The latest attack on vanity wallet address results in a loss of around $1M

Another vanity wallet address with a loss of almost $1 million has been added to the list of decentralized finance (DeFi) victims, who have lost a total of more than $1.6 billion during several hacks and attacks this year, which continue to infect the sector.

According to a warning issued by blockchain security company PeckShield, a hacker was discovered after taking 732 Ether (ETH), or roughly $950,000, from an address made using the Profanity Ethereum vanity wallet address generator. After emptying the wallet, the exploiters moved the cryptocurrency to the recently-sanctioned Tornado Cash, an Ethereum-based crypto mixing platform.

#PeckShieldAlert Seems like $950k worth of crypto has been stolen by 0x9731F from Ethereum “vanity address” generated with a tool called Profanity. The exploiter already transferred ~732 $ETH into Mixer pic.twitter.com/QOZfnE49H4

— PeckShieldAlert (@PeckShieldAlert) September 26, 2022

Are vanity addresses safe?

It is important to note that vanity addresses are personalized crypto wallet addresses generated using words or character combinations that the owner chooses. However, the safety of vanity addresses is still in doubt, as shown by recent vulnerabilities.

Interestingly, a few weeks back, decentralized exchange (DEX) aggregator 1inch Network alerted community members that addresses generated with profanity were not secure. The DEX urged cryptocurrency owners with vanity addresses to move their holdings right away. The vanity address generator is unsafe, according to 1inch, because it seeded 256-bit private keys with a random 32-bit vector.

Following the DEX aggregator’s alerts, blockchain investigator ZachXBT revealed that some hackers had already managed to escape with $3.3 million worth of digital assets via an attack of the Profanity bug.

The United Kingdom-based crypto market maker faced an exploit on September 20 that cost it $160 million. Ajay Dhingra, a researcher, speculates that the vulnerability may have resulted from the firm’s hot wallet being compromised and used to manipulate a smart contract vulnerability. The CEO and creator of the company, Evgeny Gaevoy, issued a call to the attackers to get in touch if they are interested in treating the flaw as a white hat hack.