walletgeneratordotnet scam Paper wallet generation scam

[_act_]

I saw this not long ago:

https://www.reddit.com/r/CryptoCurrency/comments/15artmb/redditors_hacked_bitcoin_is_a_lesson_on_the/
https://www.coingabbar.com/en/crypto-shorts-news/redditors-bitcoin-hack-exposes-paper-wallet-perils
https://cointelegraph.com/news/redditor-gets-lesson-after-bitcoin-paper-wallet-hacked

The links are referring to the same Redditor

My Bitcoin was taken. How?" A Reddit user thought they were following best practices until two days ago when their Bitcoin wallet was completely cleaned out.

He said he used a good way to generate a paper wallet. HD wallet was created a very long time why are people still using the unsafe way to generate paper wallet.

There are many HD wallets available that can be used. Example is Electrum.

I checked the site on this forum, it has been known for scam vulnerabily since 2018.

TryNinja, please edit this your 2017 post: https://bitcointalk.org/index.php?topic=2047618.msg20403112#msg20403112

Re: walletgenerator.net, I find no way to verify the download with PGP
Disclosure: Key generation vulnerability found on WalletGenerator.net

It was known to be a good site before, but now it is vulnerable that you will lose your coins if you use the site. I am wondering that someone will not make good research before using those generators. It is not good to even use JavaScript again to generate paper wallet.

To generate a paper wallet, use HD wallet.

How can a scam site like this be taken down?

[cloxy]

 The website walletgenerator dot net was actually sold in 2017. Regardless of that, nobody should have assumed that it was ever safe.

https://www.reddit.com/r/Bitcoin/comments/kullxn/two_out_of_the_top_three_paper_wallet_generation/

https://www.coindesk.com/markets/2019/05/27/researcher-discovers-serious-vulnerability-in-paper-crypto-wallet-site/

https://medium.com/mycrypto/disclosure-key-generation-vulnerability-found-on-walletgenerator-net-potentially-malicious-3d8936485961

The domain resolves to 185.178.208.185 which is in Russia, this IP has been flagged several times for abuse...

https://www.criminalip.io/en/asset/report/185.178.208.185

[LoyceV]

How can a scam site like this be taken down?

Complain to their webhost (after which they'll move) or domain name registrar. It might work.

It's really bad that 2 scamsites have been making victims for many years. Related reading: here.

[Yamane_Keto]

It was known to be a good site before, but now it is vulnerable that you will lose your coins if you use the site. I am wondering that someone will not make good research before using those generators. It is not good to even use JavaScript again to generate paper wallet.

To generate a paper wallet, use HD wallet.

How can a scam site like this be taken down?

You can blame Google, they show these sites as a first search result for words like wallet generator, generate bitcoin address, paper wallet, and they may also tell the user, generate the key offline to ensure that your coins are not stolen.
even open-source wallets can be completely flawed if the entropy that generates the private key or seed is not completely random or is written in pseudo-random.

I don't want to say that there are still people who trust Blockchain.com, atomic wallet and exodus wallet and those are not newbies.

[CODE200]

I'm a bit confused how the scam works so correct me if I'm wrong about what I think it is. Does it mean that the scammers have access to the generated wallet that you generate in the website? I don't lurk too much here so I am not familiar with these kind of scam, I mostly see fake airdrops, social engineering and good old-fashioned pyramid schemes.

I don't get why people use obscure sites to create their wallets, store their bitcoins, to trade and to even gamble, I want to know why? To be different? There's probably more reasonable answer that I can't think of.

[LoyceV]

Does it mean that the scammers have access to the generated wallet that you generate in the website?

From what I've seen, the code is altered to create known private keys, even when used offline. Read my crazy idea (which I never attempted).

I don't get why people use obscure sites to create their wallets

It could have been a trusted site back in the days, until it got sold.

[Pmalek]

You can blame Google, they show these sites as a first search result for words like wallet generator, generate bitcoin address, paper wallet, and they may also tell the user, generate the key offline to ensure that your coins are not stolen.

Google doesn't care, nor do they carry out any research whether certain sites are scams or not. It's also possible to purchase ad space and advertise scams in Google ads to other users. Remember when ChipMixer was still alive and you couldn't find the official website on Google? At the same time, there were loads of phishing sites that appeared on top of the search results. It's the same with other mixers, like Sinbad. The phishing versions aren't the first result, but they still appear close to the top.

