Specialists from the Distrust company discovered a serious problem in the Libbitcoin Explorer console application designed for managing cryptocurrency wallets. This vulnerability allows attackers to gain access to seed words and illegally appropriate funds. By August, losses from her misuse had reached figures in excess of $900.
Libbitcoin Explorer offers the ability to perform various actions without the need for a full Bitcoin node, including generating private keys and managing transfers.
An address on the Bitcoin network that the MistTrack platform has identified as risky. Data: X. This detected bug affects application versions from 3.0.0 to 3.6.0, and is related to the pseudo-random number generation (PRNG) mechanism.
According to analysts Anton Livadja and Ryan Heywood, the Libbitcoin Explorer app uses the "bx seed" command to generate random numbers to set up a Bitcoin wallet. However, if the application relies on an insufficiently strong algorithm, the entropy rate drops from 256 bits to just 32 bits. This can allow cybercriminals to crack private keys within a short period of time. Based on the analysis, the main theft took place around July 12, 2023, but the first unauthorized accesses could have started as early as May. As of August, funds in Bitcoin, Ethereum, XRP, Dogecoin, Solana, Litecoin, Bitcoin Cash and Zcash were stolen. The person behind these acts remains unknown.
The list of potentially affected bitcoin wallets remains unpublished, however it is mentioned that there may be up to 2600 cases. According to information, MetaMask, Ledger and Trezor remained out of reach of this problem.
The Libbitcoin development team disagreed with the findings, arguing that users should not use the "bx seed" command, as it is considered unsuitable for securing a wallet in many materials. Anyone who used vulnerable versions of Libbitcoin Explorer is advised to move their assets to verified addresses with proper key generation.
Not long ago, ForkLog published an article about common weaknesses in cryptocurrency wallets.
