pull down to refresh

1 sat \ 9 replies \ @tomlaies 2 Aug \ on: ColdCard users have allegedly been reporting drains since 2022 bitcoin
Raises an interesting question, if they did know, and wanted to patch it

What I find particularly interesting here is who did these drains 3 years ago?

  • Did an attacker know of this vulnerability and only slowly exploited it?
  • Or did Coldcard users create new wallets and found somebody elses wallet?
write
compose
254 sats \ 8 replies \ @justin_shocknet OP 2 Aug -420 sats

Since the entropy was so low you wouldn't need to know about the vulnerability specifically, just a naive collider script would get lucky once in awhile.

Knowing the vulnerability just ups the success rate. You can mine weak seeds just as you mine blocks.

Attackers in 2022 may not even know they were Coldcard seeds, just generally weak seeds.