Andrew

[Andrew @lawlesslogic]

@Vikingobitcoin9 Sickening. There is no excuse for this, it’s just fucked up

[Andrew @lawlesslogic]

@BitcoinPierre Except if he is north korean or russian or Chinese

[Andrew @lawlesslogic]

@LorenHodl Bitkey team really came through on this one, can imagine they will do well

[Andrew @lawlesslogic]

@clay_garrett Impressive

[Andrew @lawlesslogic]

@r0ckstardev @clay_garrett Please god 😂

[Andrew @lawlesslogic]

@CorySwan Retarded take, self custody is what makes bitcoin valuable, if you cant just keep dollars on the bank

[Andrew @lawlesslogic]

@HodlMagoo Verify, dont trust. Except no one is verifying

[Andrew @lawlesslogic]

@callebtc Its a dark day for self custody. This is what should have been the gold standard

[Andrew @lawlesslogic]

@zherbert @FoundationHQ I ran it against LLM’s, broken error check on the avalanche source, the seed task discarding the failure return, asserts compiled out in release. I did not verify the claims myself line by line

[Andrew @lawlesslogic]

@Mandrik As much as I like the company, they have shown real neglect on their end. Any seed related code should have been reviewed 1000x over. I can’t really bring it up feel sorry for them, they have cost people their life savings, there is no excuse

[Andrew @lawlesslogic]

@rot13maxi We should start poking all the RNG’s on other vendors hardware wallets, this is what attackers will start doing if they haven’t already

[Andrew @lawlesslogic]

@BTCsessions https://t.co/5Vm4NaL6bS

[Zero-Knowledge Goof (Loop master general) @LLFOURN]

MK4s are vulenerable but are millions of times harder to steal from. MK3s can be stolen from a decent laptop, mk4,5s and Q would need much more compute.

The model:
- attacker has a roughly 2^20 UUID range that it knows cold cards fall in
- checks a 16 button press variancer in user behavior before generating the seed

You should still promptly remove funds from mk4,mk5 and Q.

[Andrew @lawlesslogic]

@Pledditor Basically all of them - 72 bits is crackable

https://t.co/5Vm4NaL6bS

[Zero-Knowledge Goof (Loop master general) @LLFOURN]

MK4s are vulenerable but are millions of times harder to steal from. MK3s can be stolen from a decent laptop, mk4,5s and Q would need much more compute.

The model:
- attacker has a roughly 2^20 UUID range that it knows cold cards fall in
- checks a 16 button press variancer in user behavior before generating the seed

You should still promptly remove funds from mk4,mk5 and Q.

[Zero-Knowledge Goof (Loop master general) @LLFOURN]

MK4s are vulenerable but are millions of times harder to steal from. MK3s can be stolen from a decent laptop, mk4,5s and Q would need much more compute.

The model:
- attacker has a roughly 2^20 UUID range that it knows cold cards fall in
- checks a 16 button press variancer in user behavior before generating the seed

You should still promptly remove funds from mk4,mk5 and Q.

[Andrew @lawlesslogic]

@HodlMagoo This is far from over, incoming copycats with LLM’s

[Andrew @lawlesslogic]

@lopp @CasaHODL The solution is dice and passphrase

[Andrew @lawlesslogic]

@BitBoxSwiss This would be a good time to scrutinize your own code, a lot of people are hurting. No time to celebrate or advertise on this kind of event

[COLDCARD @COLDCARDwallet]

COLDCARD Mk3 Security Advisory

If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.

Mk4, Q and Mk5 are not affected based on our early analysis.

Read the advisory and migrate carefully:

https://t.co/3vgPHOjMS7

[Andrew @lawlesslogic]

@theinstagibbs Fuck, this is ugly

[Andrew @lawlesslogic]

@Pledditor Man I hope this isn’t what I think it is. This will hurt