Unlukey

Unlukey is a collaborative research project on weak crypto wallet generation vulnerabilities.

• Enter a wallet address to check whether it belongs to a wallet derived from a vulnerable seed. Never enter your recovery phrase or private key.
• The address is checked against the published datasets.
• If there is a match, the result identifies the vulnerability associated with the matching dataset and provides guidance on what to do next.

Privacy

Address matching runs locally in your browser — your address is never sent to a server.

Coverage

• Coldcard

  A weak-randomness vulnerability in Coldcard firmware caused recovery phrases to be generated using a software PRNG instead of the hardware RNG, reducing their effective entropy and allowing attackers to discover vulnerable recovery phrases and drain funds.

  Search space 22–72 bits

  View dataset scope

  coinkite advisory Wizardsardine technical analysis
• Ill Bloom

  A weak-randomness vulnerability in CryptoJS caused affected wallet applications to generate BIP39 recovery phrases with significantly reduced entropy, allowing attackers to discover vulnerable recovery phrases and drain funds.

  Search space 39–47 bits

  View dataset scope

  ill-bloom web Ill Bloom technical disclosure