MetaMask Warns of Security Vulnerabilities in Old Versions of Crypto Wallets

On Wednesday, MetaMask said that with the help of security researchers in Halborn, it discovered a critical security flaw in an older version of its encrypted wallet. The security firm was awarded a $50,000 bounty for the discovery.

For users of the MetaMask extension prior to 10.11.3, three prerequisites lead to a potential vulnerability. These are: (1) an unencrypted hard drive, (2) a secret recovery phrase that has been imported into the MetaMask extension on a device that has been compromised, stolen, or accessed without authorization, and ( 3) The "Show Secret Recovery Phrase" checkbox was used to view one's Secret Recovery Phrase on-screen during the import process.

"We've only discovered that the secret recovery mnemonic can be extracted under very specific circumstances, and while Halborn awaits disclosure, we've been able to introduce new protections."

Apparently, the vulnerability affects MetaMask wallet versions for all browser versions prior to the 10.11.3 update, and all operating systems that satisfy all three conditions, but not the mobile version.

MetaMask warned affected users to transfer funds from compromised wallets. However, keep in mind that all three of these conditions must be met for the vulnerability to be active on older versions of MetaMask.