Usually, when creating a new cryptocurrency wallet, the system generates a combination of 12 or 24 random words (called a key).
This key is the only protection securing your assets. Normally, these words are chosen so randomly that guessing them by computer would be like finding one specific grain of sand in the Sahara Desert.
However, in vulnerable apps, the random word generator worked like a broken lottery machine – it only spun certain predictable word combinations.
Hackers quickly realized this. They simply generated all possible predictable combinations by computer, checked which wallets had money, and emptied them in one go.
In one night in May, more than 400 wallets were emptied this way, with 2.73 million euros stolen. Later, another 1.85 million euros were stolen from another victim.
Who is at risk?
The good news – the most popular wallets today and physical memory devices (such as „Ledger“ or „Trezor“) are completely safe.
Read more Science about skin: what cellulite really means and why you need a cream with SPF every day?
Those at risk are users of older apps created roughly from 2018 or mobile apps or browser extensions made by small companies.
Security researchers identified five specific vulnerable wallets but do not publicly disclose their names to avoid providing guidelines to other criminals.
What to do? 3-step instruction
The security company „Coinspect“ created a free and secure checker on the website illbloom.org.
There is nothing to fear – the tool only asks you to enter your public wallet address (you must never enter your secret words anywhere).
If a match is found on the site, experts advise acting immediately:
- Consider the wallet unsafe. Even if your funds are still there – it is only a matter of time. Hackers deliberately do not touch accounts with less than about 4.40 euros but use them as bait for your further transfers.
- Create a new wallet. Download a reliable, popular app and generate a completely new 12–24 word phrase.
- Immediately transfer funds. The only way to save your money is to physically send it to the new address. Reinstalling the old app or logging in again with the same words will not solve anything.
During such crises, fake “saviors” offering to help save funds flood the internet. Cybersecurity experts warn that no official rescue service or verification site will ever ask you to enter your secret 12-word code or transfer money to them. If anyone asks for this – they are scammers.
Read more Seoul asks North Korea for help in searching for a missing sailor
