Browser Vulnerability? Security Concerns for Airdrop Hunters - Dr. DODO is Researching

Last week witnessed a hacking incident where numerous users of the BitBrowser reported having their private keys stolen, sparking concerns about the security of using the BitBrowser. Some speculate that this issue might be linked to the use of the BitBrowser, especially for users who had enabled extension data synchronization. It is advised that immediate action should be taken, such as transferring assets out of affected wallets. BitBrowser is a multi-account management tool that allows users to easily create multiple browser windows and tab pages with different IPs.

Currently, individual users have experienced losses of up to $60,000, with over 3,000 wallets affected and a total loss amounting to $410,000. The official statement from BitBrowser mentioned that the data cache on the BitBrowser server had been compromised, leading to the leakage of private keys and unlawful transfer of assets. They had contacted local law enforcement, and MetaMask has been contacted to freeze the hackers' wallets. However, due to the lack of transparency and prompt crisis management, some users remain skeptical and distrustful of the measures taken by BitBrowser.

As of yesterday, August 29, the Chief Information Security Officer of SlowMist, 23pds, announced on Twitter: "Regarding the situation where numerous BitBrowser users were hacked, we have successfully intercepted a portion of the funds being laundered with our partners. BitBrowser is in the process of filing a report, and once the filing is successful, SlowMist will formally intervene."

Fingerprint Browsers and Airdrop Hunters

For airdrop hunters, preventing the association of multiple accounts has always been a key focus. Apart from the basic isolation of addresses on the blockchain, IP isolation is also an important aspect. Fingerprint browsers were developed to address this need. They allow users to simulate various browser fingerprints, preventing account associations and bans. This technology is particularly useful for businesses involving multi-account operations, such as cross-border e-commerce, social media, and advertising campaigns.

Browser and Wallet Security Concerns

However, it's crucial to note that whether it's BitBrowser or other third-party customized browsers, or similar multi-account management tools, users need to be highly cautious about several security issues:

Security of the Browser or Extension: Many of these browsers are modifications of the Chrome core to cater to specific needs. However, this modification might lead to delays in updating to the latest versions. This time gap in updates could potentially be exploited by hackers who discover vulnerabilities during this period. Users should opt for reputable and highly secure tools and regularly update them to the latest versions.
User's Own Operational Security: Managing private keys is often the first lesson users learn when dealing with cryptocurrencies. However, as time passes, some users neglect its importance due to lack of firsthand experience of being hacked. Private keys must be backed up and never stored online or shared with others. Even though platforms promise encryption, exposing one's financial risks to other people's software is still unwise.
Interactions with Third-Party Services: When interacting with DApps on the blockchain, users must exercise caution to ensure they are using official channels and avoid being misled by phishing websites. While interacting with new protocols, it's necessary to invest extra time to verify endorsements or the legitimacy of the team. Blindly rushing into operations is not advisable.

Author's Perspective

The recent hacking incident involving BitBrowser serves as a warning to all individuals and institutions involved in the cryptocurrency sector, especially airdrop hunters or studios that manage numerous account addresses. These entities must pay strict attention to their information security and private key management. Particularly in third-party server environments, it's recommended to use wallets that don't expose private keys like Account Abstraction wallet or wallets that operate via methods like WalletConnect or Coinbase Wallet which utilize QR code scanning to avoid exposing private keys on third-party platforms.

The response from the BitBrowser team indicates room for improvement in their understanding of blockchain security. Their statement of contacting MetaMask to freeze hackers' wallets is somewhat ironic. When data breaches occur on platforms primarily used by Web2 users, the consequences might not be as dire. However, when the majority of users are Web3 participants, the situation takes on a different significance. For users, establishing comprehensive security mechanisms and contingency plans is essential for long-term survival in this high-risk, high-reward field. After all, losing capital for the sake of airdrop rewards reverses priorities.