According to PeckShield’s tweet: “Seems like $950k worth of crypto has been stolen by 0x9731F from Ethereum “vanity address” generated with a tool called Profanity. The exploiter already transferred ~732 $ETH into Mixer.”
A hacker has stolen approximately $950,000 worth of cryptocurrencies from an Ethereum Vanity wallet address generated with a tool called Profanity. The attacker exploited a vulnerability similar to that of the recent $160 million attack on market maker, Wintermute.
This was revealed in an alert issued by blockchain security firm PeckShield, which stated that the hacker stole 732 Ethereum on September 25 before transferring the funds to the cryptocurrency mixer, Tornado Cash.
According to PeckShield’s tweet,
“Seems like $950k worth of crypto has been stolen by 0x9731F from Ethereum “vanity address” generated with a tool called Profanity. The exploiter already transferred ~732 $ETH into Mixer.”
Vanity wallets allow users to customize crypto wallet addresses using words or specific characters selected by the owner. However, as recent exploits have demonstrated, the security of vanity addresses remains in doubt.
Notably, decentralized exchange (DEX) aggregator, 1inch Network, had earlier in September warned community members that addresses generated with Profanity were not secure. The DEX urged cryptocurrency holders with vanity addresses to transfer their assets as soon as possible.
1inch stated that the vanity address generator uses a random 32-bit vector to seed 256-bit private keys, indicating that it is unsafe.
Following the DEX aggregator's warnings, blockchain investigator ZachXBT announced that an exploit of the Profanity vulnerability has already allowed some hackers to cart away $3.3 million in digital assets.
This new attack brings the total loss of DeFi funds in 2022 to more than $1.6 billion.
