Nonce 255: The Twelve-Second Execution of Ethereum's Weakest Keys

Here is a data point that should close the argument. Every Ethereum address derived from a private key with a value between 1 and 255 has a nonce greater than zero. Not most of them. All 255. Someone, at some point, spent gas to send each of those addresses a transaction — a dusting, a wake-up call, a marker placed on a map. Unchained verified the low-balance address activity independently on-chain. That single observation is the most complete census of an automated surveillance grid I have seen published this cycle, and it arrived as a footnote to a one-dollar experiment.

Austin Griffith, who has spent years building developer education at the Ethereum Foundation, funded a handful of addresses whose private keys were chosen from the bottom of the integer line — 6969 first, then shorter decimals. Total exposure: roughly a dollar. The money did not survive a single block. Twelve seconds, approximately one mainnet block time, and the balance was zero. Three pending transactions were visible in the mempool at once before the sweep confirmed. Three separate actors were racing for one dollar.

That is the shape of the thing. Now the mechanics.

Context: What "Weak" Actually Means

A private key is an integer in the range [1, 2^256). The security of every ECDSA signature on Ethereum rests on the assumption that an attacker cannot guess which integer you chose. The number of candidate integers is approximately 1.16 × 10^77 — a cardinality so far beyond physical intuition that it functions as a mathematical restatement of "unknown."

The key 6969 does not live in that space. It lives in the space of four-digit decimals. Ten thousand candidates. Any laptop enumerates that in microseconds and derives the corresponding addresses without touching a network. "Weak key" is not a metaphor and not a vulnerability class; it is a cardinality statement. The entropy of the secret is the entire security argument, and nothing downstream — hardware wallets, multisig, social recovery, MPC — repairs a secret drawn from a ten-thousand-element set.

The second mechanic is the mempool. Ethereum's public mempool is an intent broadcast layer. A pending transaction is a signed, plaintext statement of what you are about to do, visible to anyone before inclusion. I have written at length about concrete code defects — the unsigned integer overflows I found in 0x v0.9.9's fillOrder path back in 2017 were a textbook case of arithmetic failing silently. The mempool is a different animal. It is not a bug. It is an architectural disclosure, working exactly as designed, and it hands every searcher a preview of your balance change.

The third mechanic is the other half of the story, and it is where the entropy lesson stops being about crypto traders. eMudhra, a certificate authority, was found to have eight intermediate CA keys whose values were each integers below 256. One of them was 4. Mozilla's Dennis Jackson published the disclosure; independent researcher Scott Helme corroborated. Firefox and Chrome distrusted the CA on October 17. Microsoft followed on October 20. eMudhra announced it was exiting the SSL/TLS business on October 22. Five days from disclosure to corporate retreat from a product line.

Core: An Enumeration Engine With a Gas Bill

Start with the economics of the sweep, because the economics explain the speed.

The attacker's decision is not "can I enumerate this key." At four digits the answer is trivially yes. The attacker's decision is "is the balance in this address greater than the cost of the transaction that claims it, plus the risk that a competitor outbids me." In the Griffith experiment, the balance was about a dollar, and the successful bot spent most of it on gas. Reported figures put the great majority of the deposit into network fees. That is the signature of a contested race, not a profitable one. A single searcher pays near-zero gas. Three searchers bidding against each other converge on spending the prize itself.

This is why the mempool matters more than the key space. The bot does not need to find your key to take your money — it needs to find your key, sign the sweep, and then win the auction that follows. The version of this I modeled when I spent three months simulating slippage on Curve stableswap pairs had the same structure: the profitable actor is the one who sees the pending state change first, and the profit margin is the difference between their gas bid and the next bidder's. In a $1 honeypot, that margin is approximately the whole dollar.

Now the boundary, which is where the interesting data lives. Griffith tested increasing key lengths. Reportedly, a ten-digit key — ten billion candidates — was swept immediately. A twelve-digit key — a trillion candidates — was still unswept at the time of reporting. His own pre-experiment estimate was a threshold somewhere between eight and twelve digits. The measurement landed inside the predicted band.

