Crypto crime (financing terror, money laundering, fraud, ponzi, etc.)

Welcome to the Precious Metals Bug Forums

Welcome to the PMBug forums - a community supported watering hole for folks interested in gold, silver, precious metals, sound money, investing, market and economic news, central bank monetary policies, politics and more.

Register a free account to join the discussions. When you register an account and log in, you may enjoy additional benefits including access to market data/charts and additional members only rooms (including one for trade/barter with the community).

Ledger tech guy weighs in on the Coldcard issue. Warning: Extreme level computer geek talk:
...
Cryptography is hard. Implementing it securely is harder. And the part almost nobody thinks about, generating high quality randomness, is where the whole thing lives or dies.

This week's Coldcard incident made that visible in the most expensive way possible.

What broke. Every private key you own derives from one number: the seed. If that number is predictable, everything derived from it is too. Coldcard's firmware was supposed to draw that seed from a dedicated hardware RNG. It didn't. A guard checked whether a config macro was defined, not whether it was enabled, so the build silently fell back to a software generator seeded from the chip's serial number and timer, values an attacker can reconstruct. Older devices were effectively deterministic; current ones were capped near 32 bits, about four billion possibilities. A seed space advertised as 128 bits collapsed to something you can enumerate. Researchers estimate more than 1,000 BTC drained from roughly 1,200 wallets, from a flaw sitting in public code since March 2021. The device never had to be touched.
...
Click to expand...

 
Non-technical analogy/explanation of the Coldcard issue:
...
In simple terms, here’s what happened:

Imagine your 24-word seed phrase is like a lottery ticket that should be picked from an unimaginably huge number of possibilities. Normally, the chance of someone guessing it is effectively zero.

With some versions of the Coldcard firmware, a bug meant the wallet wasn’t using enough true randomness (“entropy”) when creating new wallets. Instead of choosing from an astronomically large pool, it unknowingly chose from a much smaller pool.

A simple analogy

Think of it like this:

Correct behavior: Pick one grain of sand from every beach on Earth.
Bugged behavior: Pick one grain from just one bucket of sand.

It’s still hard to guess—but suddenly it’s realistic for a determined attacker with enough computing power.

What actually happened?

A firmware bug caused the random-number generator used during wallet creation to produce less random seeds than intended.

According to Coinkite’s analysis:

Mk3 devices could end up with roughly 40 bits of effective entropy.
Mk4, Mk5 and Q were less affected but still only had around 72 bits of effective entropy for affected seeds, instead of the much stronger randomness expected.

Why were coins stolen years later?

The seed was weak from the very moment the wallet was created.

Attackers later figured out the flaw and were able to:

Scan the Bitcoin blockchain for addresses.
Recreate candidate seeds using the weakness.
Check whether those seeds matched wallets with Bitcoin.
Spend the coins if they found a match.

The Coldcard itself wasn’t hacked. The vulnerability was in how some wallets were originally generated.
...
Click to expand...

 
4th wave - theft total keeps rising

 
Trezor owners at risk of home invasion/ burglary:

 
Just a little food for thought, make of it what you will. Some replies are pretty good.

 
pmbug said:
I'm seeing a lot of reports like this on X today:



Scary stuff.
Click to expand...

I'm late to the raiding-party...of course there's none of this in the Institutional Mediuh; the Bitcoin Bro's are keeping it on the down-low...but the schadenfreude is strong on this one.

The red flag, for my simple mind: The complexity, of programs that even the average geek or Tech Bro won't understand without deep study. Even someone INVOLVED with part of it, won't understand the weakness of other, unrelated programs.

Such as ColdCard. How off-line is it, really? Relies on a random generator for pass phrases...there's a flaw point, right there, as noted further down in the discussion. And, this Wasabi monitoring program? Unrelated to the hack, but is it another security weakness? Can IT be used to find inactive "wallets" that can be hacked, looted and sold, before the Bitcoin Dupe even knows it happened?

What's that us metal-stackers say? If you don't hold it, you don't own it. I would further posit that if you don't understand it, you can't protect it.
 
searcher said:
Just a little food for thought, make of it what you will. Some replies are pretty good.

Click to expand...

He explains the motives well and probably is pretty accurate on the history and depiction of the thought-processes.

I've always thought Yeung was a little simple on his theses on gold price and why China would be such a driver, but here, he seems to have captured it well. Perhaps it's the language barrier that has him not explaining other questions as well in the past.
 
Yeah, FedGov gonna protect all the Widdle Peepul...sure.

Ever notice?...the one thing that seems to unite all these bitcoin pumpers and promoters, is their CHILDLIKE TRUST, in, variously, the coding, and that government will keep its hands off it? And protect their ability to trade in a non-legal-tender medium?

According to the CIA plant Satoshi, whatever his name was supposed to be...bitcoin was supposed to be the answer to various problems of fiat. Like, "inflation." Which government would pretend is a natural, unstoppable force - but obviously is not; it's another name for currency debasement, done deliberately BY this government.

And these low-T soyboiz are trusting government to help and protect their alternate currency. Sure. Even to prosecuting cyberthieves and hackers.

Sure. When did government EVER allow a competing currency to their own legal-tender fiat?
 
You must log in or register to reply here.
Back
Top Bottom