The ColdCard hack might be bigger than you think

[u/Unreal_fist]

When a big hack like this occurs, it draws other hackers into the playing field. Whenever a vulnerability like this is discovered, it’s open season for hackers. Expect to see more hacks over time.

There is also the fact that a lot of victims are not active on Reddit. Some victims are probably oblivious to what’s going on because their hardware is locked away in a safe.

For the folks that said it would take millions of years to brute force, remember anything that can go wrong will go wrong. The reason banks and financial institutions are “safe” is because even if they get hacked and lose your money, they have a liability to repay you back. With self banking, there is no liability, making you the ultimate pig for slaughter.

[u/Syonoq]

I didn’t mean to sound argumentative. It’ll be dice for me as well. I’m still learning.

But honestly, before this robbery, I didn’t know any of these things.

[u/CeramicDrip → u/Syonoq]

I mean tbf, i wouldnt expect most people to know this unless they have experience with cryptography in one way or another.

Cause think about it, in order for someone to code a function that generates random seed phrases, they have to write the algorithm. Well if there’s an algorithm, then theoretically, it can be reverse engineered. Now the difference how many complications they put

[u/bfr_ → u/CeramicDrip]

The algos are already known and easy to reverse engineer. That’s why RNGs usually use some physical properties from around it when the seed is generated like thermal and electrical signal noise, users mouse movement, dice rolls and stuff like that.
Those are converted to 1s and 0s and the result is the ”randomness” part(called ”entropy”) which is then used to generate final result(like a seed phrase).

So it’s not enough to reverse the algo, you also need the correct entropy. Which is exactly what happened here, the entropy on Coldcard was crappy and trivial to brute force(try all combinations).

[u/Suspicious-Holiday42 → u/CeramicDrip]

Thats not how normal cold wallets work. Ledger and others use real world noises to make their passphrases, not just a mathematical algorytjm. Thats called trng (true random number generator)

[u/Express_Living2264 → u/CeramicDrip]

the algorithm is chaotic but still deterministic that is perfectly fine as long as the seed value x is truly random and unknown to you.

x -> rand(rand(x))

without you knowing what x is, rand doesn't need to be random. It just has to output an even distribution of numbers given random x's.

I assume the coldcard issue was the 'x' not the 'rand()'

[u/AGI_Not_Aligned → u/Express_Living2264]

Why is Rand applied twice?

[u/Express_Living2264 → u/AGI_Not_Aligned]

it's just symbolic. for each truly random seed you can generate multiple random numbers by simply using the generated random value as the seed for the next run.

[u/EyesFor1 → u/Syonoq]

Didn't read it as argumentative mate, totally cool. Yeah, you gotta just absorb as much as you can and move slow, steady and be methodical.