brgv-Hodl.btc, ☪, ﷲ, ₿

(98, 105, 116, 99, 111, 105, 110)

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@RepNancyMace Really?

[BTCPay Server @BtcpayServer]

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.

Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.

If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.

[Student Of Things @studentofthings]

Just confirmed, I found the Coldcard RNG bug 11 months ago and never reported it because they didn’t acknowledge me on the first one I reported.

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@matteopelleg Worst case scenario

[TFTC @TFTC21]

COLDCARD Security Update: Coinkite Explains the Entropy Bug

Coinkite has published a detailed technical breakdown of the COLDCARD seed generation vulnerability disclosed yesterday.

During a 2021 migration to Bitcoin Core's libsecp256k1 library, seed generation accidentally started pulling from MicroPython's software random number generator instead of COLDCARD's dedicated hardware RNG.

The bug slipped through because both functions shared the same name, allowing the wrong one to be silently selected during the build process without triggering an error.

The Mk3 is the most affected device. Seeds generated on firmware 4.0.1 and later have an estimated effective search space of roughly 40 bits, far below the intended 128-bit security target, and those users should migrate immediately.

The Mk4, Q, and Mk5 models mixed in additional entropy from their SE1 and SE2 secure elements, bringing the effective search space to approximately 72 bits, better but still well below the 128-bit target.

Users need to update their firmware (Mk3 to 4.2.0, Mk4/Mk5 to 5.6.0+, Q to 1.5.0Q+), generate a completely new seed, and migrate their funds to the new wallet. Updating firmware alone does not fix a seed that was already generated by the affected versions.

Even users who added dice rolls or a BIP-39 passphrase during original seed creation should strongly consider migrating unless they are certain they used at least 100 fair, independent rolls.

Coinkite acknowledged that AI likely helped the attacker discover the bug, noting they had recently used AI to review their own code and it missed the issue entirely.

Full technical backgrounder: https://t.co/MKTy7T3wY9

[nvk @nvk]

https://t.co/N60cz5Yprl

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@hwill212001 @BitcoinArchive 💯

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@MDBitcoin Come on, be patient, October is approaching, and you'll be grateful for 49K. By the way, 200K is the next top and it will be in October 2029...

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@BitcoinRachy Yes, perfect entry, around 49k, Ben promised it me...

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@myzccc Goat

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@saylordocs Level 7, I don't know what that it is, but anyway...

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@puckrin It's simple, chinese have already such technology...

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@BitPaine Shut up, 200K top in late 2029

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@ArabianAnon @RamAbdu Yep

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@JoeCarlasare Wait, only when Ben will allow....

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@benjamincowen I believe this time is different...

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@jacksonhinkle Warmonger

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@layeredstacks @TFTC21 Yep, Ben promised me 49K in October

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@saylordocs Nobody takes this guy seriously

[brgv-Hodl.btc, ☪, ﷲ, ₿ @be12v]

@PeterMcCormack Absolutely