Read that carefully, because the naive reading is wrong. The 8-to-12-digit threshold is an economic boundary, not a technical one. Ten billion candidates is not a hard problem; it is a problem with a price. A trillion candidates is a bigger price. That price is a function of GPU-hour cost, electricity, and the expected value of the target balance. Every one of those inputs moves. Hardware gets cheaper on a schedule. The threshold drifts right. Anyone treating "12 digits is safe" as a stable fact is treating a snapshot of a cost curve as a law of nature. Abstraction layers hide complexity, but not error — and "sufficient entropy" is one of the abstraction layers people most enjoy lying to themselves about.

The nonce census is the strongest forensic artifact in the whole report. A nonce greater than zero means the address has sent at least one transaction. For all 255 addresses below the 256 boundary to show nonzero nonces requires someone to have funded each one and moved the funds out. That is not casual opportunism. That is a maintained index. Somebody built and operates infrastructure that enumerates the low-entropy address space, funds it to eliminate the ambiguity of an untouched address, and sweeps anything that arrives. I have seen this pattern before in a different shape: in early 2021 I traced roughly 40% of popular ERC-721 collections to centralized IPFS pinning, and the lesson was identical — the layer everyone assumed was distributed had a small number of operators who were never named in the marketing. The low-entropy key space has operators too. They are just quieter.

Which brings us to eMudhra, and the reason the two stories belong in one article.

A CA's intermediate key is a signing secret. If you can enumerate it, you can mint a certificate that chains to a trusted root, and every browser will accept it. The values here were below 256. One was 4. Enumerating 4 requires counting. There is no cryptanalysis in this story, no side channel, no fault injection. The failure was arithmetic, not attack.

And notice where the leak sat: intermediates. Intermediates are the operational, high-churn, low-ceremony part of a PKI hierarchy. They get issued, used, rotated, and reissued by teams under schedule pressure. Root keys sit in HSMs behind ceremony scripts and dual control. Intermediate keys sit on a build machine because someone needed to test something on a Friday. This is precisely the place where entropy hygiene degrades, and it is precisely the place where a single bad integer compromises the entire chain below it. Reversing the stack to find the original intent — here the intent was "get a cert issued," and the secret protecting that intent was a single digit.

What followed is the part the crypto industry should study. No lawsuit. No regulatory hearing. Firefox and Chrome removed trust on October 17, Microsoft on October 20, and the CA exited the SSL/TLS business on October 22. Root store removal is the only enforcement mechanism in modern PKI with genuine teeth, and it operates faster than any court, with no discovery, no appeal, and no published standard for what counts as sufficient key entropy. That is the uncomfortable observation. The system that caught this failure is also the system that can end a company in seventy-two hours on a mailing list posting. It worked here. It is not accountable anywhere.

Contrarian: The Experiment Proves Surveillance, Not the Boundary

I want to be precise about what was and was not demonstrated, because the reporting has been sloppy on this point.

Griffith did not publish the 14- and 16-digit private keys. That is defensible — publishing them would hand the addresses back to the bots and invalidate the test. But it means Unchained could not independently verify the longer-key results. The "12 digits survived" claim is single-source. Truth is not consensus; truth is verifiable code, and an unpublished key is not verifiable.

More importantly, "not yet swept" has two possible explanations, and the reporting collapsed them into one. Either the search space was beyond the attackers' capacity, or the address balance was not worth the gas bid war. A bot scanning a trillion candidates must amortize that scan across expected value. A one-dollar bait does not justify a trillion-candidate sweep. The experiment measured willingness to pay, not capability. If Griffith had funded the 16-digit address with $50,000, I would expect a very different result and a very different headline.

The blind spot that nobody is discussing is internal infrastructure. Every exchange, custodian, and wallet team I have ever audited has a folder of throwaway wallets whose keys were generated by a human typing something memorable, because the test needed to be reproducible. These are not in the mempool until they are funded. When they are funded — during a migration, a stress test, a customer support reproduction — the index is already watching. The 1-through-255 census proves the index exists. It does not tell you how deep it goes.

Takeaway

The open question is not whether twelve digits is safe. It is how fast the threshold moves, and who is measuring it. Griffith's unpublished 14- and 16-digit addresses are the only instrument currently pointed at that boundary, and their disclosure — or non-disclosure — will determine whether we get a number or a rumor. Meanwhile, every organization holding a key generated by a human should assume it is already indexed, funded or not, and rotate. The bots have a census. The question is whether you have one of your own.