The private key was 6969. One dollar of ETH went in. Twelve seconds later — one block — the balance was zero.
That is not a hack. Nothing was exploited. No contract was drained, no bridge was compromised, no governance proposal got sniped at 3 a.m. A number a human could memorize was converted into an address, the address was funded, and an automated process that had been waiting for precisely that event took the money. The theft is not the story. The waiting is.
In parallel, a certificate authority called eMudhra was discovering that eight of its intermediate signing keys were each an integer smaller than 256. One of them was 4. That means the private key protecting a link in the global TLS trust chain had roughly two bits of entropy. Firefox and Chrome distrusted the CA on October 17. Microsoft followed on October 20. By October 22 eMudhra had announced it was exiting the SSL/TLS business entirely. Five days, end to end.
Two events, two layers, one bug. Both systems assumed a secret was hard to guess. Neither system measured whether it actually was. Entropy is not a checkbox on a configuration form; it is a number, and numbers can be counted.
I have spent a good chunk of my career auditing key generation and the code that depends on it. The 2017 ERC-20 audit that made my reputation wasn't about re-entrancy in the transfer function — it was about the fact that the project's test harness seeded its random number generator with a timestamp. Three vulnerabilities, $2 million in avoided loss, and one lesson I have repeated in every engagement since: test the generator, not the output.
Austin Griffith's experiment is the cleanest public demonstration of that lesson I have seen. Griffith is an Ethereum Foundation developer, best known for SpeedRun Ethereum and for spending years teaching people how to write contracts rather than how to gamble on them. His setup was almost insultingly simple. Generate a keypair from a deliberately weak private key. Derive the address. Fund it with about a dollar. Watch what happens. The independent outlet Unchained then audited the results on-chain rather than taking his word for it.
On the certificate side, the disclosure chain was equally procedural. Dennis Jackson of Mozilla stood up a disclosure site. Scott Helme, an independent security researcher, verified the findings. The browser root programs did what root programs do when a subordinate CA cannot demonstrate control of its own keys: they removed trust, and they did it fast, because the alternative is every certificate under that intermediate becoming a forgery vector.
The timeline matters more than the outcome. Disclosure to distrust in under 24 hours for Firefox and Chrome. Microsoft lagging by three days. The CA itself exiting a core business line two days after that. That is not a slow-moving standards body. That is an immune response.
Now the arithmetic, because the arithmetic is where this gets interesting.
6969 in decimal is four digits. The full space of four-digit decimal keys is 10,000. In hexadecimal that is 0x1B39 — eleven bits of actual entropy, twelve if you are generous. Compare that to the 256-bit space a properly generated secp256k1 key occupies. The gap between 2^11 and 2^256 is not a difference of degree. It is a difference of category. One of those numbers is guessable by a laptop before your coffee finishes brewing. The other exceeds the estimated number of atoms in the observable universe by a margin that makes the comparison embarrassing.
Here is what most coverage of this experiment missed. The bots did not win because ECDSA is fast. They won because enumeration can be done once and reused forever. That is the entire mechanism, and it changes the economics completely.
Deriving an address from a private key is cheap — key generation plus a Keccak hash. A well-optimized GPU rig does millions per second. Enumerating 10,000 keys is instant. Enumerating 10 billion keys takes a while, but you only do it once. Store the resulting addresses in a sorted array, twenty bytes each, and you have built a lookup table that converts every future honeypot in that space into a binary search. The private key is the index. You do not need to store it. You just need to store the address and remember how you enumerated.
That reframes the whole frontier question. Griffith's reporting indicates the ten-digit space (10^10) was swept essentially immediately, while twelve digits (10^12) was not. Conventional reading: the bots hit a compute ceiling. My reading is different. The binding constraint at twelve digits is not processing power, it is storage bandwidth on the join between the table and the mempool. Ten billion addresses at twenty bytes is 200 gigabytes — a single NVMe drive, an afternoon of generation, and a consumer workstation. A trillion addresses is 20 terabytes. That is a rack, a compression budget, and a lookup latency that starts to matter when the funding transaction confirms in twelve seconds.
So the frontier is not a chip. The frontier is a disk. And disks get cheaper every year, which means the low-entropy exponent that is "safe" moves right on a schedule that nobody is publishing and nobody is pricing.
The twelve-second figure deserves its own scrutiny. Twelve seconds is not a speed record. Twelve seconds is the block time. No bot can execute faster than inclusion once a funding transaction is broadcast, so a twelve-second sweep is proof that the attacker was operating before inclusion — reading the mempool, deriving the address from the pending transaction's destination, and submitting a competing transfer with a higher gas bid. Three separate pending transactions were observed competing for the same dollar. That is not one actor. That is a market.
And the economics of that market are strange. Most of the dollar went to gas. The successful bot likely netted cents. Which tells you the honeypot was never the product — the precomputed table is the product, deployed across thousands of low-entropy addresses with small balances that no individual victim will ever bother reporting.
