wallet seed phrase thing that's going round - do i need to move my coins or is it hype

6

604yvr

New member
Messages
20
Reaction score
14
Points
3
saw a few headlines about a flaw in how some older wallet apps generated their recovery phrases, something about the randomness not being random enough, and now im sat here trying to remember what i even set mine up with. its an app i installed on my phone about four years ago and i've barely thought about it since,its just where my cashouts land
is this an actual thing i need to do something about or is it the usual crypto headline where it turns out nine people are affected. has anyone actually read the detail
 
its real but its narrow, and the detail is the whole thing here so heres what actually happened.

when a wallet creates your 12 or 24 word recovery phrase, those words are supposed to be pulled from a pool so enormous that guessing is hopeless forever. some older wallet software used a weak random number generator to do the pulling. that shrank the pool from astronomical down to a range small enough that somebody could simply work through the entire thing. researchers rebuilt the attack end to end, generated every phrase that weak generator was capable of producing, derived the addresses those phrases lead to, then checked the public chain to see which of them still held funds.

as of the end of june they'd traced a couple of thousand affected addresses with activity on them, spread across bitcoin, eth, tron, polygon and rootstock, and one sweep back in may emptied a few hundred of those. the totals are in the millions, not the hundreds of millions.

so NOT every wallet. specific builds of specific older apps. but if yours is one of them then your phrase has effectively been public since the day it was created, and no pin or password on the app makes the slightest difference to that
 
just make a new adress in the app and send it all to that, thats what i done when i seen it. takes 2 min
 
that does nothing avalon, and this is the important bit for anyone else reading it and thinking the same.
every address in your wallet is derived from the same seed phrase. new address, same seed, same weakness. if the phrase is guessable then so is every single address that comes out of it, including the shiny new one you just moved everything into.
what you need is a NEW wallet, generated fresh by current software, with a new phrase, and then move the funds to that. anything else is rearranging the furniture in a house with no front door
 
correct. and one more thing while people are panicking, don't take my word or anybody elses in here for whether your specific app is affected. the researchers published the list of affected addresses. check your own address against the actual source rather than asking a gambling forum whether your money is safe
 
right so i definitely have a wallet because my mon landed in it in june. but i don't remember ever writing any words down anywhere?? is that even possible or have i just forgotten doing it
 
Tracy is right, and it is worth understanding what it actually means rather than panicking about it.
You can still check your address against the affected list, because that only needs the address. What you cannot currently do is recover that wallet if the phone dies, gets lost, or the app is removed. At the moment those funds exist in one place and one place only.

Go into the app settings today and find the backup or reveal recovery phrase option. Write the words on paper, twice, and keep them somewhere that is not the phone. At twelve pounds this costs you four minutes and teaches you the habit while the stakes are meaningless,which is by far the best time to learn it.
 
@bitvadol turning up to a wallet security thread and discovering hes been one dropped phone away from losing twelve quid this whole time 😂
 
well mine is on paper, two copies, two different places, never photographed and never typed into anything at all. it looks primitive and it is, and thats exactly the point, a piece of paper cant be phished. and honestly the thing that takes most people isnt a clever attack anyway, its somebody polite pretending to be support. that bloke in january who lost a fortune in bitcoin and litecoin handed the phrase over himself to a fake trezor support account. no exploit required, just good manners
 
ay grabe. tanong ko lang ha, mine is saved in my notes app kasi baka makalimutan ko, and i have a screenshot din sa gallery para sure talaga. ok lang ba yun? my phone has a password naman
 
no. that is the single worst place it could possibly be and im not being dramatic for effect. your notes app syncs to a cloud account. your gallery syncs to a cloud account. so your phrase now sits on servers you dont control, protected by an email password that has statistically probably been in a breach at some point, and there are automated tools whose entire job is scanning compromised cloud accounts for anything that looks like twelve words in a row.
the phone password is irrelevant, nobody wants the phone. get it out of the gallery AND out of the recently deleted folder, get it out of notes, write it on paper, and then move the funds to a brand new wallet, because at this point you have to assume that phrase has already been somewhere it shouldnt
 
is always the same story with this technology because they tell you that you are your own bank and this sounds very good and very free but the bank they have the department and the insurance and the telephone number and you have twelve words on a paper in the kitchen drawer and if the paper is gone the money is gone and if somebody else see the paper the money is also gone so yes you are the bank but you are also the security and the customer service and the insurance and the police all together at the same time and nobody explain this part to you when they are telling you to buy the coin they only explain it after, when something already happen
 
ok i generated a fresh wallet on current software last night and moved everything over, and wrote the words down on paper this time instead of leaving it to whatever the app did four years ago. cost me about a dollar in fees and an hour of mild panic
still don't actually know if the old one was affected. checked the address against the list and it wasn't on there, which either means im fine or means im fine so far. moved it anyway
 
looks like its only some of the older wallet apps that are affected and not all of them, and if your address isnt on the list then your basically fine. bit of a nothing burger really
 
You must log in or register to reply here.
Back
Top