The blockchain bandits have made a new move by transferring stolen funds after six years. Blockchain bandits stole $90 million from cryptocurrency users with weak private keys between 2015 and 2016 using “Ethercombing”. Let’s take a walk down to the details.
Who is a Blockchain Bandit?
Blockchain bandits are not specifically identified yet, hence, the personality is still unknown. However, The blockchain bandits are for now seen as individuals or a group that used the ether-combing process to identify and steal from Ethereum addresses operating with weak private keys.
In a research, based on generating private keys by ADRIAN Bednarek, a security consultant at the time of his research for his client, discovered the blockchain bandits. The blockchain bandits were able to use the same ether-combing process he was working on to move funds out of a wallet with weak private keys.
Hence, the hacker’s ability to siphon funds in Ethereum wallets secured with weak private keys in a process called Ether combing earned him the name “blockchain bandit’.
Blockchain Bandits Target Weak Private Keys Using Ethercombing Process
What is Ethercombing?
Ethercombing is a method used to scan private keys to derive the wallet address associated with the private keys. Blockchain is a public ledger of cryptocurrency transactions that are verified with the use of private or public keys to validate and prove ownership of transaction data. Thus, the blockchain bandits acted on the fact that you can find out a wallet address’s public key if you know its private key.
According to a video interview with Andrian Bednarek by Independent Security Evaluators (ISE), 732 private keys as well as their corresponding public keys that committed 49,060 transactions to the Ethereum blockchain were discovered by Andrian during his research on Ethercombing.
It was during Andrian’s research that he discovered that funds from some of the weak-key addresses are being stolen and sent to a destination address that belongs to an individual or a group. In addition, this group or individual was running an active campaign to compromise private keys and steal funds.
The chat below produced by the ISE showed a process of Ethercombing used by the Blockchain bandits in identifying Ethereum addresses using weak private keys.
The blockchain bandits’ target included only weak and faulty private keys. As explained by Adrian Bednarek, if anyone knows Bitcoin, Ethereum and other cryptocurrency private keys, the associated public address that the key unlocks can be derived. Therefore, the private key allows anyone to transfer the money at that address as though they were the rightful owner.
Cryptocurrency wallets may have a weak private key because of coding errors coming from the software used in generating the keys or less caution from the wallet owner.
The Blockchain Bandits Moves Stolen Funds
After six years, the blockchain bandit’s wallet moves stolen funds that have been dormant. The first transaction to move the funds was made on January 16, 2023, to new addresses and between that date to January 21, 2023, the blockchain bandits have moved almost $90 million worth of 51,000 Ether and 470 Bitcoin to several addresses.
According to a tweet and a report by Chainalysis, the image below shows the movement of the stolen funds, though the addresses were not specifically named. The addresses were generalized as “intermediary addresses”.
Avoid Becoming a Victim of the Blockchain Bandits
Store your funds in trusted wallets that will not generate weak private keysThe movement of the funds by the blockchain bandits shows that this unknown individual or group is still an active bad player in the cryptocurrency space.
To be on the lookout, as a cryptocurrency user, you are advised to adopt best wallet safety practices. Store your funds using trusted personal wallets that will not generate weak private keys. In addition, if you are holding a large amount of cryptocurrencies, it’s preferable to use a cold storage method by using hardware wallets.
A&D Forensics provides you with facts-checked information and events in the cryptocurrency and blockchain industry as they unfold. Stay abreast by subscribing to our newsletters and following our social media platforms.
You can also request for a cryptocurrency investigation here
Contributor: Emmanuel Bassey
