So nobody at Coldcard even bothered to ask Claude if it could find any vulnerabilities? lmao
所以Coldcard那边没人想过让Claude找找漏洞吗？笑死
所以Coldcard那边压根没人去问Claude能不能找出漏洞。
So nobody at Coldcard even bothered to ask Claude if it could find any vulnerabilities? lmao
所以Coldcard那边没人想过让Claude找找漏洞吗？笑死
>>62553385
now that the internet is full with this shit, it just fund it in 8 mins only? GOOD LIL AI!
现在网上全是这玩意儿，8分钟就搞定了？好样的AI！
>>62553385
path B is only reachable if the firmware was built with a certain flag. it raises the question of why this configuration was possible at all (and the company should definitely be held liable) but a cursory audit would reveal the correct presence of path A.
路径B只有在固件用某个标志编译时才能到达。这引出一个问题：为什么这种配置一开始是可能的（公司绝对应该被追责），但随便一查审计就能发现路径A是存在的。
>>62553385
pretty sure they are going to get sued into oblivion
我很肯定他们会被告到破产。
>>62553385
Cold Card is far from cleared of being a deep state attack.
Cold Card远没有被洗清是深层政府攻击的嫌疑。
This bug sat for 5 years and was revealed right when big bitcoin is trying to get you to centralize all your coins on an exchange.
这个漏洞藏了5年，偏偏在比特币大佬们想让你把币都集中到交易所的时候爆出来。
The best way to fight off the attempted Big Bitcoin take over is to run bip-110.
对抗比特币巨头接管的最好办法就是跑bip-110。
>>62508806
>>62553563
shut up you brain dead cunt
闭嘴吧你这个脑残傻逼
All these online AI shills defense force better be getting paid for all their handwaving. It’ll make hunting them worthwhile
这些网上AI吹水防御队最好是有钱拿，不然找他们算账就有意思了。
>>62553385
Supposedly the American frontier models are nerfed and would dance around the issue while kimi one shotted it. The first round of wallet drains looked very amateurish. So basically a vibecoder found this. Now the real pros are attacking the exploit.
据说美国前沿模型被阉割了，遇到这问题就绕着走，而kimi一下就搞定了。第一轮钱包被掏空看起来挺业余的。所以基本就是个糊代码的发现了这个。现在真正的高手开始攻击这漏洞了。
>>62553475
> I can't get rid of this error
> 我搞不掉这个错误
> lemme disable the very reason to use a hardware wallet to fix this bug
> 让我干脆关掉用硬件钱包的核心理由来修这个bug
why do these fucking people have jobs
这些该死的人凭什么有工作
>>62553586
Yeah, the big boys started bruteforcing passphrases as well now
是啊，大佬们现在也开始暴力破解口令了
>>62553685
In the beginning, people were getting partial drained. Definitely crazy that someone without much experience figured this out.
一开始，人们只是被部分掏空。真疯，一个没多少经验的人居然能搞明白这个。
>>62553685
So seed phrases are just being cracked now via AI brute force? Is this what that image means
所以助记词现在就是靠AI暴力破解了？那张图是这个意思吗？
>>62553685
>cuckold sessions
>绿帽奴行为
Crypto in a nutshell
加密货币的缩影
>>62553418
Versions which were last updated before this whole thing blew open can still easily find it by simply asking it to find a vulnerability, lmao
那些在事发前就停止更新的版本，只要随便让人家找个漏洞就能轻松挖出来，笑死。
>>62553773
The Coldcard seed phrases were so easy to crack that searching for another word or two (passphrases) behind the initial seed phrase is negligible to people with a lot of compute
Coldcard的助记词太好破解了，那些有大量算力的人找初始助记词后面的一两个词（口令）就跟玩似的。
>>62553773
no, basically there is a limited range of possible entropy, which has trivialized checking addresses. it won't be long before attackers check every possible address that can be generated by this broken system
不，基本上就是熵的取值范围有限，校验地址变得毫无难度。要不了多久，攻击者就会把这套烂系统能生成的所有地址都扫一遍。
>>62553452
they shouldn't be held liable for anything it was just a mistake
他们不该承担任何责任，那只是个失误。
>>62553385
11 minute supercut of Bitcoin influencers big and small shilling Coldcard
11分钟的合集，全是大小比特币网红在吹Coldcard。
https://old.reddit.com/r/Bitcoin/comments/1vco15y/11_minute_supercut_of_bitcoin_influencers_big_and/
>>62553475
I need to know the nationality and skin color of the dev who committed that code.
