Fireblocks Uncovers ‘BitForge’ Vulnerabilities Posing Threat to Major MPC Wallets

Crypto infrastructure company Fireblocks has identified a set of vulnerabilities known as “BitForge” that pose a threat to popular crypto wallets that use multi-party computation (MPC) technology. 

These vulnerabilities were classified as “zero-day,” meaning they were unknown to the developers of the affected software before Fireblocks disclosed them, the company said in a Wednesday press release. 

Major companies such as Coinbase, ZenGo, and Binance have worked with Fireblocks to address the vulnerabilities and prevent potential exploits. 

In the announcement, Fireblocks said the attackers could have used the vulnerabilities to drain funds from the wallets of “millions of retail and institutional customers in seconds, with no knowledge to the user or vendor.”

Generally, to exploit these vulnerabilities, an attacker would need to compromise a wallet user’s device or break into the internal systems of the wallet service or a third-party custodian with access to a piece of the encrypted private key. 

The specific steps depended on the wallet being used.

Fireblocks has also identified other teams that might be impacted and has reached out to them through the industry-standard 90-day responsible disclosure process.

Fireblocks CEO Michael Shaulov said that although the vulnerabilities could have been exploited, the complexity of the attacks made it unlikely that they were discovered by malicious actors before Fireblocks disclosed them.

BitForge Vulnerability Undermines Security of MPC Wallets

While the vulnerabilities may have been patched in major wallets, the incident raises concerns about the safety of supposedly ultra-safe multi-party computation (MPC) wallets. 

MPC technology in crypto wallets was designed to eliminate single points of failure by splitting a user’s private key across multiple parties, such as the wallet user, the wallet provider, and a trusted third party. 

No single entity can unlock the wallet without assistance from the others. 

However, the BitForge vulnerabilities would have allowed a hacker to extract the full private key if they compromised just one device, undermining the multi-party aspect of MPC.

Coinbase stated that its user-facing wallet service, Coinbase Wallet, was not affected, but its Wallet-as-a-Service (WaaS) offering was technically vulnerable before the company implemented a fix. 

Coinbase claimed that the vulnerabilities discovered by Fireblocks would have been extremely difficult to exploit in its case, as it would require a malicious server within Coinbase’s infrastructure to trick users into initiating numerous authenticated signing requests.

“While Coinbase customers and funds were never at risk, maintaining a fully trustless cryptographic model is an important aspect of any MPC implementation,” Jeff Lunglhofer, chief information security officer at Coinbase, said. 

Likewise, Binance CEO Changpeng Zhao has revealed that the issue “was present in the TSS Library Binance open-sourced,” which has been fixed.