A critical vulnerability in the Libbitcoin Explorer 3.x library has led to the alarming theft of over $900,000 from Bitcoin users, a recent report by cybersecurity firm SlowMist reveals.
This exploit also poses a serious threat to users of Ethereum, Ripple, Dogecoin, Solana, Litecoin, Bitcoin Cash, and Zcash who utilize Libbitcoin to create cryptocurrency accounts. The vulnerability, ominously named the “Milk Sad” vulnerability, allows attackers to exploit a flawed key generation mechanism, resulting in the unauthorized access to valuable digital assets.
Notably, Libbitcoin serves as a crucial implementation for creating Bitcoin wallets and accounts across various platforms. Despite being used by prominent applications like Airbitz, Bitprim, and Blockchain Commons, the affected applications remain undisclosed as SlowMist did not provide specific details on which platforms were impacted by the vulnerability. The discovery of this security loophole is credited to the cybersecurity team “Distrust,” who reported it to the CEV cybersecurity vulnerability database on August 7th.
Of particular concern is a specific attack that siphoned off approximately $278,318 worth of Bitcoin. SlowMist has taken action by blocking the attacker’s address, engaging with exchanges to prevent any conversion of the stolen funds. The Distrust team and associated security consultants have set up an informative website detailing the vulnerability’s mechanics.
This flaw arises when users employ the “bx seed” command for wallet seed generation, which utilizes a pseudorandom number generator lacking sufficient randomness, resulting in duplicate seeds for multiple individuals. As investigations continue, the broader cryptocurrency community remains on high alert against further security breaches.
