[null, {"document_url": "https://ethereum.stackexchange.com/questions/3887/how-to-reduce-the-chances-of-your-ethereum-wallet-getting-hacked", "unformatted_src": "https://i.stack.imgur.com/IsKGV.png", "src": "https://i.stack.imgur.com/IsKGV.png", "formatted_filename": "IsKGV", "alt_text": "enter image description here"}, null, {"document_url": "https://ethereum.stackexchange.com/questions/3887/how-to-reduce-the-chances-of-your-ethereum-wallet-getting-hacked", "unformatted_src": "https://i.stack.imgur.com/lj3Rx.png", "src": "https://i.stack.imgur.com/lj3Rx.png", "formatted_filename": "lj Rx", "alt_text": "enter image description here"}, null, null, null, {"document_url": "https://ethereum.stackexchange.com/questions/3887/how-to-reduce-the-chances-of-your-ethereum-wallet-getting-hacked", "unformatted_src": "https://i.stack.imgur.com/cK53K.png", "src": "https://i.stack.imgur.com/cK53K.png", "formatted_filename": "cK K", "alt_text": "enter image description here"}, null, null, {"document_url": "https://ethereum.stackexchange.com/questions/3887/how-to-reduce-the-chances-of-your-ethereum-wallet-getting-hacked", "unformatted_src": "https://i.stack.imgur.com/kfZPS.png", "src": "https://i.stack.imgur.com/kfZPS.png", "formatted_filename": "kfZPS", "alt_text": "enter image description here"}, null, null, null]


Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. Join them; it only takes a minute:

How to reduce the chances of your Ethereum wallet getting hacked?

up vote 45 down vote favorite


The hack that occurred on May 12 2016 to steal 7,218 ethers from Patrick only affects miners where:

The hacker sent a continuous stream (every 2 seconds) of sendTransaction(...) request to Patrick's IP address on port 8545, and this request was forwarded to the geth instance. When Patrick used the Ethereum Wallet to send a transaction, the Ethereum Wallet unlocked Patrick's account for 2 seconds and the hacker's transaction succeeded in moving Patrick's ethers to the hacker's account.


User Patrick on the DAOHub forum posted the message yesterday with the subject [Urgent]Buying DAO using Mist has hacked.

Patrick used the Ethereum Wallet to transfer 1 ether to test out buying TheDAO tokens on his mining computer. When (so far it seems that) Ethereum wallet unlocked his geth wallet for 2 seconds (via the IPC API, not exposed to the Internet), a bot that was watching his geth wallet activity swooped in to send a transfer instruction to geth (via JSON-RPC, exposed to the Internet) and transferred his remaining 7218 ethers into the hacker's account.

Here is Patrick's account showing the 1 ether transfer before the removal of his remaining balance ~ 17 seconds later (0x95a3ba0aabc6296cbbe3862a889ecb37979da493): Here is the hacker's account showing the 7,218 ethers being split into many fragments of 97.54489533580829 ether transactions (0xc5d431ee2470484b94ce5660aa6ae835346abb19): Here is the bit of code from the Ethereum Wallet mist/interface/client/templates/popupWindows/sendTransactionConfirmation.js #228 that unlocks the geth account for 2 seconds:

The 1 ETH transaction occurred at 2016-05-12 03:12:57. The 7218.368874849814 ETH transaction occurred at 2016-05-12 03:29:03, ~ 17 seconds after the 1 ETH transaction, which is the 2 second window + the average ~ 15 second Ethereum blocktime.

After the hack, Patrick ran some analysis on his computer and found network communications every few seconds over the geth RPC port 8545 executing the following commands:

There is a question of why the RPC port 8545 was enabled so that RPC communications from the Internet would be forwarded to the geth computer.

Patrick runs GPU miners outside his network and enabled the port forwarding for port 8545 for his GPU miners outside his network, understanding that his account would remain locked for 99.99% of the time. All it took was a 2 second window.