[hugeblack]

Is this scam still running ----> Vulnerability discovered on bitcoinpaperwallet[.]com - DO NOT USE IT
paperwallet has a long history of being a bad wallet for the privacy and security of users, even open-source ones may contain backdoors, so it is a good option for developers only and only use those that have been thoroughly reviewed by many developers.
I created the topic above in 2020 and unfortunately this scam site is still working.

[mindrust]

Never ever use these 3rd party services that claim to generate "paper wallets". Paper wallet is nothing but a QR code printed on a piece of paper which has your private key. You can print or hand write your private key on a piece of paper yourself and it will instantly become a paper wallet. Or don't make it this complicated just write down your seed words. That's it.

To generate your seed words/priv keys, you should use a trusted wallet app like electrum/bitcoin core. I personally use electrum and never had a problem.

[albon]

He said he used a good way to generate a paper wallet. HD wallet was created a very long time why are people still using the unsafe way to generate paper wallet.

In the presence of safer alternatives such as hardware wallets and others, the paper wallets that are generated through walletgenerator[.]net or any of the other generator sites are wallets that are not completely secure and scams, and the private keys generated for these wallets fall into the hands of scammers and are generated with the same keys with other users. If the user of these paper wallets generates a wallet for him and deposits his funds, he finds that his funds after a certain time have been transferred and stolen to another wallet.

Many years ago and there are many accusations of scams about the Walletgenerator site. There are many old members who warned against using it, and unfortunately, the domain is still not suspended yet and works well, but Metamask has flagged it as a deceptive site.

Domain Name: WALLETGENERATOR.NET
Registry Domain ID: 1848992026_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Creation Date: March 3, 2014
Update Date: April 26, 2023
Expiration Date: March 3, 2029
Age: 9 years, 149 days
SOURCE: https://www.domainiq.com/domain?walletgenerator.net#/whois

Guys check out this article and report: How and where can I file abuse complaints to Namecheap?

[PX-Z]

To generate a paper wallet, use HD wallet.

Hoe about to users who doesnt have any HD wallets? Just use trusted open source wallet generator and generate wallet address in offline device.

How can a scam site like this be taken down?

Report it on its hosting i checked i uses namecheap. Go submit a ticket -> abuse report -> prohibited/illegal content

I just report the site and referenced the reddits thread and its the news articles.

[The Sceptical Chymist]

It's really bad that 2 scamsites have been making victims for many years.

Jesus, that is bad.  I don't know enough about SEO in order to personally lay blame on Google, but if the original owners had gotten the site to the top of Google's search results for "paper wallet" or whatever keywords caused the site to pop up to the top, the buyer of the site got really lucky and bought a scammer's gold mine.  

And no doubt if the site stays up it'll keep sucking in the newcomers and/or those that don't know enough not to create a paper wallet like that.  It'd be awesome if this thread showed up somewhere near walletgeneratordotnet in search results....any chance that could happen?

[_act_]

It'd be awesome if this thread showed up somewhere near walletgeneratordotnet in search results....any chance that could happen?

Among the search engines, especially Google, it cares more about money not protection or privacy. Google do not care about the people that are using their services. But what can most likely make this occur is if this thread is getting replies from time to time. This would be good for people that make searches like 'is walletgeneratordotnet a scam site or not', but if the person search for something like paper wallet genetor, this is what I found which is the scam site.

[hugeblack]

It'd be awesome if this thread showed up somewhere near walletgeneratordotnet in search results....any chance that could happen?

Among the search engines, especially Google, it cares more about money not protection or privacy. Google do not care about the people that are using their services. But what can most likely make this occur is if this thread is getting replies from time to time. This would be good for people that make searches like 'is walletgeneratordotnet a scam site or not', but if the person search for something like paper wallet genetor, this is what I found which is the scam site.

This is true, but it is not the main reason, the search engines show the sites that were created in the past first^*, and since the site was created on March 3, 2014, it will definitely be first in the search engines, even if it is scam.
I'm going to report them to namecheap and hope everyone does.
* This may not be true in all cases, but even ads are customized based on several factors, and one of the factors is this factor.

[CODE200]

~

From what I've seen, the code is altered to create known private keys, even when used offline. Read my crazy idea (which I never attempted).

I asked my programmer friend the same question, the mf told me that's how custodial wallets work in a condescending tone lmao. Your's though is a sneaky one, no newbie or casual bitcoin enjoyer will check if their private keys are public so it's a goddamn good scam, but good in a vile way though(saying this for legal purposes).

~

It could have been a trusted site back in the days, until it got sold.

