cryptd.in

암호화폐 친화적인 인재를 위한 대체 링크드인

COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

-

by

cryptd.in
in

Bitcoin Magazine

COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

First, yes, that is a very clickbait title and completely unusual. This is a real security issue. Here is the official announcement from Coinkite themselves posted yesterday, please read and verify the genuineness of the issue there.

TLDR: Coldcard MK3, MK4, MK5 and Q are being drained. A bug lets attackers find your seed phrase without any action on your part. Only wallets generated using the dice roll method are safe, assuming you rolled at least 50 dice. If you don’t know, don’t remember, or aren’t sure, move your funds immediately.

This is a critical issue that requires immediate action. If you used a Coldcard to generate a word seed and did NOT use the recommended 50+ dice rolls to provide your own entropy after the end of 2020, your word seed is not secure. It was generated without a sufficient amount of randomness, and can be brute forced by a malicious attacker. Wallets are actively being drained now. This issue also affects any ephemeral keys and session keys for Clone Coldcard or Key Teleport features, and BIP 85 seeds generated from a compromised seed. YOU MUST STILL MOVE YOUR FUNDS. 

This attack is being actively exploited, with around 1000 BTC seen moving on-chain connected to the vulnerability. 

Breath, and relax. You must move your funds to a new word seed, or a word seed generated by a different device, in order to secure your funds.

–   If you have another hardware wallet that is not a Coldcard, send your funds there. This is the quickest and simplest way to get them someplace secure.

–   If you do not have another hardware wallet, and only have a Coldcard, generate a passphrase using at MINIMUM six seed words from the BIP 39 word list. Use this guide to select your words for the passphrase, do NOT pick them yourself. Check your wallet fingerprint (or an address), power down your device, restart it and re-enter the passphrase. Confirm that the fingerprint (or address) matches, and send your funds to the passphrase wallet. This is not a permanent solution. This is simply giving you enough security that an attacker will not be able to brute force your keys in a matter of days, and you can generate a new seed without being in a state of panic. Make sure your passphrase is written down securely.

–   If you have no other options, or are uncomfortable with using the device at all, Nunchuck wallet available on mobile and desktop. Take your time, don’t rush yourself too fast, and make sure that all of your backups are done properly. After you have verified backups, send your funds to this wallet. If you are managing significant sums, Nunchuck has support for multisig. You can create one using multiple devices. Blockstream Green and Bluewallet are two other options for software wallets. 

Once your funds are secure, take a minute and relax. Coldcards are still safe to use as long as the word seed is generated securely. A firmware patch has been released here. Any word seed generated after this firmware update should be secure (and you can use the dice roll option too). If you have transferred your funds to a hot wallet, or something less secure, your Coldcard is safe to use after applying the firmware update and generating a new seed.

Once you have secured your own funds, stop and take stock. Reach out proactively to anyone you know who might be using a Coldcard that was vulnerable when they generated their seed. Inform them of the issue, and if needed (and you are capable) help walk them through migrating their funds. Everyone doesn’t pay attention to Bitcoin news on a regular basis, so many people might be unaware that they are even vulnerable.

This post COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED first appeared on Bitcoin Magazine and is written by Shinobi.

댓글

답글 남기기

이메일 주소는 공개되지 않습니다. 필수 필드는 *로 표시됩니다

최신 피드

인기 카테고리

ko_KR 한국어
ko_KR 한국어 en_US English ro_RO Română et Eesti ja 日本語 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

웹사이트 검색

인기 스토리

태그

#AlexeyPertsev (1) #BidenCryptoBan (1) #BidenElection (1) #BinanceVsCoinbase (1) #B비트코인 (456) #BitcoinETF (3) #B비트코인기초 (1) #B비트코인 취급 (1) #B비트코인가격 (5) #B비트코인가격수준 (1) #B비트코인펌프 (1) #B비트코인예치 (1) #B비트코인서지 (1) #BitcoinTop (1) #Bitfinex (1) #B비트 단위 (1) #브레이스브리지캐피털 (1) #BRC20토큰 (1) #BTC취득 (1) #B울리스틱 예측 (1) #BullishSentiment (1) #C중국광업 (1) #CPIP리뷰 (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #CryptoMania (1) #CryptoMarket (4) #CryptoPrediction (1) #CryptoPredictions (1) #CryptoRegulation (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty (1) #DerivativeJump (1) #Dogecoin (74) #DogecoinGains (1) #DogecoinVolume (1) #DutchCourt (2) #ECommerce (1) 1TP5테엘살바도르비트코인 (1) 1TP5테더리움 (74) 1TP5테더리움통증 (1) 1TP5테더리움가격 (1) 1TP5전문가 의견 (1) #FedRateCut (1) #FiatCurrency (1) #FinancialImpact (1) #FinancialPrivacy (1) #FirmShutdown (1) #FrozenAccounts (1) #IllicitFunds (1) #인플레이션데이터 (1) #투자 (1) #투자손실 (1) #일본기업 (1) #LegalAction (1) #LegalImpact (1) #법률 (1) #라이트닝 네트워크 (1) 1TP5시장분석 (3) 1TP5시장 모니터링 (1) 1TP5시장 예측 (1) 1TP5시장 예측 (1) #MarketProjection (1) 1TP5마켓지원 (1) 1TP5시장변동성 (1) #M결혼 (1) #MemeCoin (5) #MemeCoins (2) #M광부수익성 (1) #MoneyLaundering (2) #MtGox (4) 1TP5북한암호화 (1) 1TP5노보그라츠예측 (1) #P가격 마일스톤 (1) #P가격 예측 (2) #P가격 질문 (1) #PriceSurge (1) #P형량 (1) #QuantAnalysis (1) 1TP5규제압력 (1) #SEC안티크립토 (1) #ShibaInu (6) #SocialBuzz (1) 1TP5기술분석 (1) #Toncoin (3) #TornadoCash (3) #TornadoCashDev (1) 1TP5토네이도캐시개발자 (1) #UKCrypto (1) #업사이드 잠재력 (1) #USCongress (1) #와이오밍랜드 (1) #XRP가격 (1) #XRP업스윙 (1)

유용한 링크

유용하다고 생각되어 공유하고 싶은 링크.