Blender Wallet – non-custodial anonymous crypto wallet with built-in mixer

[SFR10]

June 22, 2021 – Non-custodial crypto wallet Blender Wallet has been hacked. The hackers withdrew the amount of 100 BTC in total.

Never expected for such a thing to happen, but I guess I was wrong ^{[I feel sorry for those that were affected by the incident in question]}... I'm not a coder/developer by any means but my gut tells me to lean more towards this hack being an inside job of some sort that intentionally left backdoors and just triggered it recently ^{[I hope I'm wrong]}.
I'm surprised that none of the affected users have posted anything so far ^[AFAICS].

[1714162553]

1714162553

[1714162553]

1714162553

[1714162553]

1714162553

[dkbit98]

100 BTC or currently over $3,3 million stolen, and this is what Blender team claims on their telegram channel:

User's passphrases and passwords were not stored in our databases, however, at the moment they are considered compromised, please do not use the addresses generated from these phrases and do not send anything to them.

https://t.me/BlenderWalletio_English/5

My question is how can passphrases be compromised if they are not stored in Blender's database?

I think that alleged hackers address should be posted in public with more explanation and clarification, but nobody should use Blender service and wallet for now.

[Chikito]

June 22, 2021 – Non-custodial crypto wallet Blender Wallet has been hacked. The hackers withdrew the amount of 100 BTC in total.

100 Btc in one person or accumulate?. I see you begin signature service today and your website can't use for the transaction also, just giving information about how to claim during the attack. I hope all fine and all balance users can be returned. Good to see you have responsibility.

[BlenderWallet]

We have started fund returning. If your funds were stolen from Blender Wallet, please contact support for compensation.
JABBER: blenderwallet@jabb.im
E-mail: blenderwallet@tuta.io

[fahq]

We have started fund returning. If your funds were stolen from Blender Wallet, please contact support for compensation.
JABBER: blenderwallet@jabb.im
E-mail: blenderwallet@tuta.io

Looking forward to my guys hearing some good news tomorrow!

[user345697]

Hi, im very sorry to hear my favourite service got hacked This is second time i lost my money on mixers. Before i lost big money on bitcoin blender. Will it be back online after some security maintenance?
I also lost about 5k$ ... can You refund me please?
Yesterday i wrote to email and jabber but no reply yet.

Today i used mixer and it still worked ok for me.

[BlenderWallet]

Hi, im very sorry to hear my favourite service got hacked This is second time i lost my money on mixers. Before i lost big money on bitcoin blender. Will it be back online after some security maintenance?
I also lost about 5k$ ... can You refund me please?
Yesterday i wrote to email and jabber but no reply yet.

Today i used mixer and it still worked ok for me.

We are continuing compensation process, please check your accounts. We will really appreciate, if you write in this topic, when you receive your bitcoins back.

Of course, Blender Wallet will come back after fixing security leaks. Please, stay tuned.

[BlenderWallet]

How was this possible if it's a "non-custodial wallet"? Please elaborate...
Requesting the seed phrases and passwords from your users to be sent without encryption to an email address that might be compromised sounds highly suspicious.

Investigation process is still taking place. After all researches, we will come back and write in details how that happened. Please, be patient.

[fahq]

We are continuing compensation process, please check your accounts. We will really appreciate, if you write in this topic, when you receive your bitcoins back.

Of course, Blender Wallet will come back after fixing security leaks. Please, stay tuned.

Hope you guys get everyone taken care of and the wallet back open. As far as online wallets goes, yours is probably one of if not the best on the market!

[fahq]

Both of my guys have/are being taken care of. I would not hesitate to continue directing people to their service. They're a stand up operation!

[LoyceV]

June 22, 2021 – Non-custodial crypto wallet Blender Wallet has been hacked. The hackers withdrew the amount of 100 BTC in total.

As a non-custodial service, Blender Wallet doesn’t store data about users on servers. The Blender Wallet team has immediately disabled registration and access to the wallets to  protect users’ funds and make sure that newly generated seed phases won’t get in hacker’s hands.The executives promise to cover the losses from Blender Mixer’s reserves. Every user who has lost the money due to the hack will get the exact amount of money on their balance. Further information on compensation will be available at https://blenderwallet.io and @BlenderWalletio_English Telegram channel.

“Over the course of investigation, we promise to figure out how hackers managed to hack a non-custodial solution, as we don’t store any data granting access to users’ balances on our servers. We initiated an internal investigation. The details of how hackers got access to users’ funds are still unclear,” commented the officials. "The whole crypto community, be it a regulated exchange or a mixer, should deploy all the forces against cybercrime, as it's users who get affected in the first place. And as a service we must do whatever we can to protect funds that we've been entrusted with."

WARNING
I've just created BlenderWallet phishing attempt?:

https://blenderwallet.io/en/:

The procedure for receiving a refund:

    Send your seed phrase and password (if you used one) to the blenderwallet@tuta.io or to the jabber blenderwallet@jabb.im

This should ring all possible alarm bells! What if their non-custodial wallet wasn't hacked, but their accounts are? It sounds like a perfect phishing scenario to ask users for their seed phrase and steal there funds! Even if the hacking story is true, there are better ways to prove ownership than sending the seed phrase.

