pull down to refresh

168 sats \ 8 replies \ @k00b 30 Jul \ parent \ on: User reports their coldcard wallet being drained on Reddit bitcoin

If it's a compromised Sparrow there would be more than one victim.

write
compose
1 sat \ 1 reply \ @88b0c423eb 30 Jul

which version of sparrow?

reply
301 sats \ 0 replies \ @k00b 30 Jul

There were fake sparrows on the app store not too long ago.

reply
75 sats \ 5 replies \ @Scoresby 30 Jul

ah yes, i see that.

Also, it seems like they didn't even take all the utxos at a single address:

source

reply
333 sats \ 0 replies \ @Murch OP 30 Jul

I think Praveen is on the right track there. The attacker probably used some block explorer API and didn’t think that any address would have so many UTXOs.

Also, it would have been way harder for people to identify this as an attack if the attacker had used a different recipient address for each sweep.

reply
201 sats \ 3 replies \ @k00b 30 Jul

It could also still be an RNG problem ... if the reports of partial sweeps are wrong or the thief doesn't feel comfortable stealing everything in an individual's wallet (which would be surprising) or, after your edit, taking only some utxos is a bug in the attack.

reply
241 sats \ 1 reply \ @Scoresby 30 Jul

reply
103 sats \ 0 replies \ @optimism 30 Jul

Beat me to it.

reply
217 sats \ 0 replies \ @optimism 30 Jul

from lopp:

I had someone contact me about this earlier today and the one thing they noted is that their full wallet balance was not swept; it was only a handful of UTXOs that were swept. I told them I suspected that their seed was not compromised, but rather something they did had compromised individual private keys.
reply