Introducing Unlukey

After researching vulnerabilities such as Ill Bloom and Coldcard, we found that even when we could generate vulnerable wallet seeds, we had no way to warn the users who were still using them.

Unlukey turns known seed-generation vulnerabilities into datasets that software wallets can use to identify affected recovery phrases and warn their users.

During recovery phrase import

When users import recovery phrases generated by other wallets, wallets can use Unlukey to detect seeds affected by known vulnerabilities and warn users before they continue using them.

The check can be performed without exposing the recovery phrase or blockchain address to a centralized service.

During active incidents

These datasets can also help when a newly discovered vulnerability is being actively exploited. In the incidents we investigated, we observed attackers finding and draining vulnerable wallets over time rather than all at once.

Attackers need to generate vulnerable seed candidates, derive addresses, and check those addresses for funds. This process is more computationally expensive than generating the complete dataset of vulnerable seeds.

The dataset can be completed while attackers are still searching for funded accounts, allowing wallets to identify vulnerable recovery phrases among those previously imported and warn users in time to take action.

Collaborative research

Unlukey is a collaborative research project on weak crypto wallet generation vulnerabilities, with reproducible research and datasets. We plan to reproduce previously discovered vulnerabilities and expand the datasets as new ones are discovered.

For implementation details, visit unlukey.org.