<p>They anticipated this type of attack and they are monitoring their JavaScript files, check this website of theirs <a href="http://blockchain-status.com/javascript_verifier">http://blockchain-status.com/javascript_verifier</a></p>

<p>Also, CloudFlare (the reverse proxy they use) can modify the Javascript on the fly (CloudFlare is at the other end of the encryption for your browser, so SSL here only secures the connection between you and the CloudFlare machines, and optionally CloudFlare to Blockchain.info, you're not directly connecting to Blockchain)</p>

<p>It is true that the client-side script does not send the password to the server but you actually need to <em>send</em> your wallet password to use their old wallet API (it's being deprecated) and if a hacker can somehow control their servers, it is possible that the hackers can read the unencrypted wallet from the memory without having to inject malicious client scripts, even if we assume they are not saving them to the disk.</p>

CC BY-SA 3.0
2016-04-16T01:49:09.163Z
2016-04-16T01:49:09.163Z
Onur Yapar
<p>Yes, the attack you describe is possible.</p>

<p>But this isn't specific to blockchain.info nor to online wallets.</p>

<p><strong>If an attacker manages to run code on your machine, you're pwned.</strong></p>

<p>As long as an attacker manages to inject code which deals with the private keys in their unencrypted form, the attacker can make it send the keys back to her.</p>

<p>One way an attacker can do this is, as you describe, by compromising online-wallet's website and inject malicious javascript.</p>

<p>Another way would be to compromise the binary of a bitcoin client (client-stored wallet) you install on your local machine.</p>

<p>The "extra safety" blockchain.info claims to provide is that simply getting hold of the <em>keys database</em> isn't enough for an attacker to steal your money.</p>

CC BY-SA 3.0
2016-08-20T16:19:10.517Z
@PhilipStern: Yes, certainly that is possible.
Nate Eldredge
CC BY-SA 3.0
2016-02-25T06:11:21.663Z
2016-03-11T17:00:25.900Z
2016-03-11T17:00:25.900Z
shx2
<p>Blockchain.info <a href="https://blockchain.info/wallet/how-it-works" rel="noreferrer">claims</a>:</p>

<blockquote>
  <p>We cannot (and don't want to):</p>
  
  <ul>
  <li>View your balance</li>
  <li>View your address book</li>
  <li>Make transactions on your behalf</li>
  <li>Confiscate your wallet</li>
  <li>Lock you into our service.</li>
  </ul>
</blockquote>

<p>They do this by only storing the <em>encrypted</em> wallet file containing the private keys, and letting the web client do the decryption and signing using the private keys without ever communicating them using the server. This means it is indeed true that the blockchain.info can't make transactions on your behalf. </p>

<p>I used to think this also meant that, if a hacker broke into their servers, they would not be able to steal everybody's bitcoins, because the private keys are not stored there. </p>

<p>However, now I'm not so sure. Couldn't the hacker simply change the server code to send javascript to the web client which, when executes, decrypts those private keys and sends them back to the (now-hacked) server? </p>

<p>It would take longer, as everyone would have to sign in to be compromised... but they'd still be able to steal a bunch of Bitcoins.</p>

<p>Am I missing something or is this indeed the current state of affairs with blockchain.info?</p>

<p>(Note this is not meant to be a dig at this particular website; it's really more of a security question in general.)</p>

<wallet><security><blockchain.info><hacking><wallet-security>
Can a clever hacker still steal everyone's money from the blockchain.info wallet?
Claudiu
# Can a clever hacker still steal everyone's money from the blockchain.info wallet?

(Asked by: username_0 on 2016-02-24)

Blockchain.info [claims](https://blockchain.info/wallet/how-it-works):

> We cannot (and don't want to):
>
> * View your balance
> * View your address book
> * Make transactions on your behalf
> * Confiscate your wallet
> * Lock you into our service.

They do this by only storing the *encrypted* wallet file containing the private keys, and letting the web client do the decryption and signing using the private keys without ever communicating them using the server. This means it is indeed true that the blockchain.info can't make transactions on your behalf.

I used to think this also meant that, if a hacker broke into their servers, they would not be able to steal everybody's bitcoins, because the private keys are not stored there.

However, now I'm not so sure. Couldn't the hacker simply change the server code to send javascript to the web client which, when executes, decrypts those private keys and sends them back to the (now-hacked) server?

It would take longer, as everyone would have to sign in to be compromised... but they'd still be able to steal a bunch of Bitcoins.

Am I missing something or is this indeed the current state of affairs with blockchain.info?

(Note this is not meant to be a dig at this particular website; it's really more of a security question in general.)

**Tags:** wallet, security, blockchain.info, hacking, wallet-security


---

## 2 answers

### Answer by username_2 on 2016-02-25. Score: 4 | Accepted answer

Yes, the attack you describe is possible.

But this isn't specific to blockchain.info nor to online wallets.

**If an attacker manages to run code on your machine, you're pwned.**

As long as an attacker manages to inject code which deals with the private keys in their unencrypted form, the attacker can make it send the keys back to her.

One way an attacker can do this is, as you describe, by compromising online-wallet's website and inject malicious javascript.

Another way would be to compromise the binary of a bitcoin client (client-stored wallet) you install on your local machine.

The "extra safety" blockchain.info claims to provide is that simply getting hold of the *keys database* isn't enough for an attacker to steal your money.

> **Comments:**
> **username_3**: @PhilipStern: Yes, certainly that is possible.  

---

### Answer by username_1 on 2016-04-16. Score: 5

They anticipated this type of attack and they are monitoring their JavaScript files, check this website of theirs <http://blockchain-status.com/javascript_verifier>

Also, CloudFlare (the reverse proxy they use) can modify the Javascript on the fly (CloudFlare is at the other end of the encryption for your browser, so SSL here only secures the connection between you and the CloudFlare machines, and optionally CloudFlare to Blockchain.info, you're not directly connecting to Blockchain)

It is true that the client-side script does not send the password to the server but you actually need to *send* your wallet password to use their old wallet API (it's being deprecated) and if a hacker can somehow control their servers, it is possible that the hackers can read the unencrypted wallet from the memory without having to inject malicious client scripts, even if we assume they are not saving them to the disk.


---

