Austin Griffith Shows How Quickly Bots Can Empty Weak Ethereum Keys

Austin Griffith of the Ethereum Foundation demonstrated how exposed weak Ethereum private keys are by sending about $1 to a wallet controlled by the private key 6969. He said on the Oct. 21 episode of Unchained’s co-hosted show Uneasy Money that three pending mempool transactions appeared almost immediately after the funds arrived, each attempting to take the money. Unchained’s review of on-chain data found that 0.0004 ETH, roughly $1, reached the address at 20:35 UTC on Oct. 21 and was moved out in the next block 12 seconds later by a transaction signed with that same key, with most of the deposit consumed by network fees. Griffith said the test was prompted by a security failure at Indian certificate authority eMudhra, where compromised intermediate certificate keys were reported to be simple numbers below 256. He also said every number below 256 already has a nonce on Ethereum mainnet, and Unchained checked all 255 addresses from keys 1 through 255 and found that each had sent transactions. In the same episode, Griffith said 10-digit keys were drained right away, while 12-digit keys had not yet been drained at that point.