我得知道提交那段代码的开发者是哪国人、什么肤色。
>>62553936
Wow an 11 minute compilation. Too bad not a single ounce of work poured into editing that video will result in any refunds.
哇，11分钟的剪辑。可惜就算花一整份心思去剪这视频，也不会有一分钱退款。
>>62553671
DEI
>>62553938
j e e t
e
e
t
>>62553475
>>62553671
>>62553938
it was on purpose. 10 years later you'll find him in the Bahamas
这是故意的。十年后你会在巴哈马找到他。
>>62553671
saars you can't say that saar we are great programmers!!
老板，这话不能讲啊老板，我们可是顶级程序员！！ ⿴ 这对币圈打击挺狠的。
>>62553385
this is pretty brutal for cyrtpo
这对加密货币来说挺残酷的。
>>62553671
Kek, this is jeetware level thinking for sw dev
Kek，这软件开发思路就是瘪三水平。
The lesson of this is that you are likely to lose all your bitcoin from some bullshit hacks every yeat than making long term profit in 10 years. Time to get a real job and invest something tangible cryptocucks
这事的教训就是，比起十年长期持有赚利润，你更可能每年因为各种扯淡的黑客攻击把比特币全赔光。该找个正经工作，投资点实打实的东西了，币圈傻狗们。
I don't quite understand the hack yet, but isn't it safer just to keep a lot of your crypto on normiebase or gemini at this point?
我还没完全搞懂这次黑客攻击，但在这种情况下，把大部分币放在normiebase或gemini这种平台是不是更安全？
dubs and btc drops to below 40k because of this
这消息一出，比特币直接跌破40k了。
>>62554322
witnessed dump this shit
亲眼看着这波砸盘。
>>62554444
checked
>>62554322
>>62554444
czeched
>>62554322
DO NOT REDEEM THE BTC
>>62554322
>>62554444
Good heavens, just look at the time!
我的天，看看这都什么节骨眼了！
So how did the hackers get the public addresses of coldcard users? Even bruteforcing that would take too much time wouldnt it?
那黑客是怎么搞到冷钱包用户公钥的？就算暴力破解也得花老长时间吧，不是吗？
>>62553563
>racism
Go to
>>>/pol/
>>62553475
this sounds the typical modern SW development where you have a management that wants everything as cheap and fast as possible, hiring cheapest workers and the only requirement at the end of the day is that it works.
这听起来就是典型的现代软件开发套路——管理层啥都想要又便宜又快，雇最便宜的码农，最后一天唯一的KPI就是能跑起来就行。
>>62554850
What? Why would you need someones public address when you're bruteforcing seed phrases?
啥？你在暴力破解助记词的时候，要别人的公钥干嘛？
>>62554895
Dont you need the public address? How do you target wallets otherwise? Just bruteforce until some wallet isnr empty? I thought they specifically targeted cold wallet adresses, not whole adress space
不需要公钥吗？不然你怎么定位钱包？就一直破解到某个钱包非空为止？我以为他们是专门针对冷钱包地址，不是扫全地址空间。
>>62554923
Yea, they’re bruteforcing, but bruteforcing a relatively small search space defined by the weak PRNG and predictable input seeds
对，他们是暴力破解，但破解的是一个由弱PRNG和可预测输入种子定义出来的相对小搜索空间。
>>62554923
The coldcard seeds for mk3 were created by something like 40 bits of entropy. The search space is 1 trillion, tiny even for a laptop to bruteforce. The attack just brute forces the shitty rng and checks if it matches a wallet in use.
mk3冷钱包的助记词是由大约40比特熵生成的。搜索空间是一万亿，对笔记本电脑来说都小菜一碟。攻击就是暴力破解那个垃圾随机数生成器，然后比对有没有匹配到在用的钱包。
The reason why this even works and only targets coldcards is because the bruteforce follows the coldcard specific rng code.
