Austin Griffith of the Ethereum Foundation sent about $1 to an Ethereum wallet controlled by the private key 6969, and bots moved on it almost immediately. Speaking on the Oct. 21 episode of Uneasy Money, the Unchained show he co-hosts, Griffith said three pending mempool transactions appeared as soon as the dollar landed, each trying to steal the funds.
A private key is the secret number that controls a wallet, so anyone who guesses it can move the assets inside. Griffith said he ran the test after a security failure at eMudhra, an Indian certificate authority.
eMudhra incident set the backdrop for the test
A disclosure site for the incident, set up by Mozilla’s Dennis Jackson, said the keys behind eight eMudhra intermediate certificates created in April 2025 had been compromised. Researcher Scott Helme wrote that each key was a number below 256, and one of them was 4.
Firefox and Chrome blocked the certificates on Oct. 17, the same day the issue was reported. Microsoft followed on Oct. 20. On Oct. 22, after the episode had been taped, eMudhra said it would exit the global SSL/TLS certificate business.
On-chain records show the funds left in 12 seconds
On-chain records reviewed by Unchained show that 0.0004 ETH, about $1, reached the address for key 6969 in a deposit at 20:35 UTC on Oct. 21.
A transaction signed with that same key moved the funds out in the next block, 12 seconds later, and most of the deposit was spent on network fees. Transactions from three other addresses hit the wallet just after that, and two of them failed.
The deposit came from a wallet named slop.atg.eth, which had been funded by austingriffith.eth.
Griffith also said there is no number below 256 that does not already have a nonce, the counter that tracks how many transactions an address has sent. Unchained checked the addresses for all 255 such keys, from 1 through 255, on Ethereum mainnet and found that every one of them had sent transactions.
Griffith also tested longer numeric keys
Before the result came in, Griffith said he expected bots to stop finding keys somewhere between eight and 12 digits. Later in the episode, he said 10-digit keys were drained right away, while 12-digit keys had not yet been drained.
He also said he had seeded a 14-digit key and a 16-digit key, saying he was looking for someone to steal my dollar. Griffith did not disclose those keys, and Unchained said it could not independently verify which ones he used.
On-chain records show that about 14 minutes after the first deposit, slop.atg.eth funded four more addresses. One was emptied within 12 seconds, while three still held their funds as of Oct. 23. The records do not show which key length each address corresponds to.
The hosts said they would check the following week to see whether the 14-digit and 16-digit keys had also been drained.