Share this article
Researcher Discovers Serious Vulnerability in Paper Crypto Wallet Site
If you have cryptocurrency in a paper wallet from WalletGenerator.net you'd best pull it off.
By John Biggs
Updated Sep 13, 2021, 9:14 a.m. Published May 27, 2019, 5:00 p.m.
Make us preferred on Google
A security researcher from MyCrypto.com, Harry Denley, has posted a detailed – and damning – analysis of paper wallet site WalletGenerator.net.
The core of the analysis hinges on WalletGenerator's original open-source code, available here. Until August 17, 2018 the online code matched the open-source code and the entire project generated wallets using a client-side technique that took in real random entropy and produced a unique wallet. But sometime after that date the two sets of code stopped matching.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
The result? The very real possibility that WalletGenerator is giving the same keys to multiple users. To test this, MyCrypto's researcher ran the generator in bulk and got some odd results.
"Approaching from a different angle, we then used the “Bulk Wallet” generator to generate 1,000 keys. In the non-malicious, GitHub version, we are given 1,000 unique keys, as expected.
However, using WalletGenerator.net at various times between May 18, 2019 — May 23, 2019, we would only get 120 unique keys per session. Refreshing our browser, switching VPN locations, or having a different party perform the same test would result in a different set of 120 keys being generated."
While the odd behavior was not found as of last Friday (May 24), it could be return at any time.
"We’re still considering this highly suspect and still recommending users who generated public / private keypairs after August 17, 2018, to move their funds," the researcher says. "We do not recommend using WalletGenerator.net moving forward, even if the code at this very moment is not vulnerable."
You can read the entire report here, but Denley recommends moving funds off of your WalletGenerator-based paper wallets. As there is no clear way to contact the "two random guy [sic] having fun with a side project" who apparently run the site, we can safely recommend you avoid the site altogether.
Code image via Shutterstock
More For You
KuCoin captured a record share of centralised exchange volume in 2025, with more than $1.25tn traded as its volumes grew faster than the wider crypto market.
What to know:
- KuCoin recorded over $1.25 trillion in total trading volume in 2025, equivalent to an average of roughly $114 billion per month, marking its strongest year on record.
- This performance translated into an all-time high share of centralised exchange volume, as KuCoin’s activity expanded faster than aggregate CEX volumes, which slowed during periods of lower market volatility.
- Spot and derivatives volumes were evenly split, each exceeding $500 billion for the year, signalling broad-based usage rather than reliance on a single product line.
- Altcoins accounted for the majority of trading activity, reinforcing KuCoin’s role as a primary liquidity venue beyond BTC and ETH at a time when majors saw more muted turnover.
- Even as overall crypto volumes softened mid-year, KuCoin maintained elevated baseline activity, indicating structurally higher user engagement rather than short-lived volume spikes.
More For You
Crypto ETFs with staking can supercharge returns but they may not be for everyone
From yield potential to custody risks, here’s how direct ETH and staking funds compare for different investor goals.
What to know:
- Investors can now choose between owning ether directly or buying shares in a staking ETF that earns rewards on their behalf.
- While staking ETFs offers yield, they come with risks and less control than holding ETH in an exchange or wallet.
- Grayscale’s Ethereum staking ETF recently paid $0.083178 per share, yielding $3.16 in rewards on a $1,000 investment.
Top Stories
