Common Blockchain Vulnerabilities

Predictable seed phrases. Some hardware wallets have been found to use insufficient randomness when generating recovery phrases, making them susceptible to brute-force attacks. "The root cause is the use of insufficiently random or predictable entropy when creating these crucial recovery phrases."

Software flaws in hardware wallets. A significant vulnerability arose when a hardware wallet's firmware improperly used a software-based pseudo-random number generator instead of its secure hardware component. "the code on the device wasn't actually using it, and was using a software-based psuedo-RNG that is predictable if you know enough about the device and have enough brute force computing."

Consequences of weak randomness. This flaw significantly reduces the possible combinations for seed phrases, allowing attackers to guess them in a reasonable timeframe. "With that flaw in place, now instead of taking until the heat death of the universe to guess the generated private keys, it was possible to do it in months/years."

Compromised seed phrases. Storing seed phrases digitally on internet-connected devices, or failing to clear them from clipboards, can lead to direct theft of funds. "I simply used a feature in Cake Wallet that allowed copying the seed phrase to import it into another wallet. Human error happens, and I certainly won’t do it again."

Social engineering and phishing. Attackers often target individual users through phishing scams, malware, or other social engineering tactics to steal credentials. "Because all of the attacks have attacked people and process and not the actual underlying tech."

Poor security practices. Users are vulnerable when they trust centralized exchanges with their funds instead of maintaining control through self-custody or when they make hasty decisions following a perceived threat. "The human is always the weakest link"

Centralized services and smart contract exploits. Many hacks occur in centralized entities like exchanges or through vulnerabilities in smart contracts, which can be poorly designed or audited. "Smart contracts get exploited. Random shit contracts more often than big audited ones but it can still happen."

Bridges between blockchains. Cross-chain bridges, often centralized, represent significant attack vectors. "Bridges are especially vulnerable to this (e.g. Wormhole)."

Misconceptions about blockchain security. While the core cryptography is generally strong, the broader ecosystem has many points of failure that are easier to exploit. "The cryptography of blockchains is not their problem. They are generally very insecure but not because the actual cryptography can -realistically- be broken."