After some investigation and an official audit, fixes began rolling out in January 2022 and by April, Phantom users became protected from this critical vulnerability.
In late September 2021, blockchain security advisory firm, Halborn, first alerted Phantom and other top browser extension crypto wallets to a critical vulnerability that put our collective users at risk.
After some investigation and an official audit, fixes began rolling out in January 2022 and by April, Phantom users became protected from this critical vulnerability. An even more exhaustive patch is rolling out next week that we believe will make Phantom’s browser extension the safest from this vulnerability in the industry.
Vulnerability Overview
With the "Demonic" vulnerability, users who imported their browser extension crypto wallet using a secret recovery phrase were at risk of having their secret recovery phrase exposed.
If a sufficiently advanced attacker was able to exploit another vulnerability and obtain physical or logical access to the device, they would be able to retrieve the secret phrase and gain access to the wallet. Many major non-custodial cryptocurrency wallets with browser extensions were potentially affected by this issue, including Phantom, Metamask, Brave, and more.
The discovery of "Demonic" revealed a new vector of attack for crypto wallets called key-finding. These attacks target the running memory of a process for specific sensitive credentials. Using the standard BIP39 mnemonic input field could make many browser extension wallets vulnerable to this type of attack.
Phantom’s Solution
We are ecstatic to welcome Oussama Amri, who originally discovered the threat last year while part of Halborn, to the Phantom team as a security engineer. And thanks to the hard work of engineers, Josiah Savary and Laamia Islam, not only have substantial parts of our codebase changed, but we have also completely rewritten how we generate seed phrases.
After some additional audits are completed this summer, we plan to open-source our approach to the BIP-39 package for seed generation so other crypto wallets can also better protect themselves and their users.
Please note that details of this vulnerability were kept confidential until all alerted parties could adequately address the threat. We are proud of the collaborative effort that went into keeping our users and the larger crypto community safe.
Staying Safe in Web3
While the Phantom team is doing all we can to prioritize security, it always helps to follow established best practices as an extra layer of protection. Some helpful tips include:
- Use a hardware wallet to store large sums
- Maintain multiple wallets to spread out risk
- Enable local disk encryption
- Don't click on suspicious and unknown links
- Use a secure internet connection
If you have reason to believe your account is at risk, we also recommend migrating your funds to a fresh wallet.
If you have any questions as a user, the Phantom team would love to hear from you at Phantom Support. For any developers who want more information on how Phantom handles security, or to report a security finding, please reach out to [email protected]. For any general developer inquiries, please feel free to join our developer discord.