Attacking and Defending Blockchains: From Horror Stories to Secure Wallets
summary
Survey of real failures: 2010 Bitcoin overflow fixed in five hours, DAO reentrancy steals tens of millions, Parity library init bug freezes wallets, plus a zero-knowledge coin bug where serial numbers reduce modulo Q and allow reuse. Covers hardware-wallet UX pitfalls, exchanges keeping ~98% cold but often lacking HSMs, IOTA’s custom Curl hash broken by collision attacks, and common integer-overflow and batch-transfer bugs. Emphasizes concrete fixes, exploit methods, and operational mitigations rather than high-level theory.
AI-written summary · about
chapters (31)
- 0:00Intro
- 2:11What's a wallet
- 4:26Hot vs. Cold
- 5:38Different types of wallets
- 5:57Online wallet
- 9:25Online interfaces
- 11:39Mobile wallet
- 14:05Desktop wallet
- 19:03Paper wallet
- 22:47Hardware wallet: not perfect
- 23:31Typical setup for individuals
- 23:53Recommendations
- 24:19Exchanges and wallets
- 25:24Exchanges and hardware wallets?
- 26:45"Warm" wallets
- 27:59Are blockchains secure?
- 28:28Blockchain bugs?
- 28:56Multiple targets
- 29:15Attackers goals
- 30:36Bitcoin overflow (CVE-2010-5139)
- 31:55Ethereum reentrancy (a.k.a. DAO bug)
- 32:05What happened? (simplified)
- 33:10Lessons and solutions
- 34:243. Zerocoin multi-spend
- 36:36Lisk account hijack
- 38:49Parity wallet bug
- 40:07IOTA's hash function
- 43:38Bitgrail withdrawals
- 44:03Batch Overflow
- 45:12Verge
- 45:55BIP32 tools (pt. 1)
related talks
49mHacked Blockchain Projects What we’ve learned
43mOutsmarting Smart Contracts
25mCommSec D2 - Smart Contract (In)Security
46mThe State of Blockchain Security - 2023 Edition
44mCryptography Pitfalls
36mDeciphering Web3 Security: Implications and Innovations
32mWallets Need to be Smarter
29mSecurity of Cryptocurrency wallets/mining