Another bug has been discovered in a bitcoin wallet, leading to the theft of around 50 bitcoins. This time, Blockchain.info’s web wallet was at fault, and the company is now offering refunds to users who lost bitcoins due to the flaw.
The popular Blockchain website primarily offers market data and serves as the main block chain explorer for the bitcoin currency. However, users can also create web-based wallets to send and receive bitcoins. The bug lies in the random number generator that the web wallet uses to sign bitcoin transactions. The random numbers are generated in web browsers using the JavaScript programming language. It was discovered on Monday, when a bitcoin user reported that he had 1.8 BTC (around $223) stolen.
“Funds from other addresses in this wallet were not affected. This leads me on thoughts that Blockchain.info or Firefox may have some weakness in random number generator like the vulnerability was recently found in the Android, [sic]” he said.
This bug follows another random generator flaw found in the Android operating system earlier this month. That flaw affected the generation of private keys for bitcoin addresses. The repetition of random numbers enabled attackers to determine the private keys of users’ wallets, which in turn enabled them to take ownership of the bitcoin addresses associated with those keys.
Multiple Android clients were affected by that flaw (including Blockchain.info’s client, for which it issued a patch). But this latest flaw affected Blockchain.info’s browser client, its Chrome and Firefox extensions, and its Mac OSX app.
Unlike the Android bug, this flaw only affected the signing of transactions, rather than the creation of private keys, confirmed Blockchain’s Ben Reeves (aka Piuk) on the Bitcointalk forum. Firefox was particularly vulnerable to a poor seeding of its random number generator, he added.
“Unlike the Android issue the RNG [random number generator] used to generate private keys was not affected so wallets do not need to be re-keyed,” Reeves told CoinDesk. “As long as your client is up to date for future transactions you will not be at risk.”
Blockchain.info has now patched the bug. Users must make sure they are using the following client version numbers:
- Chrome extension – v2.85
- Firefox extension – v1.97
- Mac client – v0.11
Also, those who just use the web wallet (without a plugin) should clear their browser cache before using the Blockchain website.
Another forum user advised USA-based forum members that there is possible legal redress via federal laws against criminal wire fraud.
When asked about the identity of the attacker(s), Reeves confirmed that the attacker is an individual and that all stolen funds have been sent to the following address: 1HKywxiL4JziqXrzLKhmB6a74ma6kxbSDj.
Significantly, funds transferred to that account also include funds taken from Android users earlier this month, suggesting that the same person could be behind the theft of bitcoins using both bugs.
For those looking to recover lost funds, Reeves told us: “If someone thinks they have had funds stolen, if it is due to this bug it is very likely the coins will have been sent to the above address. If in doubt they can contact help@blockchain.info and I will investigate further. Only a couple of BTC have been refunded so far.”
Reeves hinted at a glimmer of hope for lost funds: “It depends on [the attacker’s] intentions, but there is still a possibility they might return the funds.” But the prevailing message is: don’t bank on it.
A Blockchain.info representative said that Reeves had issued the (aforementioned) patches within hours of the flaw being detected, and added: “This is a truly amazing turnaround time.”
A list of the addresses affected by the random number generator bugs on both Blockchain and Android were published on the Bitcoin forum, and has also been updated with new finds. He told us: “If someone thinks their money was stolen due to this exploit, they should check if their bitcoin address is on the list. If it is, contact us at: https://blockchain.info/support-desk. If it isn’t, then you were not a victim of this exploit.”
Have you lost bitcoins? Have you been refunded? Let us know in the comments.