As the cryptocurrency industry continues to grow and evolve, so do the potential risks and vulnerabilities. In order to stay ahead of the curve, many crypto firms are taking proactive steps to avoid exploits on their platforms. From implementing robust security measures to conducting regular audits, these firms are committed to ensuring the safety and security of their users. Recently, BitGo, a popular cryptocurrency wallet, has recently fixed a crucial vulnerability that could have potentially exposed the private keys of both retail and institutional users.
Fireblocks Becomes a Messiah for Bitgo
In December 2022, the cryptography research team at Fireblocks discovered a significant vulnerability in BitGo’s Threshold Signature Scheme (TSS) wallets. This flaw had the potential to expose the private keys of exchanges, banks, businesses, and platform users, and Fireblocks named it the BitGo Zero Proof Vulnerability.
The vulnerability was found to be particularly alarming as attackers could extract a private key in under a minute using just a small amount of JavaScript code. As a result, BitGo took swift action and suspended the vulnerable service on December 10, 2022. A patch was released in February 2023, and BitGo required client-side updates to the latest version by March 17 to address the issue.
The Fireblocks team revealed how it discovered the exploit by using a free BitGo account on the mainnet. By identifying a missing component of mandatory zero-knowledge proofs in BitGo’s ECDSA TSS wallet protocol, the team was able to expose the private key through a straightforward attack.
To mitigate the possibility of a single point of attack, industry-standard enterprise-grade cryptocurrency asset platforms utilize either multi-party-computation (MPC/TSS) or multi-signature technology. This involves distributing a private key among multiple parties to ensure security controls in case one party is compromised. This approach minimizes the risks associated with holding cryptocurrency assets and helps to avoid potential exploits.
Crypto Market Could Have Witnessed Another Exploit
Fireblocks demonstrated that both internal and external attackers could obtain full access to a private key through two methods.
First, a compromised client-side user could initiate a transaction to obtain a portion of the private key held in BitGo’s system. BitGo would then perform the signing computation and share information that leaks the BitGo key shard, potentially exposing the entire private key. The team said:
“The attacker can now reconstruct the full private key, load it in an external wallet and withdraw the funds immediately or at a later stage.”
The second scenario explores the possibility of an attack in case BitGo is compromised. In this scenario, the attacker would lie in wait for a customer to initiate a transaction and respond with a malicious value. This value would be used to sign the transaction using the customer’s key shard. By exploiting the response, the attacker would expose the user’s key shard and combine it with BitGo’s key shard to gain control of the wallet.
Fireblocks advises users to create new wallets and transfer funds from ECDSA TSS BitGo wallets before the patch, even though no attacks have been executed through this method.
