Compromised addresses about vanity-eth

[bokub]

I'm closing this issue. Don't hesitate to comment again if you have new details later.

[bokub]

Hello,

Thanks for letting me know, but what do you expect me to do about it?

The two other accounts drained by your hacker have 11 leading zeros, which is too complex to be generated by Vanity-ETH (on my gaming rig, it would take ~25 years to reach a 50% probability of finding one).

My guess is that these addresses have been generated by profanity, which is a lot faster, but known to be unsafe:
https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c

[pegahcarter]

Great question 🙂
All I'm asking is to leave a caveat that there may be a possibility of exploitation and to use at your own risk, given the profanity exploit.

[bokub]

Vanity-ETH doesn't have the issue found in profanity, as you can see in #43. However, it's not a proof that Vanity-ETH doesn't have another unrelated caveat, I agree.

Given the fact that, out of the 300k+ Vanity-ETH users, you're the first ever to complain about a compromised address, I suppose my tool is not the cause and you were simply hacked by another way. There are a few "clones" of Vanity-ETH hosted on similar domains that are not by myself (the only one safe is https://vanity-eth.tk), or maybe your computer has a virus in it, IDK...

However, if other people start having similar problems and post issues about it, then I'll consider adding warnings.

By the way, can I ask you how long it took to generate your address ?

[pegahcarter]

Okay, perhaps my opsec isn't as good as I thought...

I got lucky with that 10 0's address. I was actually mining for a 9 0's address and my computer ran overnight (gpu RTX-2070). When I went to check in the morning, the address mined by sheer chance had 10 0's.