Researchers find security flaws in popular cryptocurrency wallets

Crypto fans need to be extremely cautious with their holdings

Digital asset infrastructure corporation Fireblocks has disclosed that more than 15 leading online crypto wallet providers have serious vulnerabilities that could potentially put millions of customer accounts at risk. Crypto fans should take note and protect their assets more than ever.

Fireblocks said in an August 9 press release that the string of vulnerabilities, called BitForge, is impacting wallets using multi-party computation (MPC) technology, allowing multiple parties to oversee and manage crypto holdings.

Disclosed as “zero-day” vulnerabilities, the issues are flaws the projects had not previously recognized. According to Fireblocks, vulnerabilities that affected Coinbase, Binance, and Zengo were recently fixed, and the firm has reached out to more than a dozen other crypto wallets still at risk.

The report states, “If left unremediated, the exposures would allow attackers and malicious insiders to drain funds from the wallets of millions of retail and institutional customers in seconds, with no knowledge to the user or vendor.”

Coinbase’s Chief information security officer at Coinbase, Jeff Lunglhofer, thanked Fireblocks for recognizing and responsibly publicizing the issue, saying that Coinbase customer funds were not at risk. Zengo Chief Technology Officer Tal Be’ery reassured customers that the problem was fixed and no user wallets were vulnerable.

MPC wallets encrypt a user’s private key, which is shared among several parties: the wallet owner, a wallet provider, and a third party. No single entity should be authorized to unlock the wallet without communication with the other parties.

However, BitForge vulnerabilities would have permitted hackers to “extract the full private key if they could compromise only one device,” according to Fireblocks technical reports.