The vulnerability — which has now been fixed — made it possible for hackers to extract recovery seed phrases from computer disks.
Popular crypto wallets, including MetaMask and Phantom, suffered for months from a critical vulnerability in their browser extension software, according to a report on Wednesday from cybersecurity firm Halborn.
The vulnerability, dating back to September 2021 and now fixed, put users’ funds at risk as it made it possible for hackers to extract wallet recovery seed phrases stored on computer disks. However, no exploits have yet been reported that could be tied to the vulnerability.
In the report, Halborn’s researchers said the seed phrases generated by wallet providers were being saved on users’ computers in plain text as part of the “Restore Session” feature. This meant malicious actors could gain entry using malware or physical access. Halborn added they worked with wallet providers to patch their wallets against the vulnerability.
MetaMask, the most popular web3 wallet on Ethereum, clarified that the critical security issue affected only a “small segment of users” and that the vast majority of users were not at high risk. According to MetaMask blog, there could be a “case where user keys could be found unencrypted on disk in rare edge cases.” Furthermore, it has issued mitigations on its latest browser extension version.
Meanwhile, Phantom, the most-used web3 wallet on the Solana blockchain, said it began issuing fixes in January, three months after the vulnerability was initially flagged by Halborn. Furthermore, Phantom plans on rolling out another exhaustive patch next week, it said.
