Profanity Vanity Address Generator Vulnerability: Cryptanalysis of a Pseudo-Random Generator with a 32-Bit Time Seed

Based on the 1inch Network Security Team technical report (September 2022) and subsequent independent research (Amber Group, Halborn, BlockSec, cryptosec.com)
Research and Analysis Review

Abstract: This paper examines a cryptanalytic vulnerability in the Profanity Ethereum vanity address generation tool, discovered by the 1inch Network security team in 2022. The root cause of the vulnerability is the initialization of the deterministic pseudorandom generator (mt19937) with a 32-bit value dependent on the system timer, instead of a full 256-bit entropy source. This reduced the effective private key space. $2^{256}$ , to $2^{32}$ (≈4.3 billion) combinations, making it possible to reverse-engineer a private key from a public key in a reasonable time on GPU clusters. The practical consequences of this vulnerability were the hacking of the hot wallet of market maker Wintermute, resulting in the loss of approximately $160 million (September 20, 2022), as well as a series of smaller incidents (approximately $3.3 million, September 2022) and further thefts totaling over $3 million in subsequent years. The paper examines the mathematical apparatus of elliptic curves (secp256k1), the mechanics of attacks using deterministic key expansion and decrementation, and historical parallels with other cases of entropy reduction in cryptosystems.

1. Introduction and Context

Vanity addresses are cryptographic addresses on a blockchain (usually Ethereum) that contain a visually recognizable prefix or substring, such as [ 0x000000... ] or [ 0xdeadbeef...]. Because the address is a hash of a public key, finding such an address requires exhaustively trying a large number of random key pairs until a match is found. The Profanity tool (by johguse, GitHub, 2017) used GPU computing (OpenCL) to achieve speeds on the order of millions of keys per second, making it one of the most popular solutions of its kind [web:1][web:10].

In early 2022, 1inch Network researchers noticed that the Profanity generator was using a 32-bit Mersenne initialization vector (mt19937) rather than a full 256-bit random seed [web:1][web:13]. The trigger for a practical investigation was the suspicious behavior of several deploy wallets (1inch, Synthetix, and others), which simultaneously announced the same airdrop, and the stolen funds were transferred to a single address [web:1].

2. Key generation architecture in Profanity

The tool’s operating algorithm can be formalized in four steps [web:1][web:13]:

Random selection of one of $2^{32}$ (“4 billion”) initial private keys – seed keys $k_{0}$ .
Deterministic expansion of a seed key into a space of 2,000,000 ( $2 \times 10^{6}$ ) derivatives of private keys by iteratively applying the elliptic curve point addition operation.
Computing the corresponding public keys on the secp256k1 curve: $P_{i} = k_{i} \cdot G$ , Where $G$ — the base point of the group.
Iteratively increment public keys (without recalculating scalar multiplication) until the hash of the resulting public key (address) matches the desired vanity pattern.

2.1 Mathematical model

Let $E$ — elliptic curve secp256k1 over a finite field $F_{p}$ , $G$ — point-generator of order $n$ (a prime number of order $2^{256}$ ). Private key $k \in [1, n - 1]$ , public key: $P = k \cdot G (\mod p)$

In a normal ECDSA/secp256k1 implementation, the private key $k$ must be chosen uniformly from the full range $[1, n - 1]$ , meaning it has an entropy of about 256 bits. In Profanity, the actual space of seed values is limited: $k_{0} \in {0, 1, \dots, 2^{32} - 1}, | {k_{0}} | = 2^{32} \approx 4.295 \times 10^{9}$

The expansion of the seed to 2 million derived keys is given by a deterministic function $f$ : $k_{i} = f (k_{0}, i), i = 0, 1, \dots, 2 \times 10^{6} - 1$

and the final public key of a specific vanity address is obtained by a series of increments from the seed: $P_{v a n i t y} = P_{s e e d, i} + j \cdot G, j = 0, 1, 2, \dots$

Key vulnerability: Since the increment operation on an elliptic curve is additive and invertible, and the entire seed space is bounded $2^{32}$ , any public key of a vanity address can be decremented back to the original seed key for essentially the same computational cost as was required to generate it [web:1][web:15].

