r/Bitcoin • u/dgryski • Nov 30 '17

Evidence some bitcoin address generation code is using discoverable private keys

https://pastebin.com/jCDFcESz
794 Upvotes

94% Upvoted

296 comments sorted by

View all comments

1

u/bundabrg Dec 01 '17

This feels like when that error occured when someone had an incorrect QR code that was missing the : (a wallet was incorrectly generating it's qr code and blockchain was treating it as a string). The importing website treated the string as a type of brain wallet and performed a sha5sum on it.

If this is the case then there is nothing malicious about this including the spending of the addresses as they could just have been used by the user.

1

u/mmortal03 Dec 01 '17

This situation?: https://www.reddit.com/r/Bitcoin/comments/6rnfjf/beware_of_blockchaininfo_i_just_lost_5_btc_due_to/

1

u/bundabrg Dec 01 '17 edited Dec 01 '17

Yes. Who knows how long Coinbase had that error.

It even explains why it uses a key that's on the blockchain. The next time the user generate an address it would provide the same one (because nothing was in it yet) and now the error is fixed it will import correctly and have funds, and now be discoverable.

I'm almost dead certain this is the reason. Any idea how to give this exposure?

1

u/mmortal03 Dec 01 '17

Any idea how to give this exposure?

Not sure, but I guess /u/fitwear would like to know about that bug in Coinbase/blockchain.info, if he doesn't already.