When Cryptographic Weaknesses Strike More Than Twice

A storm is coming to the Blockchain. A storm large enough that it has it's own name. Randstorm. For reasons that will become clear shortly, early adopters of crypto may need to seek shelter. If you participated in many of the early blockchain platforms (particularly in between the years 2011-2015), you may be affected.

Before reading the RANDSTORM FAQ and page please read the Washington Post article published on November 14th 2023 here first for context:

https://www.washingtonpost.com/technology/2023/11/14/bitcoin-wallet-passcode-flaw/
Non paywalled version: Randstorm Washington Post


If you are concerned your wallet may be vulnerable please visit to verify:

https://www.keybleed.com

Why Is Unciphered Disclosing Randstorm Now?

Please see our blog post with full explanation here: https://www.unciphered.com/randstorm-disclosure

RANDSTORM FAQ

  • What is Randstorm?

    Randstorm() is a term we coined to describe a collection of bugs, design decisions, and API changes that, when brought in contact with each other, combine to dramatically reduce the quality of random numbers produced by web browsers of a certain era (2011-2015).

    Large random numbers are a critical ingredient in the overall security of blockchain technology.

  • Why is this important?

    By our estimates approximately 1.4M BTC are sitting in wallets that were generated with potentially weak cryptographic keys.

    If we conservatively estimate that only 3-5% of wallets generated during that time were affected, the current value of coins at risk is between 1.2 - 2.1Billion USD (assuming 1 BTC=$30,000)

  • Is Bitcoin / 'blockchain technology' fundamentally broken?

    No!

    The mathematical underpinnings of cryptocurrency remain as strong as ever. What we have discovered is a series of programming mistakes.

    Mistakes that were unfortunately widely shared across many technologies during the timeline outlined above.

  • How did this happen?

    Our technical paper “Randstorm - You Can’t Patch a House of Cards" can be found here.

  • What should I do?

    If you're one of the people who got into bitcoin (or similar) projects early, and you have been watching the value of coins in your wallet rise ever since, now is a good time to generate a new wallet and move them.

    You should probably change the locks on your house at least once every decade, shouldn't you do the same for your coins?

  • Wait, what about other coins (DOGE, etc)?

    YES.

    The decentralized nature of blockchain projects make it difficult to speak for all of the other 'alt-coins' out there, but Unciphered researchers have verified that the same flaws exist with popular DOGE wallet generation in the same era.

  • Are languages other than .js vulnerable to Randstorm?

    All of the specific code vulnerabilities identified so far by Unciphered have been within JavaScript libraries designed to perform client side key generation inside a browser.

  • Which vendors have you already disclosed this to?

    We have disclosed to the following vendors:

    Blockchain.com, Bitgo, Block.io / Dogechain.info, Bitpay, Blockstream Green, Bitaddress.org, Coinkite, and BitcoinJS.

    Not all of the vendors we contacted were affected. Additionally, there may be other affected parties who we did not identify.

  • Why should I believe you?

    Over a billion USD worth of Bitcoin is protected by potentially 'weak' keys and you want me to just take your word for it?

    Please direct your attention to our Preliminary blockchain analysis (see below). We arrived at these numbers by looking at the amount of BTC that has not been touched since 2015, and extrapolating from there.

    For a deeper dive, please read our technical blog post ‘You Can't Patch a House of Cards.’

  • Are you telling me my key is vulnerable?

    Not exactly. We can’t tell you if your key is vulnerable without having a copy of it.

    If you created a wallet that you believe is affected by this vulnerability, we suggest that you move your assets to a more recently generated wallet created by trusted software.

    If you’re interested in knowing if any of your wallets are vulnerable submit your Wallet ID’s to https://www.keybleed.com

  • Re-keying my apartment is hard. Is re-keying my bitcoin easy?

    It is!

    But If you are the type that generated your own wallet to begin with, then you probably already knew that (because you did it before).

  • Can you recommend a specific key generation app?

    Yes. The reference implementation. Admittedly, this carries substantial technical overhead for most people. If you are unsure about generating your own wallet, there are also custodial exchanges who will hold your assets for you.

    If you are looking for greater understanding of this issue, there is an online wallet generator that illustrates (literally) how entropy should be handled, check out bitaddress.org. Bitaddress provides the easiest way to see entropy in action.

  • Do you have a copy of my key?

    No. We do not have a copy of your key.

    We recommend updating your wallet by sending your crypto to a new wallet.

  • Wallet generation is free, but transferring bitcoin costs money!

    We know. That's just how the blockchain works. Blame Satoshi.

Are you the first to discover this type of attack?

Not at all! In fact, we are not the first people to notice this vulnerability. The pseudonymous ketamine@national.shitposting.agency pointed to this precise issue in 2018.

