Earlier quoted context omitted.
Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner? Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.
The underlying issue here is that addresses created by the tool at fault can have their private key derived from public data. If you send it back, it'll just get stolen again. Furthermore, the typical way that someone proves ownership of an address is by making a transaction from that address with parameters set via private communication with someone else. But since the private key is knowable, anyone can do that. Th…
The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
41–44 of 44 posts
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#42Earlier quoted context omitted.
how would the original owner prove ownership of the original wallet?
The STM32 in the ColdCard has a 96-bit UID "fused" at the factory. The lower 32 bits of this are seeded into the Yasmarang PRNG's initial state. Possession of a ColdCard with a UID matching a contested wallet might be able to serve as evidence of ownership.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#43There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.
how would the original owner prove ownership of the original wallet?
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#44Earlier quoted context omitted.
The STM32 in the ColdCard has a 96-bit UID "fused" at the factory. The lower 32 bits of this are seeded into the Yasmarang PRNG's initial state. Possession of a ColdCard with a UID matching a contested wallet might be able to serve as evidence of ownership.
in other words, this attack could link together different wallets created on the same coldcard?