Every Bitcoin wallet on Android is vulnerable to attack

An exploit in Android makes every Bitcoin wallet app vulnerable to theft.


Curt Hopkins

Internet Culture

Published Aug 12, 2013   Updated Jun 1, 2021, 9:23 am CDT

In another blow to Bitcoin, the digital currency’s developers have announced that a vulnerability in the Android mobile platform puts every wallet developed on it at risk.

Featured Video Hide

A Bitcoin wallet contains a user’s private keys, the codes that both represent the currency and allow you to spend it.

Advertisement Hide

This vulnerability lays popular wallets like Bitcoin Wallet, blockchain.info wallet, BitcoinSpinner and Mycelium Wallet open to possible theft, though none have as yet been reported.

The problem lies with components which govern the way Android’s platform generates strings of secure random numbers.

Developers are encouraging anyone with an Android wallet to do “key rotation” on their account. That is, they should create a new wallet address with a random number generator, then resend all the money in their old wallet to the new one.

Updates are currently being created by the various app makers, according to a thread on Bitcointalk. Updates for Bitcoin Wallet, BitcoinSpinner and blockchain.info wallet have already been released.

Mt. Gox and other exchanges are not affected by the vulnerability, as the numbers governing those transactions are not generated on client mobile devices.

Advertisement Hide

H/T The Verge | Photo by rh1n0/Flickr

Share this article
*First Published: Aug 12, 2013, 10:26 am CDT