Oh, never considered that possibility so thank you! I'm bookmarking that thread for future reference.

This scam is 3 years old already, damn. I wonder how @canton takes it that he sold it to a scammer or it became a scam website.

[yhiaali3]

I'm going to report them to namecheap and hope everyone does.
* This may not be true in all cases, but even ads are customized based on several factors, and one of the factors is this factor.

I also reported, I do not know if these reports are useful and give a good result, but perhaps if there are a large number of them, it will definitely give a positive result, so as you mentioned, I hope everyone reports, not only this fraudulent site, but all suspicious sites. This will help prevent further fraud victims.

[khaled0111]

You can blame Google, they show these sites as a first search result for words like wallet generator, generate bitcoin address, paper wallet, and they may also tell the user, generate the key offline to ensure that your coins are not stolen.
even open-source wallets can be completely flawed if the entropy that generates the private key or seed is not completely random or is written in pseudo-random.

You can try reporting the website to "Google safe browsing": https://safebrowsing.google.com/safebrowsing/report_phish/
Maybe they will remove it from their search results if many people report it.
There is a field where you can explain why you think the reported website is not safe and should be banned.

[PX-Z]

This is true, but it is not the main reason, the search engines show the sites that were created in the past first^*, and since the site was created on March 3, 2014, it will definitely be first in the search engines, even if it is scam.

This is not always the case. There are many factors that affect to make a site in the first place/rank in the search engine page. The scam site is well written with lots of keywords on it, especially the FAQ that always give users information which make google thinks that its a well quality page, back links, plus its domain age.

I report it on namecheap as well as what i mentioned above, i hope people will mass report it too.

You can try reporting the website to "Google safe browsing": https://safebrowsing.google.com/safebrowsing/report_phish/
Maybe they will remove it from their search results if many people report it.

It's not a phishing site, so google wont prioritize to remove it. Well, i hope so, but its better to report it on their registrar — namecheap.

[LoyceV]

You can try reporting the website to "Google safe browsing": https://safebrowsing.google.com/safebrowsing/report_phish/

I haven't seen a result from those reports in years. Google doesn't care, and I gave up.

Maybe they will remove it from their search results if many people report it.

Reporting bad sites shouldn't be a petition that needs to be signed many times.

[_act_]

You can try reporting the website to "Google safe browsing": https://safebrowsing.google.com/safebrowsing/report_phish/

I haven't seen a result from those reports in years. Google doesn't care, and I gave up.

Maybe they will remove it from their search results if many people report it.

Reporting bad sites shouldn't be a petition that needs to be signed many times.

But this is not only about Google, the site needs to be taken down. I use other search engines just now and I even try it on tor but the same scam site is what I am seeing as first on the search engines including duckduckgo. The government were able to take down mixers but unable to taken down these scam paper wallet generator websites.

Not that I am supporting google too, google services are the places where scammers and hackers are living and successfully doing their work.

[hugeblack]

There is a field where you can explain why you think the reported website is not safe and should be banned.

You will not get a quick result, as the site looks legal and similar to closed-source wallets that generate an old private key for the user. From our point of view, it is a scam service, as any Bitcoin that is sent to that address will be withdrawn to scammer’s wallet, but from Google’s point of view it is a service. If it was legal, it would explain to users the risks involved.
Also, removing such content just because of reports may be abused by competitors in different scenarios.

[LoyceV]

If it was legal, it would explain to users the risks involved.

It does "explain" the risks:

To be more secure, you should download this wallet generator from your browser and run it offline.

That text was there long before the site was bought by a scammer who compromised the offline version. It also shows "We" as if it's the same owner, and endorsements from long lost times.

[Synchronice]

You can blame Google, they show these sites as a first search result for words like wallet generator, generate bitcoin address, paper wallet, and they may also tell the user, generate the key offline to ensure that your coins are not stolen.

Google doesn't care, nor do they carry out any research whether certain sites are scams or not. It's also possible to purchase ad space and advertise scams in Google ads to other users. Remember when ChipMixer was still alive and you couldn't find the official website on Google? At the same time, there were loads of phishing sites that appeared on top of the search results. It's the same with other mixers, like Sinbad. The phishing versions aren't the first result, but they still appear close to the top.

It worth to say that I tried to visit WalletGenerator.net from popular browsers right now and all of them gave me a warning that it's a fraud website.

You can try reporting the website to "Google safe browsing": https://safebrowsing.google.com/safebrowsing/report_phish/

I haven't seen a result from those reports in years. Google doesn't care, and I gave up.

