A serious security flaw has been revealed in the Libbitcoin Explorer 3.x library, leading to the illicit withdrawal of over $900,000 from Bitcoin users’ accounts. What were the causes of this event and what are its consequences for the world of cryptocurrencies?
The constantly evolving world of cryptocurrencies attracts not only investors and technology enthusiasts but also individuals with less honest intentions. Recent reports indicate one of the most significant breaches in recent times. A flaw in the popular Libbitcoin Explorer 3.x library allowed cybercriminals to steal an amount exceeding $900,000 from Bitcoin users’ accounts.
Libbitcoin Explorer, whose fault was the main cause of the incident, is a command-line tool often used for various Bitcoin-related operations, such as generating cryptographic keys or monitoring transactions. Because it does not require a full node, it facilitates interaction with the Bitcoin network, mainly serving developers and experienced users.
Worryingly, many cryptocurrency wallets relied on Libbitcoin Explorer for entropy generation for private keys. Using this gap, hackers managed to infiltrate and unnoticedly send significant amounts to various blockchains. This underscores the importance of taking action to strengthen security measures in the world of cryptocurrencies.
This flaw was named “Milky Sadness” by the Distrust cybersecurity team. It allowed attackers to manipulate the faulty key generation mechanism, which in practice enabled guessing private keys.
To illustrate the scale of the problem, experts compared the situation to securing an online bank account with a password manager that generates the same passwords for many users. By exploiting this weakness, criminals were able to withdraw funds from many affected accounts.
According to Distrust, the source of the problem is the faulty “seed” command used to generate new entropies for private keys. This faulty mechanism leads to the creation of ineffective results, making the funds vulnerable to theft.
Although the exact number of wallets affected by the Libbitcoin flaw and the full scale of cryptocurrency theft remain unconfirmed, evidence suggests that the gap was actively exploited in June and July of this year.
The events highlighted underscore the urgent need to respond to such gaps to protect the integrity of cryptocurrency transactions and related digital assets. In the age of the digital revolution, where cryptocurrencies play an increasingly important role, the threats associated with their security cannot be underestimated.
