If you had a more or less decent amount on a paperwallet created by the malicious successor of formerly clean Canton Becker's Bitcoin paperwallet generator, you likely don't have time to move your coins away because your coins would've been stolen rather quickly.
You are right. If the user uses a version that a backdoor has infiltrated, then the opportunity for assets to be stolen can be faster before the user has time to move it to another wallet.
However, when the crypto assets owned by the OP are still accessible (for example, he is using from a tool that has not been compromised), it is better to move to a new wallet than to continue using the address of the previously created Paper wallet.
Canton Becker's original paperwallet generator code is clean (it's still available on his Github) and can generate rather safe paperwallets if you trust Javascript's crypto functions to generate good enough entropy (that's a debate I don't want to emphasize upon).
It seems that the information on the wiki has been updated, including the GitHub link: https://github.com/cantonbecker/bitcoinpaperwallet (I saw the last update in October 2022).
I had previously read o_e_l_e_o's post before the update: BitcoinPaperWallet a likely scam - page needs updated.
As the Bitcoin wiki page indicates in red, the current version of the paperwallet generator website is malicious and would give you paperwallets known to the malicious owner of the website, even if you run the generator offline, because it uses predetermined entropy.
The site's code pretends that a user can add entropy by moving his mouse, but that's all fake and fog candles...
The site's code pretends that a user can add entropy by moving his mouse, but that's all fake and fog candles...
Here is one more explanation:
It's obviously scam, person who bought walletgenerator, has also bitcoinpaperwallet.
After some research, please look at this:
https://medium.com/mycrypto/disclosure-key-generation-vulnerability-found-on-walletgenerator-net-potentially-malicious-3d8936485961
and then you can find directory listing is enabled:
https://bitcoinpaperwallet.com/bitcoinpaperwallet/
and finally this modified website:
https://bitcoinpaperwallet.com/bitcoinpaperwallet/generate-walletfe23t9u2fhjnj3f32.html
random generator is broken in same way as in the article:
So, beware of bitcoinpaperwallet.com and walletgenerator.net, they will steal your coins !!!
After some research, please look at this:
https://medium.com/mycrypto/disclosure-key-generation-vulnerability-found-on-walletgenerator-net-potentially-malicious-3d8936485961
and then you can find directory listing is enabled:
https://bitcoinpaperwallet.com/bitcoinpaperwallet/
and finally this modified website:
https://bitcoinpaperwallet.com/bitcoinpaperwallet/generate-walletfe23t9u2fhjnj3f32.html
random generator is broken in same way as in the article:
Code:
var coinImgUrl = "https://bitcoinpaperwallet.com/bitcoinpaperwallet/images/logo-" + whichDesign + ".png";
...
var base64 = "data:image/png;base64," + btoa([].reduce.call(new Uint8Array(this.response),function(p,c){return p+String.fromCharCode(c)},''));
for(var i = 0; i < base64.length; i++)
{
if(i+3 < base64.length)
{
if(base64.charCodeAt(i) != 0 && base64.charCodeAt(i+1) != 0 && base64.charCodeAt(i+2) != 0 && base64.charCodeAt(i) != 1 && base64.charCodeAt(i+1) != 1 && base64.charCodeAt(i+2) != 1)
{
SecureRandom.seedInt((base64.charCodeAt(i) * base64.charCodeAt(i+1) * base64.charCodeAt(i+2))*(i+1));
}
}
}
SecureRandom.loaded = 1;
};
...
var base64 = "data:image/png;base64," + btoa([].reduce.call(new Uint8Array(this.response),function(p,c){return p+String.fromCharCode(c)},''));
for(var i = 0; i < base64.length; i++)
{
if(i+3 < base64.length)
{
if(base64.charCodeAt(i) != 0 && base64.charCodeAt(i+1) != 0 && base64.charCodeAt(i+2) != 0 && base64.charCodeAt(i) != 1 && base64.charCodeAt(i+1) != 1 && base64.charCodeAt(i+2) != 1)
{
SecureRandom.seedInt((base64.charCodeAt(i) * base64.charCodeAt(i+1) * base64.charCodeAt(i+2))*(i+1));
}
}
}
SecureRandom.loaded = 1;
};
So, beware of bitcoinpaperwallet.com and walletgenerator.net, they will steal your coins !!!
