BSV
$63.99
Vol 48.21m
-3.9%
BTC
$101079
Vol 55490.62m
-0.29%
BCH
$524.38
Vol 370.63m
-2.45%
LTC
$116.97
Vol 953.88m
-4.59%
DOGE
$0.39
Vol 3598.68m
-3.24%
Getting your Trinity Audio player ready...

WalletGenerator.net has been one of the easiest ways to create a crypto address. However, the simplicity could come at a cost according to one security researcher. Harry Denley, a security researcher with MyCrypto.com, posted a detailed Medium post outlining vulnerabilities he discovered on the site’s code.

WalletGenerator is a website that generates paper wallets for over 190 cryptocurrencies. However, according to Denley, he noticed an irregularity after the site changed ownership. The code being served via the WalletGenerator.net URL did not match the code on its GitHub repository.

Henley, together with a group of security researchers conducted an extensive research and found that the site is giving the same key to multiple users. They informed the owners of the site who according to the post, “responded by stating that they were unable to verify our claims and asking if we were perhaps on a phishing website.”

The researchers at one time used the “Bulk Wallet” generator to generate 1,000 unique keys. In the GitHub version, the 1,000 keys that were generated were unique as they expected. They then added:

“However, using WalletGenerator.net at various times between May 18, 2019 — May 23, 2019, we would only get 120 unique keys per session. Refreshing our browser, switching VPN locations, or having a different party perform the same test would result in a different set of 120 keys being generated.”

The implications could be far reaching, the report stated. This is especially so for those users that used the service between after August 17, 2018.

Henley warned, “For now, we’ll reiterate again: If you’ve generated a public/private keypair with WalletGenerator.net from August 17, 2018, and beyond, you need to move your funds to a new, secure wallet immediately. […] We do not recommend using WalletGenerator.net moving forward, even if the code at this very moment is not vulnerable.”

Henley further warned that currently, his team hadn’t been able to figure out if the current owners of the site are behind the malicious activities, if the servers being used have been compromised, or both.

Recommended for you

WhatsOnChain adds support for 1Sat Ordinals with new API set
WhatsOnChain now supports the 1Sat Ordinals with a set of APIs in beta testing; with this new development, developers can...
December 13, 2024
Palo Alto Networks breach: Blockchain key to cybersecurity resilience
Following the breach reports, Palo Alto Networks revealed that its Next Generation Firewalls had been targeted in cyberattacks exploiting two...
December 5, 2024
Advertisement
Advertisement
Advertisement