I've left BlenderWallet negative feedback as a warning for now. Better safe than sorry.

At least verify if your funds are actually gone before sending your seed phrase!

[user345697]

June 22, 2021 – Non-custodial crypto wallet Blender Wallet has been hacked. The hackers withdrew the amount of 100 BTC in total.

As a non-custodial service, Blender Wallet doesn’t store data about users on servers. The Blender Wallet team has immediately disabled registration and access to the wallets to  protect users’ funds and make sure that newly generated seed phases won’t get in hacker’s hands.The executives promise to cover the losses from Blender Mixer’s reserves. Every user who has lost the money due to the hack will get the exact amount of money on their balance. Further information on compensation will be available at https://blenderwallet.io and @BlenderWalletio_English Telegram channel.

“Over the course of investigation, we promise to figure out how hackers managed to hack a non-custodial solution, as we don’t store any data granting access to users’ balances on our servers. We initiated an internal investigation. The details of how hackers got access to users’ funds are still unclear,” commented the officials. "The whole crypto community, be it a regulated exchange or a mixer, should deploy all the forces against cybercrime, as it's users who get affected in the first place. And as a service we must do whatever we can to protect funds that we've been entrusted with."

WARNING
I've just created BlenderWallet phishing attempt?:

https://blenderwallet.io/en/:

The procedure for receiving a refund:

    Send your seed phrase and password (if you used one) to the blenderwallet@tuta.io or to the jabber blenderwallet@jabb.im

This should ring all possible alarm bells! What if their non-custodial wallet wasn't hacked, but their accounts are? It sounds like a perfect phishing scenario to ask users for their seed phrase and steal there funds! Even if the hacking story is true, there are better ways to prove ownership than sending the seed phrase.

I've left BlenderWallet negative feedback as a warning for now. Better safe than sorry.

At least verify if your funds are actually gone before sending your seed phrase!

Everything is ok. First i thought too that it may be phishing (or someone kidnaped owner, and told him to do so...hahaha ), but today they refunded me. I hope blender walltet will be back online and fix security issues, because for me it was best darknet wallet + mixer.

[LoyceMobile]

The "vouches" from newbies are a big red flag too.

[user345697]

The "vouches" from newbies are a big red flag too.

Lol yes... i just registered to write that post. Before i had no need to write on this forum. If i show You secreenshot that they refunded me, You will still say that its fake.
I am happy they refunded me... they could just disapear like bictoinblender. For me service is legit and it was real hack. But let's wait for the development of events.

[LoyceV]

If i show You secreenshot that they refunded me, You will still say that its fake.

No, I'd say it proves nothing. I can't know if a screenshot is real of fake, so it has no value.
If you want to prove anything Bitcoin-related, sign a message.

[BlenderWallet]

On June 19-22, an attack was made on our blenderwallet.io service, as a result of which an amount of about 100 btc was withdrawn from users' wallets. Here are transactions of thefts:

    6fb4f29727462b0968e406033a22055ccd19957d693e060517984718df801c52
    2c0dc84c4fcb631789e3643fa1c188d00a0f082ae680f2dabef73b96175d929a
    38bbab7b5754023b0644ffa67aa65877ab703fa797058ca4b6d61fc3915c22ba
    3c81dcca1573cd5b2ab183ac83f92f8bc840d5375008c9c79f18d3332dcc81c4
    6ec1a02c3e3d2aae0f27783c572022b3c22c67592effba3560bad86f4892186a
    6fb4f29727462b0968e406033a22055ccd19957d693e060517984718df801c52
    ae347ed9479f952970180a36810f71388b81cfab6a0466221890d4578bb5e179
    b00cc79594fdcff65ad06123b348d178a65f67091d3a9deabb42e52e9b461484
    cde86222c6ec7f177a1f97e953f20561703f66a1021e204d72e0674f525ee989
    dca5f645bf6136891ffa1a817fb623e460a8fafa8c873180a59fc3f5bf776cff
    e07e83f1968a36277a80b093d05cfc1239f86e9de04754d38017fd1afd36ff2d
    fda9739ec2c5d6b39242a7a982c68b756e3c0fafcbb7c43a21cdb56fd280f904
    46e4b62e354ab7b0b7d0847e670b4107c847f1b14d33815e9ce70e240ee339b2
    35d8c7e390626299db91bc7dd70cca7b84207b020836493692bb8e3ee137df43
    726edf2a9eecaaade9226a75ddd2215d6aaf60a12e504822f6aecdd5eef90de7
    671760b9d8aa9354840c1d45e18bfd13dec56eca3914885efa43ae9ab94d0c90
    34f5274fab7e7d1f87e99a3f8e53fba74507e52f5807083d513a7956d494e29c
    27854ebe3a88ec182fe36c2e9f72dd234b235e8b779a3447c0cf4956b184c6e8
    f56f57883c84d7161b9fa70829aa125d972573c52954661a7d3d1611566adbd2
    f76c6e22c3de32089afa6c12315be3582aab7419279a0028f2085e4251881173


After the incident, we conducted an internal investigation, which resulted in the conclusion that such an attack could only be carried out by having access to the servers and the hosting account where the Blender Wallet servers were located. We have passed the information to the hosting and expect cooperation from them.

