In a vivid reminder of the risks involved for cryptocurrency investors, Ethereum slumped on Tuesday when a critical security vulnerability in a multi-signature wallet belonging to London startup, Parity Technologies, was triggered on 6th November, paralyzing wallets created after July 19, and freezing tens of millions in ethereum. Parity is the same company whose coding error helped hackers steal $30 million worth of ethereum; on Tuesday, the company admitted it was facing more security problems.

So someone managed to _accidentally_ make _all_ Parity multisig wallets suicide: https://t.co/Y4XI9JrDVL

Global shared state WTF people.

— Peter Todd (@petertoddbtc) November 7, 2017

Parity issued a “critical” security alert to inform its users about a bug that got “accidentally” triggered which resulted in freezing more than $280 million worth of ETH, including $90M belonging to Parity’s Founder & Ethereum former core developer, Gavin Woods. In the statement, Parity said that it had fixed the vulnerability that led to the original, July hack, but failed to catch and repair another weakness that allows users to rewrite code and take ownership of wallets that don’t belong to them. As a result, Bloomberg notes that many users found themselves unable to move funds out of their wallets because important code was deleted.

Ironically, Parity advised users not to deploy multi-signature wallets – the type impacted by the latest vulnerability – until the issue has been resolved. Multi-signature wallets are supposed to add an extra layer of security, as they require multiple verifications to confirm a transaction. The company hasn’t yet disclosed how many people have been affected.

Affected users: Users with assets in a multi-sig wallet created in Parity Wallet that was deployed after 20th July.

Following the fix for the original multi-sig issue that had been exploited on 19th of July (function visibility), a new version of the Parity Wallet library contract was deployed on 20th of July. However that code still contained another issue – it was possible to turn the Parity Wallet library contract into a regular multi-sig wallet and become an owner of it by calling the initWallet function. It would seem that issue was triggered accidentally 6th Nov 2017 02:33:47 PM +UTC and subsequently a user suicided the library-turned-into-wallet, wiping out the library code which in turn rendered all multi-sig contracts unusable since their logic (any state-modifying function) was inside the library.