这事能成功而且只针对冷钱包，就是因为暴力破解走的是冷钱包特有的随机数生成代码。
>>62553385
AI finds shit only when it knows where to look
AI知道去哪找才找得到东西。 ⟧ 这是不是意味着开源的末日来了？
>>62553385
does this mean the end of open source?
这难道意味着开源的终结吗？
>>62554997
See >>62553806
Literally all anyone had to do was say "ayy AI, find me a vulnerability in coldcards firmware" and it would have done it. Someone obviously having done exactly that is why the first wave of drains was amateurish
说白了，任何人只要说句“嘿AI，帮我在冷钱包固件里找个漏洞”就能搞定。有人显然就这么干了，所以第一波盗币才这么业余。
>>62553671
kek, Debian ssh bug all over again.
哈哈，这不就是Debian SSH漏洞重演嘛。
Do not move to tangem
别换到tangem。
They lose funds constantly
他们老丢钱。
Swaps never finish then they basically laugh and say sucks to be you
交易永远不完成，然后就嘲笑你说，活该你倒霉。
>>62555000
Ok, but what's the point? You have to spend the rest of your life looking over your shoulder and you're one misstep away from spending decades in prison.
行吧，但图个啥？你得余生都提心吊胆，稍走错一步就是几十年牢狱之灾。
Surely there must have been a less illegal way to make money from this knowledge. Siphon one wallet as demonstration and sell the information to coldcard? Idk
肯定有没那么违法的方式拿这知识赚钱吧。抽一个钱包当演示，然后把这信息卖给冷钱包公司？不知道。
>>62553845
Why was it also a calculator?
为什么它还是个计算器？
>>62553475
Like fixing a front lock that jams occasionally by drilling out the lock, taking the front door off the hinges and putting a big neon sign on your house that says “undefended valuables inside”
这就像修个偶尔卡住的前门锁，结果你直接把锁钻了，把门从铰链上卸下来，再在门口挂个大霓虹灯写着“里面有值钱货，毫无防备”。
Kek
>>62558658
tangem is a blind signer. you're retarded if you buy this shit
tangem就是盲签设备。买这破玩意儿的人脑子有毛病
>>62554923
removing entropy is like removing words from your sneed phrase
削减熵值就像从你的助记词里删掉几个词
>>62553475
This was a premeditated code "error" to drain wallets. Funny how they want everyone believe it was merely incompetence. Those kikes drained all their clients' money.
这是蓄谋的代码"错误"，就是为了清空钱包。搞笑的是他们还想让所有人都相信这只是无能。那帮犹太佬把他们客户的钱全卷走了。
I put my bitcoin core wallet on a cd and usb stick, simple as
我把比特币核心钱包刻在光盘和U盘上，就这么简单。
>>62553938
The company is canadian.. so..
那公司是加拿大的……所以……
>>62563575
its a inside job from the start nigger
从一开始就是内鬼干的，黑鬼。
too many jews/crypto jews in the crypto space nigger
加密货币圈子里犹太人/加密犹太人太多了，黑鬼。
>>62560264
to attract geeks nigger
用来吸引极客的，黑鬼。
>>62554322
it's up 5% since this happened btw
顺便说一句，这事出了之后它还涨了5%。
>>62554322
Why would it? It has nothing to do with BTC. When a specific brand of car fucks up due to a manufacturing or design defect, why would that affect the market confidence in transportation stocks?
为什么要跌？这跟BTC八竿子打不着。某品牌的车因为制造或设计缺陷翻车了，凭什么影响运输类股票的市场信心？
>>62554156
>10 years later you'll find him in the Bahamas
十年后你会在巴哈马找到他。
He'll be in Israel.
他会在以色列。
>>62553385
kim says thanks a yuu
Kim说声谢谢。
>>62553671
He probably used claude which added that to make it compile
他八成用了Claude，是Claude加那个好让它能编译。
>>62564216
Oy vey. I hope living in fear for the rest of his life is worth 1300 btc.
