Major Crypto Wallets Vulnerable to New ‘BitForge’ Zero-Day Exploits

A series of newly revealed vulnerabilities, collectively termed "BitForge," pose a serious threat to leading cryptocurrency wallet providers, including major industry names like Coinbase, Binance and ZenGo.

These vulnerabilities, impacting widely used cryptographic protocols GG-18, GG-20 and Lindell 17, let malicious actors steal cryptocurrency assets within seconds, with no user or vendor interaction.

The flaws were uncovered by the Fireblocks Cryptography Research Team in May 2023 and were publicly detailed in a BlackHat presentation titled "Small Leaks, Billions Of Dollars: Practical Cryptographic Exploits That Undermine Leading Crypto Wallets."

By the time of this presentation, ZenGo and Coinbase had already released patches addressing the vulnerabilities. However, according to Fireblocks, certain wallet providers, notably Binance, remain susceptible to the BitForge exploits.

GG-18 and GG-20, regarded as cornerstones for the multi-part computation (MPC) wallet industry, permit multiple parties to co-sign transactions and generate keys.

One of the vulnerabilities affecting these protocols, CVE-2023-33241, allows attackers to extract key shards in 16-bit chunks. Fireblocks' security advisory stated, "If exploited, the vulnerability allows a threat actor interacting with the signatories in the TSS protocol to steal their secret shards and ultimately obtain the master secret key." The advisory continued, "The severity of the vulnerability depends on the implementation parameters, so different parameter choices give rise to different attacks with varying degrees of effort/resources required to extract the full key."

Lindell 17's vulnerability, CVE-2023-33242, has a similar risk profile, enabling perpetrators to retrieve the complete private key after about 200 signature efforts. This vulnerability could be exploited in two scenarios.

One scenario, as described by Fireblocks, allows threat actors to corrupt the client, forcing it to send commands to the server on their behalf, subsequently revealing chunks of the server's secret key.

In such instances, malicious entities would need at least 256 attempts to collate enough data to rebuild the server's private key. However, the absence of limitations means attackers can execute these attempts rapidly, potentially compromising security swiftly.

In another equally concerning scenario, the client's private key can be extracted using a compromised server, which can also use special messages. Like the first scenario, 256 repetitions are needed for a complete key extraction.

In response to these alarming discoveries, Fireblocks has released a status checker to let users and projects determine their vulnerability to the BitForge exploits due to improper MPC protocol implementation.

This isn't the sole security concern shaking the crypto community in recent times: the Federal Bureau of Investigation (FBI) recently issued a public service announcement (PSA) warning of a rise in scams where threat actors impersonate legitimate project owners. These criminals aim to deceive users, leading to the loss of valuable non-fungible tokens (NFTs) and other cryptocurrency assets.

As the crypto community grapples with these revelations, users are advised to ensure their wallets are updated and to stay vigilant about the latest security patches and updates from their wallet providers.