Hacker Returns 225 BTC Taken from Blockchain Wallets

A 'white-hat' hacker who was able to take 255 BTC from Blockchain users' wallets following a security flaw earlier this week has returned the funds.

AccessTimeIconDec 10, 2014 at 10:09 a.m. UTC
Updated Sep 11, 2021 at 11:22 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

A white-hat hacker who was able to take 255 BTC from Blockchain wallets following a security flaw earlier this week has returned the funds.

Bitcoin Talk member 'johoe', an account 1.5 years old but with only 21 posts, had always stated that he or she was taking the funds for safekeeping and would return them, writing on the forum:

"There were a large bunch of new broken addresses today (several 100s in one day). I took the liberty of saving some funds before they got swiped by others. If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known), I will send the funds back."

Johoe then posted a page of 1,019 addresses said to be compromised, and invited users to check if theirs was one of them. Blockchain CEO Nicolas Cary confirmed to CoinDesk that the funds had been received.

Even before the funds were returned, Blockchain had admitted it was at fault and promised to reimburse any users who had lost money.

Random number flaw

The problem that led to the vulnerability was reportedly wallets generated with previously used 'R-values' in formulas that generate random numbers, meaning a hacker could use the public address to calculate its private keys. If R-values are unique, this should be impossible.

For the technically-inclined, Blockchain CTO Ben Reeves has pointed out the mistake in code on Blockchain's GitHub page here.

Blockchain posted in a statement that the issue affected web wallet users who had created a new wallet address or sent funds from an existing address during the period the vulnerability was live.

, Reeves sent an email asking him to send the funds to this address, which johoe duly did, posting a photo of a Trezor wallet sending the transaction.

Johoe's Trezor Wallet
Johoe's Trezor Wallet

Still solving the problem

Customers on Bitcoin Talk and Reddit, while relieved their funds were swept by someone with good intentions, are now contacting Blockchain to prove their losses and have them returned.

At this stage, however, it is not 100% confirmed that all funds removed from Blockchain wallets were under johoe's control. At least one user has claimed that nearly 100 BTC missing from his wallet have gone elsewhere.

Blockchain is in the process of examining "thousands" of customer claims and support tickets for authenticity before reimbursing.

Trezor wallet image via johoe/bitcointalk.org. Hacker image via Shutterstock


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.