區塊鏈強盜利用弱加密金鑰掠奪數百萬美元的以太坊

獨立安全評估者 (ISE) 最近的一項研究表明，一個未知實體一直在利用弱私鑰來累積大量 ETH。透過一種名為「Ethercombing」的方法，該實體已收集了近 45,000 個 ETH，價值超過 600 萬美元。研究表明，處理私鑰的系統容易受到針對性攻擊，這凸顯了需要採取強有力的安全措施來保護加密資產。

Blockchain Bandit Exploits Weak Crypto Keys, Amassing Millions in Ethereum

區塊鏈強盜利用弱加密金鑰，在以太坊中累積了數百萬美元

In a groundbreaking study released on Tuesday by Independent Security Evaluators (ISE), a renowned security consulting firm, a nefarious entity has been identified as exploiting vulnerabilities in private keys to siphon tens of thousands of Ethereum (ETH) coins.

著名安全諮詢公司獨立安全評估者 (ISE) 週二發布的一項開創性研究表明，一個邪惡實體已被確定利用私鑰中的漏洞竊取數以萬計的以太坊 (ETH) 代幣。

Dubbed the "blockchainbandit," this clandestine actor has seized control of approximately 44,744 ETH, valuing roughly $6.1 million currently, from unsuspecting cryptocurrency holders. The study, titled "Ethercombing: Finding Secrets in Popular Places," delves into the intricate methods employed by the blockchainbandit to compromise weak private keys.

這位被稱為「區塊鏈強盜」的秘密行動者已從毫無戒心的加密貨幣持有者手中奪取了約 44,744 枚 ETH，目前價值約 610 萬美元。這項名為「Ethercombing：在熱門場所尋找秘密」的研究深入研究了區塊鏈強盜使用的複雜方法來破壞弱私鑰。

Private keys serve as the gatekeepers to cryptocurrency wallets, allowing users to authorize transactions. However, these keys can be vulnerable to compromise if generated using flawed code or random number generators. ISE's investigation focused on uncovering such compromised keys, leading to the discovery of 732 weak private keys responsible for over 49,000 ETH transactions.

私鑰充當加密貨幣錢包的看門人，允許用戶授權交易。然而，如果使用有缺陷的程式碼或隨機數產生器產生這些金鑰，則可能容易受到損害。 ISE 的調查重點是發現這類外洩的金鑰，最終發現了 732 個弱私鑰，這些私鑰負責超過 49,000 筆 ETH 交易。

"We aimed to identify keys that may have been generated using faulty code or random number generators," explained Adrian Bednarek, a researcher and analyst at ISE. "Our findings reveal that these keys are readily exploitable, and the blockchainbandit has taken advantage of this vulnerability."

ISE 的研究員兼分析師 Adrian Bednarek 解釋說：“我們的目的是識別可能使用錯誤代碼或隨機數生成器生成的密鑰。” “我們的研究結果表明，這些密鑰很容易被利用，而區塊鏈強盜已經利用了這個漏洞。”

The study further unearthed 13,319 ETH transferred to either invalid destination addresses or wallets derived from weak keys. At the peak of the Ethereum market, these compromised funds had a combined value exceeding $18 million.

研究進一步發現，有 13,319 ETH 被轉移到無效的目標位址或源自弱金鑰的錢包。在以太坊市場的頂峰時期，這些受損資金的總價值超過 1800 萬美元。

Bednarek suspects the blockchainbandit employs automated processes to scour the blockchain for new wallets and identify vulnerable keys. "This individual or group is highly sophisticated, dedicating significant computing resources to sniffing out new wallets and testing them for weak keys," he said.

Bednarek 懷疑區塊鏈強盜採用自動化流程在區塊鏈中搜尋新錢包並識別易受攻擊的金鑰。他說：“這個個人或團體非常複雜，投入大量計算資源來嗅探新錢包並測試它們是否存在弱密鑰。”

ISE's report emphasizes the heightened threat posed by such targeted attacks, particularly for systems handling private keys. "It is evident that any system interacting with valuable private keys is vulnerable to exploitation," the report warns.

ISE 的報告強調了此類有針對性的攻擊所帶來的更大威脅，特別是對於處理私鑰的系統。報告警告說：“很明顯，任何與有價值的私鑰互動的系統都容易受到攻擊。”

To mitigate these risks, developers are urged to implement robust defense mechanisms and explore innovative measures to counter evolving threats. "Software designers should prioritize incorporating all available defense principles to protect against present and future threats," the report concludes.

為了減輕這些風險，我們敦促開發人員實施強大的防禦機制，並探索創新措施來應對不斷變化的威脅。報告總結道：“軟體設計者應優先考慮納入所有可用的防禦原則，以防範當前和未來的威脅。”

The blockchainbandit's exploits serve as a stark reminder of the importance of safeguarding private keys. Cryptocurrency users are advised to exercise extreme caution when generating and storing their private keys, employing strong security measures to prevent unauthorized access.

區塊鏈強盜的漏洞清楚提醒我們保護私鑰的重要性。建議加密貨幣使用者在產生和儲存私鑰時要格外小心，採用強大的安全措施來防止未經授權的存取。