Profanity was a popular tool for generating vanity addresses: addresses with a chosen prefix, like a run of zeroes, which look tidy and save a little gas.
It derived a 256-bit private key from a 32-bit random seed. That takes the number of possible keys from roughly 1.2 times 10 to the 77th down to about 4.3 billion. Analysts estimated around 1,000 GPUs could enumerate every 7-character vanity address in about 50 days.
1inch Network published a warning on 15 September 2022.
On 20 September, five days later, the market maker Wintermute lost about $160M. The compromised address began 0x0000000, had been generated with Profanity for gas optimisation, and had never been retired.
Nobody stole a key. The key was recomputed, because the randomness behind it was small enough to enumerate one by one.
And notice where the failure actually sat. The cryptography was fine. The tool was flawed, the flaw was public, and the address it applied to was still in production five days after the warning.
People use "wallet", "key" and "address" as though they were the same thing, and every confusion that follows in self-custody starts there. This lesson puts them in different rooms.
A wallet is a keyring, not a vault
Your wallet does not hold your coins. The coins are positions in the public ledger from F101, and nothing about the wallet sits between you and them.
What the wallet holds is keys. It organises them, backs them up, and signs on your instruction.
Uninstall the app tomorrow and your coins are not gone. If the keys are backed up elsewhere, plug them into different software and the same coins appear. Different keyring, same keys, same coins.
Four objects, one direction
Here is the chain, and the arrows only run one way.
Entropy. Raw randomness. The starting number. This is the object nobody talks about and it is the one that failed in the autopsy.
Private key. Derived from the entropy. The thing that signs. Whoever holds it can move the funds, with no second factor, no reset, and nobody to appeal to.
Public key. Derived from the private key by mathematics that only computes forwards. Safe to share by design.
Address. Derived from the public key, usually by hashing it and adding bytes for error checking and chain identification. This is what you paste into a payment field. It is the mailbox number.
Each step is trivial forwards and computationally impossible backwards. That asymmetry is the entire system.
Two things follow immediately.
The private key is the whole authority. Not a password checked by a server. A password is a claim someone verifies; a private key produces a mathematical proof on its own, and the network cannot tell a legitimate holder from anyone else who has it.
Security is capped at the top. Every object below the entropy inherits the entropy's quality. A private key that looks like any other 256-bit number, and produces a normal-looking address, and signs perfectly, can still have 32 bits of real security if that is all the randomness it started with.
The Profanity failure is a single number, and it is worth feeling the size of it.
Intended key space: 2 to the power of 256
2^256 = about 1.16 x 10^77
For scale, current estimates of the number of atoms in the observable universe are around 10^80. You are within three orders of magnitude of that.
Actual key space, with a 32-bit seed: 2 to the power of 32
2^32 = 4,294,967,296, about 4.3 billion
Reduction factor:
2^256 / 2^32 = 2^224 = about 2.7 x 10^67
Now convert both into time, because the exponents stop meaning anything otherwise. Assume a machine testing one million keys per second, which is modest.
Searching 2^32:
4,294,967,296 / 1,000,000 = 4,295 seconds = about 72 minutes
The entire key space, on one machine, over lunch.
Searching 2^256 at a trillion keys per second, a million times faster:
1.16 x 10^77 / 10^12 = 1.16 x 10^65 seconds
Divide by roughly 3.15 x 10^7 seconds in a year:
= about 3.7 x 10^57 years
The universe is on the order of 1.4 x 10^10 years old.
That gap is why the cryptography is not the weak point in any incident in this Academy, and it is also why the entropy is. These two numbers describe key pairs that look completely identical. There is nothing on the screen, in the address, or in the signature that distinguishes an hour from forever.
Which one you can publish
- Address: publish freely. That is what it is for. Invoices, profiles, payment screens.
- Public key: safe by design, and note that on some chains it becomes visible the first time you spend, which is a real consideration for a few older schemes and not something to worry about at this level.
- Private key: never, to anyone, under any circumstance. There is no legitimate request for it. F106-01 lists this as pattern 12 and it has no exceptions.
- Entropy: never, for the same reason, because it reproduces the private key.
Support agents, wallet validators, migration tools, verification flows, strangers offering help. None of them needs your private key or your seed phrase, because no legitimate process anywhere is built to require it.
This is the one rule in the Academy with no judgment attached and no situational exceptions. The moment the request appears, the conversation is over and the counterparty is a thief, regardless of how the rest of it read.
One seed, many keys
Real wallets do not hold one key. From a single backup, usually twelve or twenty-four words, they derive an effectively unlimited tree of key pairs, each producing its own address. The same backup rebuilds the whole tree in any compatible software, anywhere.
That is why it is called a seed. It is the seed of every key the wallet will ever generate, and F103-02 is entirely about what those words actually are.
Two consequences you can act on today.
Your coins follow the seed, not the app. If the wallet company disappears, restore elsewhere. The app was never holding anything.
The seed is strictly more powerful than any single key. Anyone reading it reconstructs every key, on every chain that wallet supports, permanently.
The tree is organised by a derivation path, which is why the same seed can show you different addresses in two wallets that chose different defaults. That is not funds missing. It is the same seed read down a different branch, and the lab for this course, F103-L, makes you produce that result deliberately so it never frightens you.
A key generated on my own device is safe because I generated it myself.
Generating locally is genuinely better than receiving a key from someone else, and it is not the property that makes a key strong.
What makes a key strong is the quality of the randomness the device used, and you cannot inspect that. Profanity ran on the user's own machine and produced a key with 32 bits of real security. The Milk Sad vulnerability in F103-02 did the same thing to seed phrases, using a random number generator seeded from the clock.
There is also no self-test available. You cannot look at a key, an address, or a signature and detect weak entropy. The only practical defences are to use widely reviewed software rather than a convenience tool, to prefer a device with a dedicated hardware random number generator, and to treat any key from a tool that was later found vulnerable as compromised immediately, which is the operational half the autopsy failed.
The mental picture
A keyring on your belt. Dozens of keys, each opening one mailbox somewhere in a very large city. The mailboxes have addresses written on the outside and anyone can post into them. Only your keys open them.
Lose the ring, lose access. Let someone copy it, they have access. And the master key that generates every key on the ring, your seed, is the most powerful object you own.
Everything in F103 and F104 is about where that master key lives.
Four objects in one direction: entropy makes the private key, which makes the public key, which makes the address, and every step is impossible to run backwards. The address is for publishing and the private key is the entire authority, with nothing in between. Security is capped by the randomness at the top, and a 32-bit seed turns a key space of 10 to the 77th into 4.3 billion, which is about seventy minutes of one machine's time against a number of years with fifty-seven digits. Those two keys look identical on screen, which is why Wintermute lost $160M five days after the warning was published.