Bug in Libbitcoin Explorer 3.x Allows Hacker to Steal $900K

The potential attack from this vulnerability could result in the attacker gaining access to thousands of crypto wallets.

The blockchain security firm SlowMist shared a post citing that a critical vulnerability is found in Libbitcoin explorer’s 3.x version which is widely used by cryptocurrency wallets.

🚨SlowMist Security Alert🚨

Recently, #Distrust discovered a severe vulnerability affecting cryptocurrency wallets using the #Libbitcoin Explorer 3.x versions. This vulnerability allows attackers to access wallet private keys by exploiting the Mersenne Twister pseudo-random…
— SlowMist (@SlowMist_Team) August 10, 2023

As per the Milk Sad, this vulnerability in Libbitcoin Explorer has arised due to weak functionality that has led to an estimated damage of $900k with putting several crypto wallets at risk. Milk Sad blog compares this with Trust Wallet vulnerabilities found in the past.

Slow Mist describes that the implementation of pseudo random number generator (PRNG) in Libbitcoin Explorer is at the core of it all. PRNG uses the Mersenne twister algorithm while utilizing 32 bits of system time in seed which can cause the attack and access to users private keys.

The vulnerability can expose private keys of crypto wallets which used Libbitcoin’s explorer 3.x in seed generating. The currently affected cryptocurrencies are Bitcoin, Ethereum, Solana, Dogecoin, Litecoin, Bitcoin Cash, Zcash and others.

Are you for real Libbitcoin team? Do you really think a warning in a GitHub wiki, edited 6 years ago and seems unmaintained, with the wording "can introduce" is enough to inform users of a "not-to-be-used-in-prod" command? Transparency is the key, and you have failed miserably. https://t.co/op4MmoV3vy pic.twitter.com/Xc9QlI5byr
— sudo rm -rf –no-preserve-root / (@pcaversaccio) August 10, 2023

Several users claimed that the potential loophole was identified 6 years ago within Libbitcoin explorer’s github wiki and it seems neglected.

Also Read: Cypher Protocol Freezes Smart Contract after $1M Exploit

Disclaimer: The information researched and reported by The Crypto Times is for informational purposes only and is not a substitute for professional financial advice. Investing in crypto assets involves significant risk due to market volatility. Always Do Your Own Research (DYOR) and consult with a qualified Financial Advisor before making any investment decisions.

Follow The Crypto Times on Google News to Stay Updated!