As @tayvano has listed below, Holy shit my eth accounts been hacked documents another exploit via the RPC protocol.

Also note that a hacker with access to the local machine will also be able to access geth's IPC communication during this 2 second unlock period to send rogue transactions.

What are some steps that can be taken to reduce the chances of this occurring?

go-ethereum mining wallets security json-rpc
edited Aug 23 '16 at 9:38 asked May 12 '16 at 23:49 The Officious BokkyPooBah


up vote 30 down vote accepted

(Please edit me. I'm a community wiki)



From blog.ethereum.org - Security Alert â cpp-ethereum keeps accounts unlocked:

Affected configurations: cpp-ethereum (eth, AlethZero, â¦) version 1.2.0 up to 1.2.5 (fixed in 1.2.6) Note: Neither âgethâ nor âMistâ nor the âEthereum Walletâ (unless explicitly used together with cpp-ethereum) are affected by this, they lock accounts correctly again.

Severity: High

Possible Attacks: Attackers can spend funds from previously used accounts if they have access to the local machine or to an exposed json-rpc interface.

Details: Due to a bug in cpp-ethereum, accounts stay unlocked once their password has been entered until cpp-ethereum is closed. This includes accounts encrypted with the âmaster passwordâ entered upon startup or any password entered through Mist. This means that an attacker can spend funds from the account as soon as they have access to the RPC interface. For that to happen, they either need access to the local filesystem or the exposed http-json-rpc interface (not the default setting). Using Mist in âMist modeâ (not the default setting) and navigating to a malicious website also provides that website access to the RPC interface.

Proposed temporary workaround: Restart eth after each transaction, do not expose the json-rpc interface via http and upgrade to version 1.2.6 as soon as binaries are released. A fix has already been merged to the develop branch.


Here are some steps to reduce the chances of getting your Ethereum wallet hacked.

1. Restrict Access To RPC On Your Mining Computers

For most Ethereum miners, you will be using geth to running the blockchain node and ethminer to perform the mining calculations.

If you are running only one geth instance and the ethminers on just one computer, restrict your RPC port to only serve on the local computer. The option --rpcaddr 127.0.0.1 (which is the default setting) will restrict your RPC communications to just that computer.

If you are running only one geth instance on one computer and ethminer on the same computer plus ethminer on other computers that will need to communicate with the one geth instance, you will have to use your computer's local network IP, for example --rpcaddr 192.168.1.123. In this case, it is best set up a firewall to restrict communications via RPC to geth to your mining rigs only.

2. Don't Run The Ethereum Wallet (Mist) On Your Mining geth Node Computer

If you run Mist on your mining node, when you send a transaction with Mist, it will communicate via the IPC socket to instruct geth to unlock your account for 2 seconds.

If you have RPC turned on and this port is accessible from the Internet, scripts and bots will be able to send transactions on your geth node to snatch your coins in the short period of time that Mist unlocks your accounts, as happened to Patrick.

If you have RPC turned off and your mining computer has been compromised, any locally installed malware will be able to use the IPC socket to snatch your coins.

Don't run Mist on your mining computer. Use it on a separate secure computer instead.

3. Check You $HOME/.ethereum/history File And Erase If Necessary

The history of the commands you type into geth ... console is stored in $HOME/.ethereum/history. The following shows what I have just typed into the console:

And here are the last two lines of my $HOME/.ethereum/history file:

Check the contents of your history file using the command:

If you have ever used the command personal.unlockAccount(...), erase your history file:

By default the directory in which your history file is located is only readable by your own user. But if your account is compromised, your password is in your history file:

4. Move Your Mining Rewards If They Are Too Much To Lose

Your mining computer is continually communication with other programs on the Internet and is at a higher-than-usual risk of getting compromised.

Hackers can easily find Ethereum nodes on the Internet and your computer may be targeted. Move your mining rewards to a more secure Ethereum account to reduce the size of your losses if you do get hacked.

