1

A while ago I found website ethersecret.com which turned out to be very interesting; it provides a search engine for ethereum private keys and their corresponding addresses and whether they hold any ether on them. The downside is that the odds of finding an address with transactions, let alone some eth in it are almost impossible because of statistics.

However, digging a bit I found that most of the the addresses within the first pages had transactions. So I decided to write a simple script to do some tests. The script transferred any incoming eth into these addresses, which some of them received almost daily.

Whenever a transaction came in it would be sent out to another address by a third party pretty much immediately, just 2 blocks after the eth arrived. And then I noticed:

enter image description here Some of the accounts held some tokens, and a decent amount of them, but etherscan didn't show that these tokens held any actual value. I modified the script to see if I could use whatever eth that came into the account as gas to get the tokens out, but whoever was and is on the other side is faster and always takes the eth before any other transaction can take place and always outbids other transactions. So I eventually stopped trying to figure out what was going on.

But today, I opened for some reason ethersecret.com and it shows the following: enter image description here

Which is the weirdest thing, because the script that whoever was running always left the accounts in 0 balance, but now for whatever reason a tiny amount of eth is left in them.

My theory is that whoever was on the other side tricked people into sending eth to get these fake tokens out and their script was really good so they would extract all incoming eth at any cost. They used these private keys because they are actually "obvious", and now they are trying to bait even further.

I wonder if it could be the same people who wrote the ethersecret.com website.

Does anyone has any idea of what's actually going on with these "obvious" private keys?

  • 1
    If you take a look at the last operations in those accounts, usually after someone send ethers immediately someone else tries to withdraw using a really huge gas price. It should be pretty easy for a miner to automate detection of transfers to that address and to generate the immediate withdrawal. This only works if the balance is large enough to pay for the transaction. I've seen a security talk about trying to break 'weak' private keys in bitcoin, one of their tests was with the keys 1, 2, 3... and they found someone else was already doing that automatically for a very large number of keys. – Ismael Mar 18 '18 at 20:56
  • @Ismael indeed, its what I tried but whoever is on the otherside manages to outbid outgoing transactions, no matter if he/she uses 90% of balance to pay the gas – Victor Mar 19 '18 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.