Welcome to the PMBug forums - a community supported watering hole for folks interested in gold, silver, precious metals, sound money, investing, market and economic news, central bank monetary policies, politics and more.
Register a free account to join the discussions. When you register an account and log in, you may enjoy additional benefits including access to market data/charts and additional members only rooms (including one for trade/barter with the community).
...
Cryptography is hard. Implementing it securely is harder. And the part almost nobody thinks about, generating high quality randomness, is where the whole thing lives or dies.
This week's Coldcard incident made that visible in the most expensive way possible.
What broke. Every private key you own derives from one number: the seed. If that number is predictable, everything derived from it is too. Coldcard's firmware was supposed to draw that seed from a dedicated hardware RNG. It didn't. A guard checked whether a config macro was defined, not whether it was enabled, so the build silently fell back to a software generator seeded from the chip's serial number and timer, values an attacker can reconstruct. Older devices were effectively deterministic; current ones were capped near 32 bits, about four billion possibilities. A seed space advertised as 128 bits collapsed to something you can enumerate. Researchers estimate more than 1,000 BTC drained from roughly 1,200 wallets, from a flaw sitting in public code since March 2021. The device never had to be touched.
...
...
In simple terms, here’s what happened:
Imagine your 24-word seed phrase is like a lottery ticket that should be picked from an unimaginably huge number of possibilities. Normally, the chance of someone guessing it is effectively zero.
With some versions of the Coldcard firmware, a bug meant the wallet wasn’t using enough true randomness (“entropy”) when creating new wallets. Instead of choosing from an astronomically large pool, it unknowingly chose from a much smaller pool.
A simple analogy
Think of it like this:
Correct behavior: Pick one grain of sand from every beach on Earth.
Bugged behavior: Pick one grain from just one bucket of sand.
It’s still hard to guess—but suddenly it’s realistic for a determined attacker with enough computing power.
What actually happened?
A firmware bug caused the random-number generator used during wallet creation to produce less random seeds than intended.
According to Coinkite’s analysis:
Mk3 devices could end up with roughly 40 bits of effective entropy.
Mk4, Mk5 and Q were less affected but still only had around 72 bits of effective entropy for affected seeds, instead of the much stronger randomness expected.
Why were coins stolen years later?
The seed was weak from the very moment the wallet was created.
Attackers later figured out the flaw and were able to:
Scan the Bitcoin blockchain for addresses.
Recreate candidate seeds using the weakness.
Check whether those seeds matched wallets with Bitcoin.
Spend the coins if they found a match.
The Coldcard itself wasn’t hacked. The vulnerability was in how some wallets were originally generated.
...
I'm late to the raiding-party...of course there's none of this in the Institutional Mediuh; the Bitcoin Bro's are keeping it on the down-low...but the schadenfreude is strong on this one.I'm seeing a lot of reports like this on X today:
Scary stuff.
He explains the motives well and probably is pretty accurate on the history and depiction of the thought-processes.Just a little food for thought, make of it what you will. Some replies are pretty good.
More:
Bulgarian 'Cryptoqueen' Alive, Hiding in South Africa: Report
The spokesperson also claimed that LKA Düsseldorf had received clues suggesting Ignatova was in South Africa.news.bitcoin.com
Yah.There is so much news these days about hacks and security vulnerabilities in the entire crypto ecosphere from exchanges, DeFi markets and even hardware cold storage/wallets that it is hard to keep up. The crypto market is in shambles right now.
Binance Hack: $6.3B Drained on 9 Chains, $2.7B Frozen - Bitquery
Binance hack: $6.3B left Binance's hot wallets on nine chains in under four hours. $2.7B is frozen. We traced where the rest of the money sits.bitquery.io
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?