UC researchers warn third-Party AI routers are stealing crypto and private keys

cryptonews04-13 17:36

Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials. Summary Researchers found that 26 third-...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2627743938?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-04-13 17:36","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2627743938","market":"sh","top_or_hot":-1,"title":"UC researchers warn third-Party AI routers are stealing crypto and private keys","media":"cryptonews","content":"<div>\n<p>Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials.\n\n\nSummary\n\n\n\nResearchers found that 26 third-...</p>\n\n<a href=\"https://crypto.news/uc-researchers-warn-third-party-ai-routers-are-stealing-crypto-and-private-keys/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>UC researchers warn third-Party AI routers are stealing crypto and private keys</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nUC researchers warn third-Party AI routers are stealing crypto and private keys\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-04-13 17:36 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/uc-researchers-warn-third-party-ai-routers-are-stealing-crypto-and-private-keys/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials.\n\n\nSummary\n\n\n\nResearchers found that 26 third-...</p>\n\n<a href=\"https://crypto.news/uc-researchers-warn-third-party-ai-routers-are-stealing-crypto-and-private-keys/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"STCE","symbol_name":"Schwab Crypto Thematic ETF","start_time":0,"source_url":"https://crypto.news/uc-researchers-warn-third-party-ai-routers-are-stealing-crypto-and-private-keys/","article_id":"2627743938","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/uc-researchers-warn-third-party-ai-routers-are-stealing-crypto-and-private-keys/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2627743938","pubTimestamp":1776072965,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials.Researchers found that 26 third-party LLM routers are actively injecting malicious code and stealing credentials by exploiting their access to plaintext data.The study revealed that intermediaries can intercept private keys and cloud credentials because they terminate secure encryption to aggregate AI requests.According to a paper published on Thursday by University of California researchers, the supply chain for Large Language Models  contains several vulnerabilities that allow for malicious code injection and credential extraction.These intermediaries, which developers use to manage access to providers like Google or OpenAI, essentially act as a “middleman” that terminates secure encryption.During the experiment, one router successfully drained Ether from a decoy wallet after the researchers provided a prefunded private key.A permanen","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"STCE":"Schwab Crypto Thematic ETF","GDLC":"Grayscale CoinDesk Crypto 5 ETF","BITW":"Bitwise 10 Crypto Index ETF","AIPO":"Defiance AI and Power Infrastructure ETF","CHAT":"ROUNDHILL GENERATIVE AI & TECHNOLOGY ETF","BK7095":"多种金属与采矿","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","DIME":"CoinShares Altcoins ETF","LLM.AU":"Loyal Metals Ltd","ARTY":"ISHARES FUTURE AI & TECH ETF","AGIX":"通用人工智能 ETF-AGIX","DAPP":"VanEck Digital Transformation ETF","BKCH":"AdvisorShares Sabretooth ETF","BITQ":"Bitwise Crypto Industry Innovators ETF"},"translate_title":"加州大学研究人员警告第三方人工智能路由器正在窃取加密和私钥","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BKCH":1.5,"STCE":1.5,"BITQ":1.5,"AIPO":1.5,"DAPP":1.5,"GDLC":1.5,"CHAT":1.5,"BITW":1.5,"ARTY":1.5,"LFGY":1.5,"AGIX":1.5,"DIME":1.5,"LLM.AU":1},"content_text":"Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials.\n\n\nSummary\n\n\n\nResearchers found that 26 third-party LLM routers are actively injecting malicious code and stealing credentials by exploiting their access to plaintext data.\nThe study revealed that intermediaries can intercept private keys and cloud credentials because they terminate secure encryption to aggregate AI requests.\n\n\n\nAccording to a paper published on Thursday by University of California researchers, the supply chain for Large Language Models (LLM) contains several vulnerabilities that allow for malicious code injection and credential extraction. \nThese intermediaries, which developers use to manage access to providers like Google or OpenAI, essentially act as a “middleman” that terminates secure encryption. \nBecause they have full plaintext access to every message sent through them, sensitive data like seed phrases or private keys can be intercepted by unverified infrastructure.\nEvasion tactics and the “YOLO” risk\nThe researchers tested 400 free and 28 paid routers to measure the extent of these risks. Nine of these services actively injected malicious code, while 17 separate routers were caught accessing Amazon Web Services credentials owned by the team. \nDuring the experiment, one router successfully drained Ether from a decoy wallet after the researchers provided a prefunded private key. \nAlthough the team kept the balances low to ensure the total loss remained under $50, the result confirmed how easily a compromised intermediary can siphon funds.\n“26 LLM routers are secretly injecting malicious tool calls and stealing creds,” co-author Chaofan Shou stated on X.\nIdentifying a malicious router is a difficult task for the average user. The researchers noted that because these services must read data to forward it, there is no visible difference between legitimate handling and active theft. \nThe danger increases when developers enable “YOLO mode,” a setting in many AI frameworks that lets an agent execute commands automatically without a human confirming the action. \nThis allows an attacker to send instructions that the user’s system will run instantly, often without the operator’s knowledge.\n“The boundary between ‘credential handling’ and ‘credential theft’ is invisible to the client because routers already read secrets in plaintext as part of normal forwarding,” the study explained.\nPreviously reliable routers can become dangerous if they reuse leaked credentials through weak relays. To prevent these attacks, the research team suggested that developers should never allow private keys or sensitive phrases to pass through an AI agent session. \nA permanent solution would require AI companies to use cryptographic signatures. Such a system would allow an agent to mathematically prove that instructions came from the actual model rather than a tampered third-party source.\n“LLM API routers sit on a critical trust boundary that the ecosystem currently treats as transparent transport,” the paper concluded.\n\n\n\n\n\n                Read more:\n            \n\n                Europe banks pick stablecoin partners as MiCA srives shift","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":null,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.40.0","shortVersion":"4.40.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2627743938","isCrawlerRequest":true}