Maybe they will remove it from their search results if many people report it.

Reporting bad sites shouldn't be a petition that needs to be signed many times.

It's not a petition but is very logical that the more reports they have, the higher the chance of taking the case seriously because tons of websites are reported every day by bots and spammers for no reason, so, how can google take care of each reports if it doesn't take the number of reports in consideration?

If it was legal, it would explain to users the risks involved.

It does "explain" the risks:

To be more secure, you should download this wallet generator from your browser and run it offline.

That text was there long before the site was bought by a scammer who compromised the offline version. It also shows "We" as if it's the same owner, and endorsements from long lost times.

The scammer is very clever, played perfectly with words and the advice of generating it offline via downloaded website. By the way, problem is that even when I first typed paper wallet, my results were articles about these online paper wallet generators and now I understand that a lot of people don't do research and trust the first information that they get on Google.

[Pmalek]

The government were able to take down mixers but unable to taken down these scam paper wallet generator websites.

Mixers are a problem to the governments because being able to mix gives you certain freedoms they don't wish you to have. The perfect citizen isn't anonymous. He is an open book they can peek into whenever needed. Anything that enables freedom, privacy, and anonymity is, therefore, a threat. And threats need to be handled with swiftly. To protect the nation, of course. Saying the service was used for money laundering and financing terrorism is the perfect cover. Luckily, such things were never and will never be possible with their banking buddies who do everything by the book.

They don't care if people get bitten by fake wallet generators. It just means more users will get disappointed with Bitcoin and will go back to traditional finance where they have greater oversight.

[_act_]

It worth to say that I tried to visit WalletGenerator.net from popular browsers right now and all of them gave me a warning that it's a fraud website.

Non of them gave me a warning. The popular ones like Chrome, Edge do not care about privacy and security and they do not give me any warning . Also other browsers are not giving me any warning.

It's not a petition but is very logical that the more reports they have, the higher the chance of taking the case seriously because tons of websites are reported every day by bots and spammers for no reason, so, how can google take care of each reports if it doesn't take the number of reports in consideration?

Are you saying it is hard for those registers and Google and other search engines to do their work appropriately? Especially Google and those other search engines do not care about their users.

Some people may be holding for a very long time and not knowing their coins has been stolen immediately they use that scam paper wallet generator.

[_act_]

Pump

[Tempsnake10]

I made paper wallets on this website a few years ago. The safest way possible (I though, back then), doing it offline etc.
I got stolen this year :/
BTC went to a non-KYC exchange (tradeogre), so I don't think I'll see them again, but I'm in if people gather to prosecute that website's operator?

[Bitcoin_Arena]

It's ridiculous how the website is still online even when some members reported the domain to Namecheap for fraud over 6 months ago
What the hell is the point of the report option then if Namecheap doesn't even do anything?

And now we have more victims

I made paper wallets on this website a few years ago. The safest way possible (I though, back then), doing it offline etc.
I got stolen this year :/
BTC went to a non-KYC exchange (tradeogre), so I don't think I'll see them again, but I'm in if people gather to prosecute that website's operator?

Sorry about the loss of funds, but how do you plan to prosecute a ghost website operator you have never seen or arrested?

[Saint-loup]

I made paper wallets on this website a few years ago. The safest way possible (I though, back then), doing it offline etc.
I got stolen this year :/
BTC went to a non-KYC exchange (tradeogre), so I don't think I'll see them again, but I'm in if people gather to prosecute that website's operator?

It's a sad story like the one of OP but unfortunately it's not a surprising one. Many reputed users here heavily insist on the offline/air gapped device point without talking about entropy while it is one of the main vulnerability of wallets since many years. If there is a bug created voluntarily or not into the RNG code of your wallet, generating your seed/key and using it at the top of the Himalayas or in the middle of the Sahara won't protect your funds. That's why a physical source entropy/randomness is primodial unlike what many people think.
Bitaddress at least invites people to use physical dices.

How do I make a wallet using dice? What is B6?
An important part of creating a Bitcoin wallet is ensuring the random numbers used to create the wallet are truly random. Physical randomness is better than computer generated pseudo-randomness. The easiest way to generate physical randomness is with dice. To create a Bitcoin private key you only need one six sided die which you roll 99 times. Stopping each time to record the value of the die. When recording the values follow these rules: 1=1, 2=2, 3=3, 4=4, 5=5, 6=0. By doing this you are recording the big random number, your private key, in B6 or base 6 format.