The blockchain allows users to use Elliptic Curve Cryptography (ECC) for greater security. Users can create a public and a private key. The private key is known only to the user and is kept somewhere hidden and secure. The public key, on the other hand, is used to create an Ethereum address.
When someone signs for a transaction, they use their private key and the signature is automatically verified by the Ethereum address.
A transfer then appears as a transaction between two Ethereum addresses.
When someone wants to generate their keys, they start with the private key. The private key consists of 256 bits. The public key is a point on the secp256k1 ECDSA curve (x, y point) [here]. Then Keccak-256 (aka SHA-3) is used to generate a hashed key and finally the public Ethereum address is generated [here]:
The private key that a user creates must be completely random. There are 2²⁵⁶ different keys that can be created. So the probabilities of matching a private and a public key are:
1 in 1,550,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 … 000 (75 zeros).
You can see a description of the code here.
Adrian Bednarkek wanted to see if he could guess someone's private address. If someone has a user's private key, they can easily steal cryptocurrencies, as they sign a transaction with the private address and can then transfer the cryptocurrency (Ether) to their account.
Adrian and his team tested billions of addresses and were able to guess hundreds of private addresses. In the end, 34 billion addresses were scanned and 732 keys were found. The team calculated that from even one of the accounts they were able to guess, they could collect 45,000 ETH, which corresponds to about $7 million.
Therefore, cryptocurrency users should be very careful. If someone steals your private key, creates a copy, or creates a weak address, they will gain access to your account and steal your cryptocurrencies. Unfortunately, in the cryptocurrency space, users are responsible for their own security. If they lose their money, no one will compensate them.
