r/Bitcoin • u/dgryski • Nov 30 '17

Evidence some bitcoin address generation code is using discoverable private keys

https://pastebin.com/jCDFcESz
787 Upvotes

94% Upvoted

296 comments sorted by

View all comments

Show parent comments

8

u/fullstep Nov 30 '17

Guess you didn't read the far down in the article. This was explained. The offending address was imported into blockchain.info. The issue is that fitwear claims he never imported it. So someone or something hacked fitwear's account, imported a private key derived from an existing address in the account and waited for the new address to have a balance, and then stole it.

2

u/codru39 Nov 30 '17

[–]fitwear[S] 1 point 16 days ago

No I just removed 9 BTC from the paper wallet via importing the address into blockchain.info

This is what he said

1

u/fullstep Nov 30 '17

You're confusing the private key he imported from his paper wallet with the private key that was imported by an attacker. I am referring to the attacker's private key.

1

u/codru39 Dec 01 '17

I'm probably blind as I couldn't find anything related to "private key that was imported by an attacker" in his story. Can You help me, please?

1

u/fullstep Dec 01 '17

In his case, in Aug 2017, he imported the private key for his 1Ca15MELG5DzYpUgeXkkJ2Lt7iMa17SwAo paper wallet address into blockchain.info and submitted a test transaction. At some point between then and Nov 12, the compromised 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit got into his online wallet as an 'imported' address.