with Ethereum itself. Chen Changwu, the core developer of Ethereum, also believes that there is no problem with the algorithm of Ethereum itself.

• Chen Changwu added that in addition to random numbers, the K value used in the signature process will also affect the security of the private key. "A secret K value will be used in the process of generating a signature. Currently, both BTC and ETH use RFC6979 to generate this value. This K value must be random and unique. However, some programmers who are not familiar with cryptographic algorithm programming are likely to ignore it. These details lead to the leakage of the private key.”

• At the end of the report, ISE also gave suggestions to developers and users:

• For developers:

• Generate random numbers using well-known libraries or platform-specific modules;

Use a cryptographically secure pseudo-random number generator;

• Audit source code and generated compiled code to verify that randomly generated keys are not truncated;

• use multiple entropy sources;

• Utilizes NIST-compliant hardware random number generation instructions (RDRAND/RDSEED) provided by AMD/Intel*

Check out the NIST/FIPS guidance on cryptographic random number generation

Review and use the NIST Statistical Test Suite (NIST SP 800-22)Arvind Krishna For users using wallets: