Researchers find that someone has guessed the private keys of some Ethereum users and siphoned off ~45,000 ether from their accounts; low entropy keys to blame
LAST SUMMER, ADRIAN Bednarek was mulling over ways to steal the cryptocurrency Ethereum. He's a security consultant; at the time …
Context & Ripple Effects
Ethereum's losses have rarely come from broken cryptography itself. The record so far runs through implementation and operations: the $50M+ DAO exploit that froze funds and forced a protocol-level debate over recovery, the geth node bug developers patched after researchers warned it let 'any kid with a machine and a script' steal funds (geth vulnerability fix), and the myetherwallet DNS hijack that walked visitors onto an unsigned certificate (DNS rerouting attack).
This report adds a new entry to that list at the weakest possible layer: the keys themselves. Security consultant Adrian Bednarek's work showing that poorly generated, low-entropy private keys can be guessed means some users' funds were effectively public from the moment they were created — no exploit of Ethereum required.
First-order effects
- The holders of those accounts lose roughly 45,000 ether with no recovery path, since a correctly signed transfer from a valid key is indistinguishable from legitimate spending on-chain.
- Wallet and key-generation library maintainers now face immediate pressure to audit their entropy sources, because any weakness in randomness converts every dependent account into a target for brute-force scanning.
Second-order effects
- Custodial services and hardware wallet makers gain a selling point — professionally generated keys — as self-custody users confront the fact that their own tooling may be the failure point, echoing how the geth bug pushed node operators toward patched clients.
- Security auditing firms can extend key-entropy scanning into a product line, since the same technique Bednarek used defensively is cheap enough for attackers to run continuously against the chain.
Third-order effects
- If weak-key generation proves widespread across consumer wallets, the practical burden of cryptographic correctness becomes an argument for consolidation around custodians and vetted hardware — shifting systemic risk from individual key hygiene to the operational security of a few large holders, the same surface exploited in the Bybit multisig compromise.
The trend: Crypto theft keeps migrating down the stack — from smart-contract code to node software to DNS to key generation itself — meaning each hardening of one layer exposes the human-operated layers beneath it.