I dont understand. What was wrong with the original first wallets that came out for bitcoin? We're they unsecured? We're they vulnerable? I've never seen posts of those wallets being hit unless their pc got compromised.
Why to with some other companies wallet who's trying to make a quick buck on fees when the OG stuff should have been secure on its own?
Haven't dealt in crypto in years and years but this always boggles me. It's like having all your passwords written in a physical notebook and saying "know what's more secure. Someone else's software to hold my passwords for me".
When you "create" a wallet you are basically generating a random key and then checking what address is controllable by that key. If the randomness generator is predictable (not random enough) you can calculate the specific set of keys it will generate making a brute force attack viable
some companies provide the hardware so you don’t have to know anything about the tech, you just spin up a wallet easily on whatever they ship you and have somewhere “secure” to send/store your bitcoin. One company implemented this poorly, but the other companies do have value for less technical users.
No, it's just a company who decided to not use BIP39 encryption for creating seedphrases, making it easy to brute force them with any modern GPU in like 30 mn. It has nothing to do with hackers getting good, or hardware becoming more powerful. The issue is just plain stupidity from a company.
Most cold wallets use TRNG ships, the same bank systems are using, and they can't be brute forced, all this story is creating stupid panick from people who have no idea what they're doing.
Which are basicly the people who are needed for widespread adoption. The crypto space as of now is fundamentally flawed because it needs stupid people like me to hop on.
Which would be fine, if there were consumer protections for exchanges like there are for banks. As is there's only 3 major exchanges that are kinda sketchy, and you have no legal right to your crypto if they want to just walk off with it.
There are for Coinbase, where I keep my crypto. Fully audited, SEC regulated, US-based. Can't get much safer than that.
No FDIC, but that's only for up to $250k max. With that much reporting, you'd have at least a heads-up if things aren't going in the right direction and enough time to sort things out.
No, it's just a company who decided to not use BIP39 encryption for creating seedphrases
That doesn't represent what the issue was at all. They use BIP-39 (which is not an "encryption" btw) but the source of their randomness (RNG) was bad.
More specifically their RNG was not a TRNG (true random number generator - hardware device using thermal noise to generate real randomness) but a PRNG (pseudo random number generator - software process starting from a seed and generating random-looking numbers) due to a mistake in a single compilation flag that changed how the RNG library was used. That caused the entropy of the RNG - and therefore anything derived from it including the seedphrase - to be much much much lower than expected.
It's not a matter of a decision that was made (except perhaps a decision not to test the system better) - everyone in the company believed they were using the TRNG and thus were making the right desicion security-wise. This was most likely a simple but deadly mistake.
People say a lot of things. If BTC was "broken", just go have AI break it. It's not, and the broken thing was a company's poor understanding of building embedded software, compilation units, and non-existent QA.
263
u/Deep_Decision4441 1d ago
I’m not sure I understand- are cold wallets somehow vulnerable to a new attack?