At the moment, we are working on improving the architecture of the Blender Wallet. The estimated launch date is October 2021.

[BlenderWallet]

Non-custodial crypto wallet Blender Wallet released an updated version and resumed its work. The updated Blender Wallet comes with brand-new features and skyrocketed security.

What’s new?

All seed phrase-related operations are now happen on the client’s side
To ensure Blender Wallet’s higher security, a mnemonic phrase and a password (extension of the mnemonic phrase) will be stored on a user’s device (either in a local storage or as a file). The process of transaction signing will now take place on a client’s side too, while any type of sensitive data won’t be stored on the server. Security elevated!

Local storage encryption. To store securely all wallet-related information, local storage will be encrypted and protected with the help of a separate password. It allows getting access to the wallet without using a seed phrase. All you need is a storage and password.

Blender Wallet: it’s a non-custodial BTC wallet focused on user privacy. Blender Wallet has been launched in 2020 by the same team that had development blender.io –Bitcoin mixer existing on the market since 2017.

Key Blender Wallet’s features:
– Canceling unconfirmed transactions. A built-in RBF (Replace-by-fee) feature allows canceling unconfirmed transactions mistakenly sent to a wrong address or just transactions that stuck in the mempool awaiting confirmation.
– Speeding up the incoming and out coming transactions
– Built-in mixer – a solution developed by the blender.io team which allows sending mixed money right from Blender Wallet.
– Address control. Blender Wallet allows you to send BTC from manually picked addresses, add several senders’ addresses and freeze addresses (meaning you mark them as unused while sending the money).
The team will keep informing you about the upcoming updates. Stay tuned for new updates!

[dkbit98]

All seed phrase-related operations are now happen on the client’s side

How can this claims be verified, and is there a way to generate mnemonic phrase offline that can later be used with Blender Wallet?

Local storage encryption. To store securely all wallet-related information, local storage will be encrypted and protected with the help of a separate password. It allows getting access to the wallet without using a seed phrase. All you need is a storage and password.

Can you tell us what type of encryption are you using exactly?
Bad encryption can sometimes be just as bad as having no encryption.

Blender Wallet: it’s a non-custodial BTC wallet focused on user privacy. Blender Wallet has been launched in 2020 by the same team that had development blender.io –Bitcoin mixer existing on the market since 2017.

Are there any plans to release Blender wallet app that can be downloaded and run from computer instead of using web browser?

[ABCbits]

All seed phrase-related operations are now happen on the client’s side

How can this claims be verified, and is there a way to generate mnemonic phrase offline that can later be used with Blender Wallet?

Unless it's open source, it's not easy to verify it unless you pay experienced auditor (with JavaScript/cryptography expertise). Additionally, this wallet isn't compatible with BIP 39 (i tried it with result from https://iancoleman.io/bip39). So there's concern you can't restore access to your coin if the service is down/dead.

[BlenderWallet]

All seed phrase-related operations are now happen on the client’s side

How can this claims be verified, and is there a way to generate mnemonic phrase offline that can later be used with Blender Wallet?

Local storage encryption. To store securely all wallet-related information, local storage will be encrypted and protected with the help of a separate password. It allows getting access to the wallet without using a seed phrase. All you need is a storage and password.

Can you tell us what type of encryption are you using exactly?
Bad encryption can sometimes be just as bad as having no encryption.

Blender Wallet: it’s a non-custodial BTC wallet focused on user privacy. Blender Wallet has been launched in 2020 by the same team that had development blender.io –Bitcoin mixer existing on the market since 2017.

Are there any plans to release Blender wallet app that can be downloaded and run from computer instead of using web browser?

1. The client-side code of Blender Wallet is not obfuscated and can be reviewed by anyone with technical skills. You can check what happens on the client side and what is being sent on server. Speaking of offline generated passphrases, this feature is related to import and we are working on it.

2. Blender wallet uses AES-GCM algorythm for storage encryption with 256-bit AES key.

3. No. Right now we are not working on that task.

All seed phrase-related operations are now happen on the client’s side

How can this claims be verified, and is there a way to generate mnemonic phrase offline that can later be used with Blender Wallet?

Unless it's open source, it's not easy to verify it unless you pay experienced auditor (with JavaScript/cryptography expertise). Additionally, this wallet isn't compatible with BIP 39 (i tried it with result from https://iancoleman.io/bip39). So there's concern you can't restore access to your coin if the service is down/dead.

Defines a generation of recovery phrase and it's conversion into a binary master seed of an HD wallet.
https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki