since 2 days i am experiencing a hell lot of dust in my
BTC address , i thought it is better to watch it and when any big
BTC amount will come then i will move it , but today just some hours before i saw someone sweeped the coin to some wallet.
can anyone let me know how is this all stuff happening?
reference thread:
https://bitcointalk.org/index.php?topic=1580363.msg15867453#msg15867453Either coinb.in has a bug/problem and generated the same private key twice, you were the victim of an attack during the creating of the private key (maybe a phising website or something), or your pc is compromised (those seem to be the most likely scenarios).
Hi,
Coinb.in developer here.
I think its fairly unlikely coinb.in was compromised and also unlikely that it generated the same private keys twice. I think its most likely you have been compromised. Let me explain why.
Firstly, I have various honey traps setup on the server, one is as big as 20 BTC. If coinb.in had become compromised, I'm very confident I'd have lost those coins and we'd be hearing about it from multiple users (as there are quite a lot) and not just yourself.
Secondly, I'm not convinced that coinb.in key generation code is a problem. I have over 100 BTC generated in addresses from coinb.in. It is unlikely to generate the same keys twice, heres the code:
/* generate a new random private key */
coinjs.newPrivkey = function(){
var x = window.location;
x += (window.screen.height * window.screen.width * window.screen.colorDepth);
x += coinjs.random(64);
x += (window.screen.availHeight * window.screen.availWidth * window.screen.pixelDepth);
x += navigator.language;
x += window.history.length;
x += coinjs.random(64);
x += navigator.userAgent;
x += 'coinb.in';
x += (Crypto.util.randomBytes(64)).join("");
x += x.length;
var dateObj = new Date();
x += dateObj.getTimezoneOffset();
x += coinjs.random(64);
x += (document.getElementById("entropybucket")) ? document.getElementById("entropybucket").innerHTML : '';
x += x+''+x;
var r = x;
for(i=0;i<(x).length/25;i++){
r = Crypto.SHA256(r.concat(x));
}
var checkrBigInt = new BigInteger(r);
var orderBigInt = new BigInteger("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141");
while (checkrBigInt.compareTo(orderBigInt) >= 0 || checkrBigInt.equals(BigInteger.ZERO) || checkrBigInt.equals(BigInteger.ONE)) {
r = Crypto.SHA256(r.concat(x));
checkrBigInt = new BigInteger(r);
}
return r;
}
/* generate random string */
coinjs.random = function(length) {
var r = "";
var l = length || 25;
var chars = "!$%^&*()_+{}:@~?><|\./;'#][=-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890";
for(x=0;x<l;x++) {
r += chars.charAt(Math.floor(Math.random() * 62));
}
return r;
}
As you can see, there are lot of random values used to help with key generation before it is hashed a random number of times. Some values will be more unique than others, but as you can see we are using everything from the screen size, language, date+time, static stings, random data and your mouse positions to generate enough entropy to make a key pair. I've also had this code reviewed by a lot of people.
If anyone has any questions, please feel free to get in touch.
