Blockchain Bandit Strikes Again, $172M in ETH Moved After Two Years of Dormancy

• The Blockchain Bandit strikes again, consolidating $172M in ETH, spotlighting crypto’s ongoing security vulnerabilities.
• Weak private keys remain a critical flaw; the Bandit’s “Ethercombing” exposes systemic issues in encryption and wallet safety.
• Rising crypto thefts hit $2.3B in 2024; user negligence and exchange breaches drive the surge, calling for stronger safeguards.

The notorious “Blockchain Bandit” has returned, moving $172 million worth of 51,000 ETH into a single wallet. This follows a two-year period of dormancy. In batches of 5,000 ETH, the hacker transferred the stolen Ether, according to blockchain investigator ZachXBT. Between 8:54 and 9:18 p.m. UTC on December 30, transfers took place. Since January 2023, when the hacker moved 470 Bitcoin (BTC), these monies have not been touched.

Exploiting Weaknesses: How the Bandit Operates

The Blockchain Bandit first gained notoriety in 2018 by exploiting weak private keys, a method known as “Ethercombing.” This technique involved guessing private keys systematically using flawed code and random number generators. By leveraging this approach, the hacker amassed nearly 45,000 ETH in under eight months. Reports reveal that the Bandit identified 732 private keys linked to 49,060 transactions.

Weak private key management remains a critical vulnerability in the crypto ecosystem. Besides, hackers can replicate private keys when faulty random number generators are used. This exploitation exposes wallets to unauthorized access. Consequently, experts stress the importance of secure key management and robust encryption practices to combat such threats.

Rising Crypto Theft: A Troubling Trend

The Bandit’s reappearance coincides with an alarming rise in crypto thefts. Onchain security firm Cyvers reported over $2.3 billion stolen across 165 incidents in 2024. This figure marks a 40% increase from 2023. Centralized exchanges and custodial platforms accounted for $1.9 billion of these losses. Moreover, pig butchering scams further worsened this trend, highlighting the dire need for improved security measures.

Bandit’s methods reflect user negligence and coding flaws. Poorly chosen passwords and default settings make wallets vulnerable. Additionally, Ethereum’s early vulnerabilities created opportunities for large-scale exploitation. Despite improved coding practices, the damage has already been done.

Cybersecurity experts suspect potential ties between the Bandit and North Korean hacker groups like Lazarus. These groups are infamous for targeting crypto platforms to fund state-sponsored programs. However, no definitive links have been confirmed.