Skip to main content

Amber Group uses simple hardware to show just how fast, easy the Wintermute hack was

The Hong Kong-based group documented its reproduction of the hack on its tech and security oriented blog, seeking insights into Web3’s attack surface spectrum.

Amber Group has reproduced the recent Wintermute hack, the Hong Kong-based crypto finance service provider announced on its blog. The process was fast and simple, and used hardware easily accessible to consumers. Wintermute lost over $160 million in a private key hack on Sept. 20.

Reproducing the hack can help “build a better understanding of the attack surface spectrum across Web3,” Amber Group said. It was only hours after the hack of UK-based crypto market maker Wintermute was revealed that researchers were able to pin the blame for it on the Profanity vanity address generator.

One analyst suggested that the hack had been an inside job, but that conclusion was rejected by Wintermuteand others. The Profanity vulnerability was already known before the Wintermute hack.

Amber Group was able to reproduce the hack in less than 48 hours after preliminary setup that took less than 11 hours. Amber Group used a Macbook M1 with 16GB RAM in its research. That was far speedier, and used more modest equipment, than how a previous analyst had estimated the hack would play out, Amber Group noted.

Related: The impact of the Wintermute hack could have been worse than 3AC, Voyager and Celsius — Here is why

Amber Group detailed the process it used in the re-hack, from obtaining the public key to reconstructing the private one, and it described the vulnerability in the way Profanity generates random numbers for the keys it produces. The group notes that its description “does not purport to be complete.” It added, repeating a message that has often been spread before:

“As well documented by this point — your funds are not safe if your address was generated by Profanity […] Always manage your private keys with caution. Don’t trust, verify.”

The Amber Group blog has been technically oriented from its inception, and has addressed security issues before. The group achieved a $3-billion valuation in February after a Series B+ funding round.



from https://ift.tt/RsUENrX
https://ift.tt/vGo6Xin
Labels:

Comments

Post a Comment

Any questions, Please.

Popular posts from this blog

ENS DAO delegates offer perspective on DAO governance and decentralized identity

AlphaWallet CEO and Spruce co-founder talk about their roles as contributors to the Ethereum Name Service following the project's recent airdrop. Earlier this month, the Ethereum Name Service, or ENS, formed a decentralized autonomous organization, or DAO, for the ENS community.  Cointelegraph spoke to two ENS DAO delegates who applied for the opportunity to represent the community and stay involved in the decision making process: Victor Zhang, CEO of AlphaWallet, an open source Ethereum wallet, and Gregory Rocco, co-founder of Spruce, a decentralized ID and data toolkit for developers. Zhang spoke about his experience as an external contributor to ENS and an early supporter since 2018. Zhang initially sought to help ENS by offering Alpha Wallet as a user-friendly tool for  resolving .eth names and cryptocurrency wallet addresses. Essentially, if a user inputs an .eth name in the AlphaWallet, it will show the wallet address, and vice versa using reverse resolution. Alpha...
Post a Comment
Read more

How Social Platform Chingari is Using Web 3.0 to Transform the Traditional Way We Use Social Media

The world is changing. This isn’t news to anyone, but sometimes it is nice to realize that—contrary to news headlines—not all the change is bad.  In fact, the last decade has seen so much innovation and so many improvements to technology that even 2015 seems like a different world.  Internet speeds, connecting with anyone globally (for free), and our ability to reach large groups of people without a middleman is nothing short of revolutionary. When it comes to technology evolution, this often happens with different iterations.  Once a system is mature, there’s a better idea of what we would like to change and improve.  We go back to the drawing board, target our creative minds at the issues, and create a new version that has evolved to better meet our needs.  The Internet has followed this model since its inception, evolving through three distinct stages.  We are only at the cusp of the third stage, called Web 3.0, with technologies such as blockchain and ...
Post a Comment
Read more

INX submits bid for Voyager Digital's assets

FTX US won a $1.4-billion bid to purchase Voyager’s assets in September, but with the firm filing for bankruptcy, the funds were once again up for grabs. Trading platform INX has submitted a bid for an undisclosed amount to purchase the assets of crypto brokerage firm Voyager Digital. In a Nov. 30 announcement, INX said it had sent a non-binding letter of intent for Voyager’s assets following the platform filing for bankruptcy in July. According to INX CEO Shy Datika, the bid was aimed at providing “credibility, technology, and unique regulatory positioning” for Voyager users seeking stability in a volatile market. Voyager’s original bankruptcy filing from the Southern District Court of New York suggested the firm could owe between $1 billion to $10 billion to more than 100,000 creditors amid a bear market and exposure to Three Arrows Capital. In September, FTX US won a $1.4-billion bid to purchase Voyager’s assets, but with FTX Group itself filing for bankruptcy in November, th...
Post a Comment
Read more