FAQ

What is Unlukey?

Unlukey is a public checker for wallet addresses associated with known weak seed-generation vulnerabilities.

What does Unlukey currently cover?

Unlukey currently offers address lookup only for wallets with on-chain activity. Our goal is to reproduce exploited weak PRNGs, test likely unexploited variants, and cover each PRNG’s full vulnerable seed space. We need to collaborate with researchers and wallet developers to achieve this.

What does a match mean?

A match means the address is associated with a known weak-seed vulnerability. The corresponding recovery phrase can be discovered by an attacker.

What should I do if my address matches?

If your address matches, funds controlled by the same recovery phrase are at risk. The safest remediation is to create a new wallet with a new recovery phrase and migrate your funds to addresses from that new wallet.

Does a negative result mean my wallet is safe?

No. A negative result only means the address was not found in the datasets currently covered by Unlukey. The datasets are not exhaustive and cover specific recovery phrase types, networks, and derivation paths, as described in each dataset’s scope.

Does Unlukey check my address on a server?

No. The check runs entirely in your browser. Your address is not sent to Unlukey’s servers.

Do you ever need my recovery phrase or private keys?

No. Unlukey only needs a public wallet address. Never enter secret information into the checker.

How can I get updates?

Follow @coinspect, where we will be posting updates.

Who are you?

Coinspect is a security research and auditing firm that has been working in the blockchain space for more than 12 years.