Ethereum Foundation’s Griffith sets $1 wallet honeypots, sees bots drain weak keys in seconds

Rapid bot activity targets weak private keys

On-chain data confirmed that 0.0004 ETH, equivalent to about $1, was sent to the address corresponding to the key 6969 at 20:35 UTC on October 21. Within just 12 seconds, a transaction using the same key moved the funds out, with most of the deposit consumed by network fees. Three other addresses sent transactions to this wallet in rapid succession, but two attempts were unsuccessful.

Griffith’s deposit originated from a wallet labeled slop.atg.eth, which itself received funding from the austingriffith.eth address. This quick sequence of events showcased the vigilance of automated systems designed to monitor and exploit wallets with weak private keys.

On the show, Griffith observed that as soon as the deposit landed, three transactions were immediately pending in the mempool attempting to steal the funds.

He further remarked, “there’s not a number less than 256 that doesn’t already have a nonce,” indicating that all straightforward, low-number Ethereum private keys have been used to send transactions—suggesting near-complete scans by automated programs.

Mini dictionary: Mempool – Short for “memory pool,” this is a collection of unconfirmed transactions waiting to be mined into blocks on a blockchain network.

Testing key lengths and bot responses

Ahead of the experiment, Griffith predicted that automated bots would likely stop actively searching for easy-to-guess keys somewhere between eight and twelve digits. However, he later updated his findings, stating that wallets with 10-digit keys were emptied “right away,” while those with 12-digit keys remained untouched at the time of the discussion. He also mentioned having seeded wallets with 14-digit and 16-digit private keys as part of the ongoing test, intentionally inviting would-be attackers by depositing small amounts.

Griffith did not make public the exact values of these longer private keys. A review of on-chain records by Unchained showed that slop.atg.eth funded four additional wallet addresses about 14 minutes after the initial deposit. Of these, one wallet was emptied within 12 seconds, while three continued to hold their funds as of October 23. The particular key lengths associated with these addresses were not specified.

The podcast hosts noted their intention to follow up the following week to determine whether the 14- and 16-digit key wallets remained secure or were eventually compromised by bots.

Griffith stated that during his investigation, every private key from 1 up to 255 had already sent at least one transaction on the Ethereum mainnet, underscoring the thoroughness of automated scanning.

Automated scanning of simple keys on Ethereum

Ethereum transactions utilize private keys, usually long and randomly generated, to secure assets. Using predictable or short private keys makes wallets susceptible to attacks by bots that systematically search for vulnerable credentials. This experiment highlighted the prevalence and speed of such automated tools on Ethereum’s main network.

The results demonstrate that Ethereum mainnet wallets with very short, simple keys are immediately targeted and drained, often within seconds, which points to persistent surveillance by wallet-draining bots. More complex keys with greater length appeared to evade immediate discovery, but the experiment is ongoing to determine their eventual safety.

The story originates from a segment addressing whether bots are compromising the openness of the internet by automating vast portions of network activity.