FAQ

What is Unlukey?

Unlukey is a collaborative research project on weak crypto wallet generation vulnerabilities.

What does Unlukey currently cover?

Unlukey currently supports two ways to check for known seed-generation vulnerabilities: the website checks public wallet addresses, while the SDK lets wallets check recovery phrases directly when they are imported.

What's the difference between the website checker and the SDK?

The website checker looks up a public wallet address. The client SDK lets wallets check a recovery phrase directly when it is imported.

What does a match in the website checker mean?

A match means the address is associated with a known weak seed-generation vulnerability. The corresponding recovery phrase can be discovered by an attacker.

What should I do if my address matches?

If your address matches, funds controlled by the same recovery phrase are at risk. The safest remediation is to create a new wallet with a new recovery phrase and migrate your funds to addresses from that new wallet.

Does a negative result mean my wallet is safe?

No. A negative result only means the address was not found in the datasets currently covered by Unlukey. The datasets are not exhaustive and cover specific recovery phrase types, networks, and derivation paths, as described in each dataset’s scope.

Does the Unlukey website checker send my address to a server?

No. The website checker runs entirely in your browser. Your address is not sent to Unlukey’s servers.

Do I ever need to enter my recovery phrase or private keys on the Unlukey website?

No. The website checker only needs a public wallet address. Never enter your recovery phrase or private keys into the checker.

How can I get updates?

Follow @coinspect, where we will be posting updates.

Who are you?

Coinspect is a security research and auditing firm that has been working in the blockchain space for more than 12 years.