A deadly vulnerability in WalletGenerator, a service that generates printable private and public keys for storing cryptocurrencies, could affect users who have put funds in wallets generated by the site after August 17, 2018.
Analysts at MyCrypto found today that WalletGenerator’s capacity to truly “randomize” public and private keys (keypairs)—an essential part of ensuring that the funds are cryptographically secure and unhackable—has been contaminated. Instead of being generated randomly, they are instead being spawned from a single, static data source; an image rendered on the WalletGenerator website itself.
This means that keypairs can be easily reproduced by a bad actor with access to the image data. “It illustrates fully that the randomness is not random,” said Harry Denley, MyCrypto’s director of security, in an interview.
He described the bug as “brilliant” for its ability to remain undetected. “Usually with malicious key generators, they send the generated secrets back to their server once the user has generated them,” he said. This one leaves the secrets with the user, leaving its methods untraceable.
In other words, only the person with access to the images—whoever is behind the WalletGenerator website—can reproduce the keypairs.
Denley, in a Medium post, added that the bugs had been mysteriously removed after he reached out to the site’s operator on May 22. The vulnerability was originally caused by “changes to the code” apparently introduced in August last year, and the changes are preserved in the Wayback Machine.
“In this strange turn of events, we still have no idea whether the current site owner is the malicious party, if the server is insecure, or both,” Denley wrote in the Medium post.
For the afflicted? Denley advises users to immediately “create a new keypair / wallet and move your funds to that new, secure address.” MyCrypto also recommends sending funds to BitAddress, an offline cold-wallet service.
WalletGenerator appears fairly popular, and racks up some 140,000 monthly users according to SimilarWeb. Its service allows users to download a—supposedly—randomized keypair onto a paper wallet, which they can then print and store offline.
We were unable to reach WalletGenerator for comment.