2.2 Reverse Attack (Private Key Reconstruction)

The 1inch algorithm, which recovers the private key from the known public key of the vanity address [web:1]:

Get the public key $P_{v a n i t y}$ from a transaction signed by the address owner (the public key is recovered from the ECDSA signature, which is publicly available through Etherscan and similar explorers) [web:15].
Deterministically “collapse” $P_{v a n i t y}$ back through the same extension function, yielding 2 million intermediate key candidates.
Decrement repeatedly ( $P \mapsto P - G$ ) candidates until they match one of the $2^{32}$ initial seed-public-keys, pre-tabulated using the “meet-in-the-middle” method (analogous to the Pollard algorithm / baby-step giant-step).
Recover the private key from the found public key seed. $k_{0}$ (trivial, since the table is built in advance for all $2^{32}$ values), and then the target private key $k_{v a n i t y}$ by reverse application of steps 2–4 of generation.

This inversion is equivalent to solving the discrete logarithm problem in a bounded subspace of size $2^{32}$ , and not in the entire order group $n \approx 2^{256}$ , which reduces the computational complexity of the attack with impossible (~ $2^{128}$ operations using the Pollard method for a full 256-bit key) to a value that is quite achievable on a GPU cluster in hours-days [web:2][web:5][web:14].

2.3 Estimation of computational complexity

According to expert estimates cited in a GitHub discussion, a cluster of 1,000 GPUs could recover private keys for all 7-character vanity addresses generated by Profanity in approximately 50 days [web:5][web:14]. Formally, the brute-force difficulty is estimated as: $T_{a t t a c k} \approx \frac{2^{32}}{R \cdot N}$

Where $R$ — the speed of enumeration of one GPU (keys/sec), $N$ — the number of GPUs in the cluster. For modern GPUs ( $R \sim 10^{9}$ keys/sec per device for comparing simple dot addition operations) attack time is measured in hours with sufficient parallelism [web:13].

3. Chronicle of incidents and practical consequences

3.1 Vulnerability discovery and disclosure

1inch Network published a technical disclosure of the vulnerability on September 15, 2022, accompanied by the warning: “Your money is NOT SAFU if your wallet address was generated with the Profanity tool” [web:1]. That same day, the Profanity author archived the GitHub repository, deleting all compiled binaries and leaving the code in an inoperable state [web:2][web:10].

An example from the archives. The investigation began when several deploy addresses from various projects (1inch, Synthetix, and others) simultaneously announced the same airdrop, and the stolen funds flowed to a single address 0xee9bd0e71681ee6e9aa9f1ba46d2d1149f7bd054 . This on-chain trace became the starting point for reconstructing the attack [web:1].

3.2 Wintermute Hack (September 20, 2022)

The most high-profile consequence of the vulnerability was the hacking of the “hot” administrative wallet of the crypto market maker Wintermute, generated through Profanity, which resulted in the loss of approximately $160 million in stablecoins and other tokens [web:7][web:11][web:13]. The attacker took advantage of the fact that the compromised hot wallet retained administrative permissions to the Wintermute vault smart contract, allowing them to directly initiate a transfer of funds from the vault, bypassing additional security mechanisms [web:7].

An example from the archives. According to a postmortem by Polygon CISO Mudit Gupta, the Wintermute team knew about the Profanity vulnerability and withdrew ETH from a compromised wallet, but forgot to revoke the wallet’s administrative privileges over the vault contract—this became the immediate attack vector [web:7].

3.3 Series of smaller incidents

Almost simultaneously, on September 19, 2022, a separate incident involving the theft of approximately $3.3 million was recorded from several Ethereum addresses also generated by Profanity [web:9][web:12]. Years later, despite public warnings, a further theft of approximately $3.3 million was recorded from addresses whose owners were either unaware of the vulnerability or failed to transfer assets in a timely manner [web:8][web:9].

3.4 Summary table of incidents

Date	Incident	Estimated damage	Source
Beginning of 2022	1inch researchers discover an anomaly in Profanity’s PRNG	—	[web:1]
June 2022	Suspicious activity from several deploy wallets; reported by @samczsun	—	[web:1]
September 15, 2022	1inch public disclosure, Profanity repository archive	—	[web:1][web:2]
September 19, 2022	Theft from multiple wallets generated by Profanity	≈ $3.3 million	[web:9][web:12]
September 20, 2022	Wintermute Hot Wallet Hack	≈ $160 million	[web:7][web:11]
2025–2026	Repeated thefts from old Profanity addresses	≈ $3.3 million	[web:8][web:9]

4. Cryptanalytic nature of vulnerability: generalized classification

From a cryptanalytic perspective, the Profanity incident falls under the category of attacks on insufficient entropy (weak PRNG seeding) rather than an attack on secp256k1 elliptic curve cryptography itself, which remains mathematically secure. Formally, two independent implementation flaws can be identified [web:13]:

The PRNG seed (mt19937) was initialized with a 32-bit value instead of the full 256 bits of entropy, which reduced the key space $2^{256}$ to $2^{32}$ .
The iterative key expansion algorithm used reversible additive operations on an elliptic curve without using one-way (hash) functions, making the generation process invertible “both ways” [web:13].

