Researcher Discovers Serious Vulnerability in Paper Crypto Wallet Site

If you have cryptocurrency in a paper wallet from WalletGenerator.net you'd best pull it off.

May 27, 2019 at 5:00 p.m. UTC
Updated Sep 13, 2021 at 9:14 a.m. UTC

A security researcher from MyCrypto.com, Harry Denley, has posted a detailed – and damning – analysis of paper wallet site WalletGenerator.net.

The core of the analysis hinges on WalletGenerator's original open-source code, available here. Until August 17, 2018 the online code matched the open-source code and the entire project generated wallets using a client-side technique that took in real random entropy and produced a unique wallet. But sometime after that date the two sets of code stopped matching.

The result? The very real possibility that WalletGenerator is giving the same keys to multiple users. To test this, MyCrypto's researcher ran the generator in bulk and got some odd results.

"Approaching from a different angle, we then used the “Bulk Wallet” generator to generate 1,000 keys. In the non-malicious, GitHub version, we are given 1,000 unique keys, as expected.

However, using WalletGenerator.net at various times between May 18, 2019 — May 23, 2019, we would only get 120 unique keys per session. Refreshing our browser, switching VPN locations, or having a different party perform the same test would result in a different set of 120 keys being generated."

While the odd behavior was not found as of last Friday (May 24), it could be return at any time.

"We’re still considering this highly suspect and still recommending users who generated public / private keypairs after August 17, 2018, to move their funds," the researcher says. "We do not recommend using WalletGenerator.net moving forward, even if the code at this very moment is not vulnerable."

You can read the entire report here, but Denley recommends moving funds off of your WalletGenerator-based paper wallets. As there is no clear way to contact the "two random guy [sic] having fun with a side project" who apparently run the site, we can safely recommend you avoid the site altogether.

Code image via Shutterstock

The Festival for the Decentralized World
Thursday - Sunday, June 9-12, 2022
Austin, Texas
Save a Seat Now

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Trending

1
CoinDesk - Unknown
After Armstrong Tweet, India's Crypto Policy Body Says No Contempt of Court Challenge vs. RBI

The Coinbase CEO last month suggested the RBI's "shadow ban" of crypto exchanges violated a Supreme Court ruling.

The Coinbase CEO last month suggested the RBI's "shadow ban" of crypto exchanges violated a Supreme Court ruling.

CoinDesk - Unknown
2
CoinDesk - Unknown
Portuguese Congress Rejects Two Bills Seeking to Tax Crypto

The proposals were submitted by two leftist parties. The government, which also seeks to apply taxes, hasn’t submitted a proposal so far.

The proposals were submitted by two leftist parties. The government, which also seeks to apply taxes, hasn’t submitted a proposal so far.

CoinDesk - Unknown
3
CoinDesk - Unknown
First Mover Asia: Regulatory Attention on Terra Could Change South Korean Trading Environment; Bitcoin Goes Sideways

The founders of two prominent crypto-related organizations said tightened restrictions could make it difficult for foreign tokens to list on Korean exchanges, discouraging projects from trying.

The founders of two prominent crypto-related organizations said tightened restrictions could make it difficult for foreign tokens to list on Korean exchanges, discouraging projects from trying.

CoinDesk - Unknown
4
CoinDesk - Unknown
A16z Doubles Down on Crypto Investments Despite Market Downturn, and NFL Launches Play-to-Earn NFT Game

The most valuable crypto stories for Wednesday, May 25, 2022.

The most valuable crypto stories for Wednesday, May 25, 2022.

CoinDesk - Unknown