区块链强盗利用弱加密密钥掠夺数百万美元的以太坊

独立安全评估者 (ISE) 最近的一项研究表明，一个未知实体一直在利用弱私钥来积累大量 ETH。通过一种名为“Ethercombing”的方法，该实体已收集了近 45,000 个 ETH，价值超过 600 万美元。该研究表明，处理私钥的系统容易受到针对性攻击，这凸显了需要采取强有力的安全措施来保护加密资产。

Blockchain Bandit Exploits Weak Crypto Keys, Amassing Millions in Ethereum

区块链强盗利用弱加密密钥，在以太坊中积累了数百万美元

In a groundbreaking study released on Tuesday by Independent Security Evaluators (ISE), a renowned security consulting firm, a nefarious entity has been identified as exploiting vulnerabilities in private keys to siphon tens of thousands of Ethereum (ETH) coins.

著名安全咨询公司独立安全评估者 (ISE) 周二发布的一项开创性研究表明，一个邪恶实体已被确定利用私钥中的漏洞窃取数以万计的以太坊 (ETH) 代币。

Dubbed the "blockchainbandit," this clandestine actor has seized control of approximately 44,744 ETH, valuing roughly $6.1 million currently, from unsuspecting cryptocurrency holders. The study, titled "Ethercombing: Finding Secrets in Popular Places," delves into the intricate methods employed by the blockchainbandit to compromise weak private keys.

这位被称为“区块链强盗”的秘密行动者已从毫无戒心的加密货币持有者手中夺取了约 44,744 枚 ETH，目前价值约 610 万美元。这项名为“Ethercombing：在热门场所寻找秘密”的研究深入研究了区块链强盗使用的复杂方法来破坏弱私钥。

Private keys serve as the gatekeepers to cryptocurrency wallets, allowing users to authorize transactions. However, these keys can be vulnerable to compromise if generated using flawed code or random number generators. ISE's investigation focused on uncovering such compromised keys, leading to the discovery of 732 weak private keys responsible for over 49,000 ETH transactions.

私钥充当加密货币钱包的看门人，允许用户授权交易。然而，如果使用有缺陷的代码或随机数生成器生成这些密钥，则可能容易受到损害。 ISE 的调查重点是发现此类被泄露的密钥，最终发现了 732 个弱私钥，这些私钥负责超过 49,000 笔 ETH 交易。

"We aimed to identify keys that may have been generated using faulty code or random number generators," explained Adrian Bednarek, a researcher and analyst at ISE. "Our findings reveal that these keys are readily exploitable, and the blockchainbandit has taken advantage of this vulnerability."

ISE 的研究员兼分析师 Adrian Bednarek 解释说：“我们的目的是识别可能使用错误代码或随机数生成器生成的密钥。” “我们的研究结果表明，这些密钥很容易被利用，而区块链强盗已经利用了这个漏洞。”

The study further unearthed 13,319 ETH transferred to either invalid destination addresses or wallets derived from weak keys. At the peak of the Ethereum market, these compromised funds had a combined value exceeding $18 million.

该研究进一步发现，有 13,319 ETH 被转移到无效的目标地址或源自弱密钥的钱包。在以太坊市场的顶峰时期，这些受损资金的总价值超过 1800 万美元。

Bednarek suspects the blockchainbandit employs automated processes to scour the blockchain for new wallets and identify vulnerable keys. "This individual or group is highly sophisticated, dedicating significant computing resources to sniffing out new wallets and testing them for weak keys," he said.

Bednarek 怀疑区块链强盗采用自动化流程在区块链中搜索新钱包并识别易受攻击的密钥。他说：“这个个人或团体非常复杂，投入大量计算资源来嗅探新钱包并测试它们是否存在弱密钥。”

ISE's report emphasizes the heightened threat posed by such targeted attacks, particularly for systems handling private keys. "It is evident that any system interacting with valuable private keys is vulnerable to exploitation," the report warns.

ISE 的报告强调了此类有针对性的攻击所带来的更大威胁，特别是对于处理私钥的系统。报告警告说：“很明显，任何与有价值的私钥交互的系统都容易受到攻击。”

To mitigate these risks, developers are urged to implement robust defense mechanisms and explore innovative measures to counter evolving threats. "Software designers should prioritize incorporating all available defense principles to protect against present and future threats," the report concludes.

为了减轻这些风险，我们敦促开发人员实施强大的防御机制，并探索创新措施来应对不断变化的威胁。报告总结道：“软件设计者应优先考虑纳入所有可用的防御原则，以防范当前和未来的威胁。”

The blockchainbandit's exploits serve as a stark reminder of the importance of safeguarding private keys. Cryptocurrency users are advised to exercise extreme caution when generating and storing their private keys, employing strong security measures to prevent unauthorized access.

区块链强盗的漏洞清楚地提醒我们保护私钥的重要性。建议加密货币用户在生成和存储私钥时要格外小心，采用强大的安全措施来防止未经授权的访问。