Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coldcard's $38M (so far) exploit shakes faith in self-custody

coindesk.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#11

Post by KetoManx64 »

swishman wrote: post #7

This is really bad. This is going to set bitcoin back years.. if it ever comes back. There really is no point and no real use case for it outside of crime. Unless the whole world order collapses in which case we'll have bigger problems..

- Yes it is bad, but there have been plenty of larger scale hardships in the past decade. - No it will not set back Bitcoin years - The US dollar is used for much more crime than Bitcoin ever has been - The financial world is collapsing in front of our eyes. The US dollar is inflating 8-12% every year, and the federal government wants to raise the debt ceiling even further. If you haven't realized how Bitcoin saves you from this by this point there's no point in trying to convince you otherwise.

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#12

Post by KetoManx64 »

expedition32 wrote: post #8
paulpauper wrote: post #4

so there was $70 million just sitting there for five years in the open that anyone could have taken. Nuts. Enticed by riches, hackers worldwide are now going through all firmware source code , wit the help of the latest AI models, for all wallets to find misconfigurations and other problems. Expect more thefts from low entropy bugs. AI has clearly been shown to be more more adept at auditing code than humans.

Meanwhile nobody has ever been able to hack a bank. Probably because they employ the actual pros unlike crypto.

> Nobody has been able to hack a bank

Bro, people lose hundreds of millions of dollars to bank scams on a yearly basis.

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#13

Post by name_nick_sex_m »

expedition32 wrote: post #8
paulpauper wrote: post #4

so there was $70 million just sitting there for five years in the open that anyone could have taken. Nuts. Enticed by riches, hackers worldwide are now going through all firmware source code , wit the help of the latest AI models, for all wallets to find misconfigurations and other problems. Expect more thefts from low entropy bugs. AI has clearly been shown to be more more adept at auditing code than humans.

Meanwhile nobody has ever been able to hack a bank. Probably because they employ the actual pros unlike crypto.

And their source code isnt wide open for analysis

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#14

Post by pants2 »

angry_octet wrote: post #6

Incredible hyperbole from the Amicus guy: "This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future," Lawrence said. "That dream is over. Done." Sky is falling stuff. Actual cryptography experts have shown the importance (and difficulty) of random number generation for ages. Yes, if your "hardware wallet" aka computer and software is implemented poo…

Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#15

Post by fragmede »

sunshine-o wrote: post #5

There must be a fascinated industry dedicated to cracking old, orphan, lost and forgotten accounts with bad seeds and entropy.

Wired's story on Joe Grand is the tip of the iceberg.

https://www.wired.com/story/roboform-password-3-million-doll...

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#16

Post by matsemann »

KetoManx64 wrote: post #12
expedition32 wrote: post #8

Earlier quoted context omitted.

Meanwhile nobody has ever been able to hack a bank. Probably because they employ the actual pros unlike crypto.

> Nobody has been able to hack a bank Bro, people lose hundreds of millions of dollars to bank scams on a yearly basis.

Not the same. And it's not like the same scams don't exist for crypto. Even worse, many of them are automated. One bad npm install could swipe my crypto, but probably not my bank account.

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#18

Post by angry_octet »

pants2 wrote: post #14
angry_octet wrote: post #6

Incredible hyperbole from the Amicus guy: "This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future," Lawrence said. "That dream is over. Done." Sky is falling stuff. Actual cryptography experts have shown the importance (and difficulty) of random number generation for ages. Yes, if your "hardware wallet" aka computer and software is implemented poo…

Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.

If it's long enough it's fine. They key property for passphrases is being able to remember them. But diceware phrases where you actually roll dice are stronger, and has evident verifiability.

RNG on computers is still hard, and a proper HSM has a carefully designed source of randomness and mixing. I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#19

Post by name_nick_sex_m »

This article is bad because its adspam bullshit, and doesnt explain the vulnerability...

.. but this stupidest thing coinkite did was their dogshit design: Trying to inject their RNG logic into lower levels and hoping 3rd party libraries (through micropython) used them correctly... rather than just using their hardware dependencies directly. That design, and all bugs that came out of it, seems massively and avoidably stupid

Re: Coldcard's $38M (so far) exploit shakes faith in self-custody

#20

Post by pants2 »

angry_octet wrote: post #18
pants2 wrote: post #14

Earlier quoted context omitted.

Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.

If it's long enough it's fine. They key property for passphrases is being able to remember them. But diceware phrases where you actually roll dice are stronger, and has evident verifiability. RNG on computers is still hard, and a proper HSM has a carefully designed source of randomness and mixing. I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.

Yeah, something very cool is XOR can only improve randomness as long as there's no correlation between the sources. So Linux RNG XOR'd with this comment is even better than it's source!
Post reply on HN