5. Reduce Your Attack Surface If Possible

Run the server version of Ubuntu Linux if possible. It is a little bit harder to install, especially the GPU drivers, but you have a lower chance of getting hacked as fewer services run in this version compared to the desktop version.

6. Secure Your Network

7. Don't Use The User root (Or User With Administrator Privileges) To Run Your Miners

If your Internet facing programs (geth) has a vulnerability, a hacker can cause more damage if the program is running with administrator privileges.

8. Check Your Port Forwarding Rules On Your Router Or Firewall

Only the port 30303 for TCP and UDP traffic should be forwarded by your modem or firewall to your geth node computer. Port 8545 (or whatever you configured for your RPC port) should NOT be forwarded to your geth node computer.

My firewall rules are for my 2 mining rigs (.120 has the geth instance, .121 is just a GPU miner, .111.* is my DMZ):

9. Test For Open Ports On Your Internet Connection

Use a service like GRC to probe for the open ports on your Internet connection. Click on grc.com, click on Shields UP!!, then click on ShieldsUP! again. Read the text and click Proceed.

On the web page shown below, I've typed in ports 8545, 30303 and clicked User Specified Custom Port Probe: The probe results are shown below - Port 8545 (geth RPC) is not open to the Internet while port 30303 (Ethereum P2P port) is: It's probably a good idea to test All Service Ports (Ports 0 to 1055) at the same time to confirm which ports you have open. The following results show that I only have port 443 (HTTPS) open: 10. Opening RPC Ports For Miners Outside Your Network (Your Own Solo Mining Pool With Your Own Distributed Miners)

Don't open up your RPC port 8545 if you have GPU miners outside your network.

Your alternatives if you have GPU miners outside your network with your geth instance:

edited Dec 27 '17 at 2:30
20 revs, 2 users 100%

0. Read the official security advisory.

ethereum blog: [security alert] insecurely configured geth can make funds remotely accessible

1. Never turn on RPC on hot wallets. Even with IP and CORS limited to localhost. Just don't.

2. Never turn on IPC on a machine you don't feel you have complete control about the security. Or use parity.

3. Don't use accounts to store huge amounts of ether. Use multisignature contracts.

4. Don't use online computers to store huge amounts of ether. User air gapped machines or paper wallets.

edited May 16 '16 at 20:58
answered May 13 '16 at 7:25 
I imagine perhaps that Mist does not use signed transactions but rather unlocks the an account to send unsigned transactions. So perhaps sending signed transactions using web3 on a NodeJS command line console or by using a script would allow one to send a transaction without the risk of attack. This assumes that accounts are never unlocked when sending signed transactions but I am not sure that is the case.

Comments would be appreciated

answered Feb 27 '17 at 12:17 John Shearing

protected by Afri May 22 '17 at 10:07


Not the answer you're looking for? Browse other questions tagged go-ethereum mining wallets security json-rpc or ask your own question.


Is it possible to hack an ethereum account?
How to call a contract method using the eth_call JSON-RPC API
What are ipc and rpc?
How can I reverse or cancel a transaction or recover lost ethers?
Do I have to unlock my account in geth to call a web3.eth.sign() in JavaScript?
Geth stopped syncing after a while
Error: account is locked. Attempting to send ether from one account to another, Local Node on Private Blockchain
Is it possible to unlock a geth wallet through JSON RPC?
How can I list The DAO proposals and vote from the command line?
How can i publish smart contracts accessible from all client


How does web3.js verify that it is geth that is listening on port 8545?
Endless loop emptying an account with Contact Creations
Ethereum send transactions are unsuccessful when I run the node and miner in same machine
Fatal: failed to write genesis block: wrong genesis block in database
ethers.js connect to private net RPC
geth light mode features
Why blocks are not including queued transactions in this private chain
Setup Ethereum-Wallet as geth RPC
Geth account unlocked for 2 seconds
Expose securely your network to make possible anyone can hit your smart contract