In 2015, Ryan Castellucci drew attention to attacks occurring against “Brain Wallets” advising - “If you’re using a brainwallet, move your coins - NOW!”

In 2019, Joachim Breitner and Nadia Heninger released the paper, "Biased Nonce Sense: Lattice Attacks against Weak ECDSA", where the authors compute “hundreds of Bitcoin private keys and dozens of Ethereum, Ripple, SSH, and HTTPS private keys.”

In 2019, researchers discovered a “blockchain bandit” who managed to steal almost 45,000 ether (ETH) by successfully guessing frail private keys.

In April of 2023, Ledger discovered an issue with wallets created using the Trust Wallet browser extension which would have allowed “an attacker to steal all the assets of any wallet created with this extension, without any user interaction.”

Concerned your Crypto Wallet may be vulnerable, please visit to verify:

Keybleed.com

[Powered by Unciphered]

Preliminary blockchain analysis

We used data from Glassnode and Dune Analytics queries to determine the amount of Bitcoin in addresses that were created during the time that the vulnerability was live and found that over 1.45M BTC ($52 billion at current prices) is still held in addresses that were first created during the impacted time period. 

Because we’re talking about non-custodial wallets, even the wallet developers themselves can’t know the exact amount of BTC held in wallets they created. Owing to their ease-of-use of BitcoinJS-based wallets when compared to other early Bitcoin wallets, we know that impacted wallet software had a large market share. For instance, blockchain.com reported being responsible for 28% of Bitcoin transactions between 2012 and 2021. (https://www.cnbc.com/2021/03/24/blockchain-com-rides-bitcoin-mania-to-a-5-2-billion-valuation.html). 

The likelihood of a specific cryptocurrency address (aka, wallet) being cryptographically weak hinges on several factors. Particularly critical is the software version used: for instance, Blockchain.info wallets created before March 2012, or other wallets generated using the open-source version of BitcoinJS prior to crucial updates implemented in March 2014, are at heightened risk.

In the case of wallets where additional entropy was incorporated, such as blockchain.info wallets created after March 2, 2012, a multitude of factors come into play. For instance, the browser used by the wallet owner, alongside the approach to password creation, be it through a password generator or manual input, and even the typing speed can influence security. These factors, while not exhaustive, collectively contribute to the security of the private keys generated. Depending on the exact combination of variables, entities with extensive GPU resources, like nation-states or GPU mining farms, could still feasibly access private keys. This complexity underscores the importance of comprehensive awareness and proactive wallet migration to secure potentially impacted funds.

Below, we calculate the relative vulnerability of wallets generated under different scenarios and the number of affected wallets in each of these cases:

Estimate Model For Vulnerable Wallets

Vanilla BitcoinJS Main Line

  • November 2011 to March 2014

    • Compute: 1 GPU within a day in the fastest case scenario

      • Example: Nvidia 3090 - MSRP $1300 - 11/8/2023 - available on Amazon. These are the same ones you find in high-end gaming PCs.

    • Amount: Some % of 870,000 BTC ($31B)

      • % unknown because Wallet generation numbers are not published, BitcoinJS was Forked 157 times by 8/3/14 and 2.1k Forked by 11/8/2014 

  • March 2014 to December 2015

    1. Compute: Close to 256-bit key strength - Key almost generated with full entropy - the standard level of encryption you would want/expect in a secure wallet.

    2. Amount: Some % of 530,000 BTC ($18.9B)

      1. % unknown because Wallet generation numbers are not published, BitcoinJS was Forked 157 times by 8/3/14 and 2.1k Forked by 11/8/2014 

    3. We have seen examples that some vendors didn’t upgrade till much later and those wallets are still producing vulnerable wallets.


Blockchain.info (Forked from BitcoinJS)

The popularity of BitcoinJS adds considerable difficulty when assessing the scope of this issue. According to the wayback machine, as of August 2014 there were 157 forks of the bitcoinjs library

At the time of publication (November 2023) there are 2100+ forks of BitcoinJS 

Unciphered would like to thank the following individuals, entities, and projects for their positive influence on the cryptocurrency ecosystem

  • Ketamine - Bitcoin-dev List

  • Blockchain.com

  • Trailofbits.com

  • Bitgo.com

  • Glassnode.com

  • Dune.com

  • Block.io(Dogechain.info)

  • Lawfareblog.com

  • Gemini.com

  • Kraken.com

  • Ledger.com

  • Bitpay.com

  • BitcoinJS Maintainers

  • Chris Inglis

  • Countless engineers, legal professionals, and you know who! :)

  • Friends and family of Unciphered.com for this very long, and winding project that added a lot of stress to our lives. Thank you!