天哪。希望余生活在恐惧里值那1300个BTC。
>>62553385
So why dont they just use LUNC?
那他们干嘛不用LUNC？
>has active PERPS
有活跃的永续合约
>has a burn address
有销毁地址
>has a built-in-dex
有内置DEX
Swap this radioactive BTC for LUNC, this pumps the LUNC price to the moon. People see green chutes, they start to FOMO.. Attackers dont care about being exit liq because its not actually their money. They keep swapping.
把这些放射性BTC换成LUNC，把LUNC价格推到月球。大家看到绿苗就开始FOMO……攻击者不在乎被当退出流动性，因为反正不是他们的钱。他们继续换。
Since they KNOW when the price is going lunar, they BUY LONGS (pref leveraged to the tits, on every LUNC PERP out there) BEFORE this big BTC injection into the chain.. Then as they get the LUNC proceeds from this series of titanic swaps, they take that LUNC and SEND IT TO THE BURN ADDRESS.. thus sending the already PHAT LONGS to SATURN and beyond.
因为他们知道价格什么时候要起飞，就在这笔大额BTC注入链之前提前买入做多（最好高杠杆，在所有LUNC永续市场上）。然后等这一连串巨量兑换拿到LUNC收益后，他们把这些LUNC直接发到销毁地址……把已经够肥的多头仓位直接甩到土星外太空。
That current BTC haul would be like 32% of LUNC's ENTIRE MC.. a BIG monster wick.. then, they BURN IT ALL for a multi megaton flywheel to send their longs to alpha centauri.
那批BTC大概相当于LUNC总市值的32%……一根超级大针……然后他们全烧掉，形成一个几兆吨级的飞轮，把多头仓位送到半人马座阿尔法星。
At any point, they exit those perp longs into any popular layer 1, send to mixer and presto, they have usable value. This would not work if they cared about the BTC but since its all RADIOACTIVE TAINT BTC.. then why not use it for fuel to spark a mad dash on a chain that is easy to push, and has DEX and has many active PERPS.
任何时候他们都能把那些永续多头仓位平到任何主流Layer 1，转到混币器，搞定，价值就能用了。如果他们在乎BTC的话这招不灵，但既然全是被污染的放射性BTC，那干嘛不用它当燃料，去点燃一个容易推动、有DEX、还有大量活跃永续市场的链上疯狂行情。
>I bet it would work.. GPT also bets it would and cut off the discussion. lol
我打赌这能成……GPT也赌能成然后直接掐了讨论。哈哈。
>>62553475
>>62553671
This is literal Jeet code
这完全是阿三代码。
I recognize it because I work with jeets
我一看就知道，因为我跟阿三一起干过活。
They don't care if the "fix" to an issue will cause the whole system to have a problem in the future, they just want to release it now and look good in front of the boss for fixing the issue in the retarded timeline given to him
他们根本不在乎这个“修复”会不会让整个系统未来出问题，他们只想着现在赶紧上线，在给定那种离谱时间线里修好问题，好在老板面前露脸。
>>62564980
According to this guy who found the flaw and reported it to Coldcard last year, it was a "pseudoanon tranny"
据去年发现这个漏洞并报告给Coldcard的那个人说，是个“伪匿名变性人”。
>>62565001
Kek
>finds the exploit a year ago
一年前就发现这个漏洞了。
>does the principled thing and doesn't exploit it and notifies coinkite
>做了件有原则的事，没去利用漏洞，还通知了Coinkite
>coinkite disregards it
>Coinkite置之不理
Can't wait for the lawsuits if this is true
要是真这样，等着瞧官司吧
>>62565001
lmao, that's even worse
笑死，那更离谱
I can't comprehend the mind of the tranny, but I assume he wasn't in the best mental state when he made that decision
我真搞不懂那个变态的想法，但估计他做决定时脑子也不太清醒
>>62565001
Not to defend coinkike here but what is the harm minimizing action to take at that point? The bug had already been out there for 4 years. If they patch it theres still 4 years worth of generated seeds at risk, if they tell people that they need to regenerate seeds they're basically calling every hacker in the world to find the weak seeds and despite their best effort many of their customers will either not see the alert or not act on it. Every option seems horrible.
