クリプトドットイン

暗号に強い人材のためのオルタナティブ・リンクトイン

Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen

-

によって

クリプトドットイン
で

Bitcoin Magazine

Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen

The popular Bitcoin hardware wallet Coldcard product, made by Coinkite, is at risk following a $70 million hack.

Coinkite on Thursday admitted that its Coldcard Mk3 model was affected following the hack and advised users to move their funds. Then, on Friday, the company 前記 that users of the later hardware devices Mk4, Mk5, and Q should also take precautions. 

Hackers on Thursday were first able to drain funds from 1,196 Bitcoin addresses because their private keys were not generated using sufficient entropy — or randomness. 

Since then, a total of 1,082.65 Bitcoins have disappeared from wallets, according to data from Galaxy Research and engineers at payments company Block. 

While Coinkite has not admitted that the hack is linked to their wallets, the company has said that a wallet seed generation bug in Coldcard products meant the hardware’s true random number generator wasn’t actually being used on certain firmware versions. 

Coinkite and other engineers in the Bitcoin space are still investigating reportedly ongoing drains still happening at the time of writing.

What actually happened 

A firmware bug in Coldcard Mk3 devices (starting with version 4.0.1 in March 2021) caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator, producing seeds with only ~40 bits of entropy rather than the intended 128.  This made private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force.

A total of 594.5 Bitcoins worth over $35.7 million at today’s prices were moved to a new address from single-signature addresses on Thursday. 

More wallets were later drained, according to blockchain analysts, with the total now over $70 million. 

Various affected users shared their experiences on social media, with one saying that their Bitcoin had not been moved since 2021, and all of a sudden was swiped. 

Bitcoin engineers have since 前記 that Coldcard products — specifically the Mk3 models — had  “faulty entropy in wallet generation,” meaning they did not use real randomness to create a seedphrase. 

What to do 

Developers in the Bitcoin space have since urged users to move their funds if they used a Coldcard. Coldcard has issued guidance for users to take, which can be found これ.

Coinkite first said that their Mk3 models were affected but then on Friday said that those who did not use sufficient entropy to create a seed — in this case, 50 dice rolls — should generate a brand-new seed on the updated device. Others have warned to ditch Coldcard completely to be sure their funds are safe. 

“Everything is fucked,” wrote Kevin Loaec, CEO of Bitcoin security company, Wizardsardine. 

“Every single mnemonic generated [via a Coldcard] since 2021 will be public in the next few days,” Loaec warns.

This post Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

コメント

コメントを残す

メールアドレスが公開されることはありません。 ※ が付いている欄は必須項目です

最新フィード

人気カテゴリー

ja 日本語
ja 日本語 en_US English ro_RO Română et Eesti ko_KR 한국어 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

ウェブサイトを検索

人気記事

タグ

#AlexeyPertsev (1) #Bidenクリプトバン (1) #Biden選挙 (1) #BinanceVsCoinbase (1) #ビットコイン (456) #BitcoinETF (3) #ビットコイン基礎知識 (1) #ビットコインの取り扱い (1) #Bビットコイン価格 (5) #BitcoinPriceLevel (1) #BitcoinPump (1) #BitcoinReserve (1) #ビットコイン・サージ (1) #Bitcoinトップ (1) #Bitfinex (1) #ビットワイズ (1) #BracebridgeCapital (1) #BRC20トークン (1) #BTC取得 (1) #Bullish予測 (1) #Bullishセンチメント (1) #中国鉱業 (1) #CPプレビュー (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #クリプトマニア (1) #CryptoMarket (4) #CryptoPrediction (1) #Crypto予測 (1) 1TP5トリプトレギュレーション (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty（暗号の不確実性 (1) #Dデリバティブジャンプ (1) #Dogecoin (74) #Dogecoinゲイン (1) #Dogecoinボリューム (1) #ダッチコート (2) #ECコマース (1) #ElSalvadorビットコイン (1) #Ethereum (74) #EthereumPain (1) #EthereumPrice (1) 1TP5専門家の意見 (1) #Fedレートカット (1) #FiatCurrency (1) #フィナンシャル・インパクト (1) #フィナンシャル・プライバシー (1) #Firmシャットダウン (1) #F凍結アカウント (1) 1TP5自己資金 (1) #InflationData (1) 1TP5投資 (1) 1TP5投資損失 (1) #日本ファーム (1) #法的措置 (1) 1TP5法的影響 (1) #法律 (1) #LightningNetwork (1) #市場分析 (3) #Mマーケットモニタリング (1) #M市場予測 (1) #市場予測 (1) #M市場予測 (1) #Mマーケットサポート (1) #マーケットボラティリティ (1) #マリッジ (1) #MemeCoin (5) #Memeコイン (2) #Miner収益性 (1) #マネーロンダリング (2) #MtGox (4) #北朝鮮暗号 (1) #ノボグラッツ予想 (1) #Priceマイルストーン (1) #P価格予測 (2) #Price質問 (1) #プライスサージ (1) #Prisonセンテンス (1) #QuantAnalysis (1) 1TP5規制圧力 (1) #SECアンチクリプト (1) #ShibaInu (6) #SocialBuzz (1) #技術分析 (1) #トンコイン (3) #トルネードキャッシュ (3) #TornadoCashDev (1) #TornadoCashデベロッパー (1) #UKクリプト (1) #Upsideポテンシャル (1) #USCongress（米国議会 (1) #ワイオミングランド (1) #XRP価格 (1) #XRPupswing (1)

お役立ちリンク

私が役に立ち、共有したいと思ったリンク