4.1 Historical parallel: other cases of entropy deficiency

Example from the history of cryptanalysis 1. In 2013, the Android SecureRandom vulnerability resulted in the reuse of the same value “ $k$

“when signing Bitcoin ECDSA transactions by different users, which made it possible to calculate private keys by solving a system of equations $k = (s_{1}^{- 1} (h_{1} + r x))$

, since the general $k$

linked two signatures by one unknown person.

Example from the history of cryptanalysis 2. In 2008, a flaw in OpenSSL on Debian (CVE-2008-0166) reduced the entropy space for SSH/SSL key generation to 32,768 possible PID-based seed values, allowing all possible keys to be pre-tabulated for a brute-force attack—a structurally identical “small seed, big key” principle to that used in Profanity.

Example from the history of cryptanalysis 3. In 2010, researchers from the group fail0verflow and George Hotz showed that the Sony PlayStation 3 used a static (non-random) value $k$

for signing ECDSA firmware, which directly allowed the private console signing key to be recovered from two signed messages—an illustration of how compromising randomness in ECDSA-like schemes leads to complete key disclosure.

5. Formal assessment of the reduction in cryptographic strength

The system’s resistance to discrete logarithm on an elliptic curve secp256k1 with a full 256-bit key entropy is estimated using the Pollard rho method with a complexity of: $O (\sqrt{n}) \approx O (2^{128})$

operations, which is beyond the computational capabilities of any existing or proposed classical computer. With the seed space limited to $2^{32}$ effective resistance is reduced to: either $O (2^{32}) or O (\sqrt{2^{32}}) = O (2^{16})$

depending on the use of meet-in-the-middle techniques when tabulating all seeded public keys in advance. The difference is $2^{96}$ – $2^{112}$ orders of magnitude makes the attack practically feasible on widely available hardware—which is a quantitative expression of the essence of the vulnerability [web:13][web:14].

6. Response measures and recommendations

Instantly transfer funds from any Profanity-generated addresses to new addresses with random, full-entropy private keys [web:1].
Revocation of administrative and ownership rights of smart contracts linked to Profanity addresses [web:1].
Archiving and deprecation of the original tool by the author (September 15, 2022) [web:2][web:10].
The industry is moving towards using tools like ERADICATE2 and other generators that use cryptographically strong entropy sources (e.g., /dev/urandom, hardware RNGs) at the full 256 bits [web:1].

7. Conclusion

The Profanity case demonstrates a classic principle in cryptography: the security of a system is determined by the weakest link in the randomness chain, not by the theoretical strength of the algorithm used . The secp256k1 elliptic curve cryptography underlying Ethereum and Bitcoin remains mathematically secure; the vulnerability arose solely due to an engineering error in initializing the pseudorandom generator with a 32-bit value, rather than a 256-bit value. The economic impact of this single engineering error—over $160 million stolen from Wintermute and tens of millions of dollars in additional losses to other users—makes this case one of the most significant practical examples in the history of applied cryptanalysis of blockchain systems [web:1][web:7][web:13].

Sources

Profanity Pretty Address Generator Vulnerability: 32-Bit RNG Cryptanalysis: https://cryptexy.ru/profanity-pretty-address-generator-vulnerability-32-bit-rng-cryptanalysis/

[web:1] 1inch Network. A vulnerability disclosed in Profanity, an Ethereum vanity address tool. 1inch Blog, September 14, 2022.
[web:2] Wiz Vulnerability Database. CVE-2022-40769.
[web:5] Amber Group. Exploiting the Profanity Flaw. Medium, September 29, 2022.
[web:7] cryptosec.com. The Famous $160M Wintermute Hack: Inside Job or Profanity Bug?
[web:8][web:9] Forklog / Cointelegraph. Hackers stole about $3.3 million through vulnerability in Profanity Ethereum address generator.
[web:10] GitHub. johguse/profanity repository archive notice.
[web:11] Blockworks. The Bug That Took Down Wintermute Is Still at Large.
[web:13] BlockSec. A Deep Dive of HOW Profanity Caused Wintermute to Lose $160M.
[web:14] Halborn. Explained: The Profanity Address Generator Hack, September 2022.
[web:15] rebryk. How to hack a vanity address generated with Profanity. Medium.