But the API was still available until Friday without rate limiting. ShapeShift stopped using payment IDs in November 2019 and switched to using subaddresses, which cannot be publicly determined. Those payment IDs are available from Monero's blockchain, which meant those transactions would be easier to trace using an EAE attack, also known as a 'poisoned outputs' attack, he says. The technical details dig into the intricacies of how virtual currencies can be shifted around, and the challenges those shifts pose in tracing.īax says that between April 2015 and November 2019, ShapeShift's API used 32-byte payment IDs. But it shouldn’t reflect on Monero's current privacy state, which has improved since 2017, Ehrenhofer says.Īlso, Ehrenhofer says that the Lazarus group made some notable and revealing moves, including sending large amounts of Monero around at a time when those transactions would have been unusual. The issues in ShapeShift's systems have been known for a number of years, says Justin Ehrenhofer, the host of Breaking Monero, a video series focused on Monero. And Monero was supposed to protect you even if that data was known,' he says. 'You can play connect the dots with some Monero transactions if you have data from exchanges. Miers says the research highlights broader security issues with Monero, and ones that are not unique to ShapeShift.

He published a blog post about the bug on Tuesday.īax's analysis 'is a good real-world example of flaws in Monero that have been understood, theoretically, for a long time,' says Ian Miers, an assistant computer science professor at the University of Maryland and a cofounder of Zcash, a privacy-focused digital currency. The bug appears to have been discovered by multiple parties, including Nick Bax, who recently received a doctoral degree from Stanford University School of Medicine and is an independent analyst who studies blockchain and cryptocurrencies. The issues also put at risk the privacy of some other users of Monero, a cryptocurrency designed to provide a high degree of privacy, who transacted on ShapeShift. See Also: OnDemand | Steps You Can Take Right Now to Guard Against Ransomware Attacks Weaknesses in the systems of ShapeShift, a U.K.-based cryptocurrency exchange, reveal how a North Korean-linked group laundered cryptocurrency that came from a notorious ransomware attack in 2017.

Western union bug professional