Post #4330731

2026-08-02 12:58 UTC

Look at all the fleeced crypto idiots, say the people holding lots of cryptocurrencies (and who themselves have been robbed, rug-pulled or scammed multiple times over the years). The crypto noobs are doing it all wrong, they say: The only safe way to store your crypto wealth is in an offline hardware wallet that would require physical theft to steal your coins. But this is now cold comfort for users of the hardware wallet Coldcard, which had a flaw that traces to a March 2021 firmware build which "routed seed generation to a predictable software randomiser instead of the chip’s hardware one, leaving a bounded set of possible keys that anyone with the disclosure and enough compute can reproduce offline, without ever touching a device." "Galaxy Research flagged a third wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday midday and Saturday morning UTC. That is just over a tenth of a bitcoin per victim. The July 30 opening wave averaged close to a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes. Observed losses across all three waves now total 1,367 bitcoin, nearly $89 million, from 4,585 addresses." https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million

Replies (6)

@stux@mstdn.social 2026-08-02 14:32

@briankrebs@infosec.exchange lol.. The ONLY truly secure way is to put them on a drive within a local wallet and destroy the drive No one will ever touch 'em again

Open ##4330786
@kims@mas.to 2026-08-02 15:52

@briankrebs@infosec.exchange I'm an atheist who somehow weirdly believes in Mammon so my reaction to bitcoin theft is a giant yawn But I'm surprised this particular theft isn't shaving a double-digit percentage off the price of bitcoin. Coldcard users are the small-dollar hodlers (as you note, the average theft was one coin) who followed all the rules and did everything "right." This theft should be emotionally destabilizing for a few million users I'd have thought hitting the true believers (as opposed to the cynical institutional holders who understand that bitcoin is bullshit) would have a greater knock-on effect as panic sweeps through the cult But no. The price has barely moved

Open ##4331790
@david_chisnall@infosec.exchange 2026-08-02 13:17

@briankrebs@infosec.exchange It’s almost as if there’s a reason modern banking systems require a mechanism to reverse fraudulent transactions.

Open ##4332773
@rob11563@mastodon.coffee 2026-08-02 14:03

@briankrebs@infosec.exchange Why Cryptocurrency Is A Giant Fraud https://www.currentaffairs.org/news/2021/04/why-cryptocurrency-is-a-giant-fraud

Open ##4343398
@samiamsam@mastodon.social 2026-08-02 14:04

@briankrebs@infosec.exchange *snort* someone stole my pixie dust *weeps*

Open ##4343399
@temporalthought@infosec.exchange 2026-08-02 14:15

@briankrebs@infosec.exchange honest question: bad rng aside, why not password managers to store cryptocurrency wallets?

Open ##4343400