Then there is the forensic artifact that I find more damning than the sweep itself: the nonce census. Of the address space corresponding to private keys 1 through 255, not one address lacks an outgoing transaction. Unchained's verification confirmed it. Every single one has been used.
Think about what has to be true for that statement to hold. Those addresses were not funded by their creators. They were awakened. Something sent dust to each of them, or swept whatever arrived, on a schedule dense enough to cover the entire sub-256 space. The ledger remembers everything, including the fact that you were scanned. A nonce is not a neutral piece of account state. In this context it is a fossil record of automated interest.
The eMudhra case runs the same logic one layer up the stack. Eight intermediate keys, each an integer below 256, one of them literally 4. That is not a subtle bug. That is either a random number generator that failed catastrophically or — and I have seen this more times than I would like — a test fixture that was promoted to production because it was convenient. The person who wrote the key generation routine tested it, saw output, and shipped it. Nobody measured the output's distribution. Nobody counted the bits.
With roughly two bits of entropy, four guesses produce the key. Once an attacker has an intermediate key, they can sign certificates for any domain under that intermediate, and they can do it in a way that is indistinguishable from legitimate issuance. Revocation does not save you here. A CRL or an OCSP response is itself signed by the compromised key hierarchy. Smart contracts have no mercy, and neither does a trust anchor — once the private key is foreign-controlled, every downstream signature becomes hearsay. The only remaining lever is removal from the root store, which is exactly what the browsers did, and which is exactly why eMudhra had no path other than exiting the business.
Certificate Transparency logs help, but they are a detection mechanism, not prevention. A rogue issuance shows up. The site owner monitoring their own CT stream sees an unknown precert for their domain and panics appropriately. That is damage control running in parallel with damage.
This is where the mirror image becomes useful. In 2022 I mapped 850,000 wallets through the Terra collapse looking for the exact block height where solvency failed. The lesson from that forensic exercise was that systemic failure has a timestamp. Entropy failure has a timestamp too — it is just earlier and quieter. It happens in a key generation call, months or years before anyone notices, and it leaves no on-chain trace except the aftermath.
My methodology for evaluating this class of event is unglamorous. Build the enumeration harness. Derive addresses from the candidate key space. Join against mempool feeds and account state. Count. The Dune query is boring SQL over traces joined to a pipeline table of precomputed weak addresses; the Python is a loop and a sorted array. What makes it useful is that it is reproducible. Anyone can rerun it. Anyone can check whether the twelve-digit claim survives.
And here is where I stop applauding.
The twelve-digit result is a single-source assertion. Griffith did not publish the 14- or 16-digit private keys, and Unchained could not independently verify the upper end of the range. That is a defensible security decision — publish the key and you guarantee a race between spectators and bots — but it means the frontier is a claim, not a measurement. The lower bound is hard: ten digits fell, and the nonce census corroborates a comprehensive sweep of the trivial space. The upper bound is soft. Follow the data, not the narrative, and the data currently stops at what one researcher chose to disclose.
The second blind spot is more uncomfortable for the industry. Every headline from this experiment is about a honeypot, but the actual institutional exposure is elsewhere: internal test wallets, staging environments, and CI fixtures seeded with short keys. Nobody publishes those. Nobody wants to. If a corporate treasury's hot wallet was ever initialized from a passphrase, a timestamp, or a memorable number, it is in the same enumerated space as 6969 — and unlike Griffith's dollar, it will not be recovered by a browser root program.
The third blind spot is framing. This is not an Ethereum failure. The ledger performed exactly as designed; it is transparent, it is fast, and it does not discriminate between a bot and a human. The failure is upstream, in key generation, in the compliance documents that specify entropy requirements nobody actually tests. Treating this as a crypto-is-dangerous story lets every other system that relies on a secret off the hook — including the certificate authorities that just demonstrated the same defect at global scale.
What to watch next is narrow and specific. First, whether the 14-digit test eventually gets swept, and how long it takes — that single data point quantifies the current cost ceiling of the address-table ecosystem better than any paper. Second, CT log anomalies over the next quarter: if the eMudhra intermediates were weak, the siblings of that generator are worth auditing, and the logs will show forged precerts before the press does. Third, whether the CA/Browser Forum moves from guidance on key entropy to a testable ballot, because right now the standard is a recommendation and the enforcement is a root store deletion.
Twelve seconds is not a warning about bots. It is a measurement of how long a guessable secret survives contact with a public mempool. The number will get smaller. Nothing about the incentive to precompute goes away, and the storage that makes ten digits trivial today makes twelve digits routine within a few hardware cycles. The only variable that actually moves in the defender's favor is entropy — real entropy, generated by a CSPRNG, measured, logged, and audited. Everything else is a countdown.