0

There is an official news here.here

Practically speaking this bug is exploited as follows. An attacker first generates a random private transaction key. Thereafter, they modify the code to merely use this particular private transaction key, which ensures multiple transactions to the same public address (e.g. an exchange's hot wallet) are sent to the same stealth address.

what's the monero burning bug attack details?

  • The link you included in your question details the attack. Can you clarify what further details you are asking for please? – jtgrassie Oct 25 '18 at 12:53
  • @jtgrassie I want to know how to generate a random private transaction key,Also insert the key into the detailed source code? I want to reproduce it. – maximmaxim Oct 25 '18 at 14:27
1

Comprehensively detailed here: https://src.getmonero.org/2018/09/25/a-post-mortum-of-the-burning-bug.html

Practically speaking this bug is exploited as follows. An attacker first generates a random private transaction key. Thereafter, they modify the code to merely use this particular private transaction key, which ensures multiple transactions to the same public address (e.g. an exchange's hot wallet) are sent to the same stealth address. Subsequently, they send, say, a thousand transactions of 1 XMR to an exchange. Because the exchange's wallet does not warn for this particular abnormality (i.e. funds being received on the same stealth address), the exchange will, as usual, credit the attacker with 1000 XMR. The attacker then sells his XMR for BTC and lastly withdraws this BTC. The result of the hacker's action(s) is that the exchange is left with 999 unspendable / burnt outputs of 1 XMR

To answer your comments:

I want to know how to generate a random private transaction key

Key generation happens here.

Also insert the key into the detailed source code? I want to reproduce it.

It cannot be reproduced as the bug was patched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.