Post #4288101

Coindesk: Major bitcoin wallet flaw drains $38 million worth of BTC in 25-minute sweep A wallet’s seed, the secret phrase controlling the funds, is meant to be drawn at random from a pool so vast that guessing is hopeless. Coldcard’s firmware was not doing that. According to a report published by Block’s Bitcoin engineering and security teams, a build setting told the device to skip its own hardware randomness generator, and a check in a supporting library tested only whether that setting existed rather than whether it was switched on. Key generation quietly fell through to a basic software substitute seeded from the chip’s serial number and clock registers.