不是要替CoinKike洗白，但那时候怎么处理才算损失最小？漏洞都暴露四年了。要是打补丁，还有四年里生成的种子有风险；要是让用户重新生成种子，基本就是在招呼全世界黑客来找弱种子，而且就算他们尽力通知，很多客户要么看不到提醒要么不当回事。每条路都烂透。
>>62565095
The only option would have been for them to utilize the bug themselves to find all possible seeds (including up to 40 bit passphrases) to mass-seize coins in the same day, and then promptly announce the bug and initiate return proceedings. And then tell anyone with stronger passphrases to move their funds as fast as possible in case of future attacks.
唯一的办法就是他们自己先用这个漏洞把所有可能的种子（包括40位密码短语的）都挖出来，同一天大规模没收币，然后马上公布漏洞并启动归还流程。再让密码设得强的人赶紧转移资产以防后续攻击。
Sure, they would go bankrupt right after, but they would have saved their customers funds
当然，之后他们肯定破产，但至少保住了客户的钱
>>62553385
Nobody bothered to ask you if you’re a pediphile. It really is that simple do
没人闲着没事问你是不是恋童癖。就这么简单
>>62553845
i will never understand the Xellenial obssession over the fucktarded blackberry keyboard.... I am old enough to remember that shit was ASSS, even the most proponent people of them solely used it for the cursor nipple or the fuck all tiny cursor square they later introduced... trully those shit keyboard should die. I had this during that era and holy fucking christ it was such a huge step up for typing than that trash ass "smart" squished at an inorganic angle up keyboard.
我永远不懂X世代对那傻逼黑莓键盘的痴迷……我老到还记得那玩意儿烂得一批，就算最铁杆的用户也主要是冲着那个鼠标杆或者后来出的那个小得可怜的方形光标去的……真该让那些垃圾键盘去死。那个年代我用过，老天爷啊，比起那所谓“智能”屏、挤成反人体工学角度的键盘，打字体验提升简直巨大。
>>62565217
Microsofts CEO was absolutely certain the iPhone would turn into a failure because it "didn't even have a keyboard".
微软CEO当年信誓旦旦说iPhone会失败，因为“连个键盘都没有”。
Boomers and gen X had a thing for buttons
婴儿潮和X世代就是迷恋实体键
>>62565183
you shouldn't ask "is my wallet safe", but instead "did the version of the software I used years ago when creating the wallet back then have some major bug in it"? even the coinkite wallet is safe if you created it yesterday.
你不该问“我的钱包安全吗”，而该问“我当年创建钱包时用的那个软件版本有没有重大漏洞”？就算Coinkite钱包，只要你是昨天创建的，也是安全的。
>>62564216
every single time
每次都这样
>>62565229
I mean I think we all still do have a thing for buttons, I just do not understand the glazing over the blackberry keyboard style in particular, it's offputting almost cult like with a few people who claim nostalgia over them, thems people are weird.
我觉得咱们其实都喜欢实体键，我就是不懂为啥非得吹黑莓键盘那种风格，看着有点瘆人，跟邪教似的，那几个靠它怀旧的人，脑子都不正常。
>>62560153
what are the charges?
指控是啥？
>>62553385
are these "hardware wallets" really that much more secure than just creating a wallet myself and store the wallet.dat on an encrypted thumb drive somewhere safe?
这些“硬件钱包”真就比我自个儿建个钱包、把wallet.dat存到加密U盘里放安全地方更安全？
>>62565247
Yeah I have no idea either. What you said just reminded me of the iPhone story
哎，我也不知道。你说的让我想起iPhone那事了
>>62565371
proper hardware wallets
正经硬件钱包
>brick themselves after a certain number of wrong pin entries.
>输错几次PIN就自毁
This is enforced by secure elements. So you can't brute force the pin unlike the password protecting your encrypted usb seed.
这是由安全芯片强制执行的。所以你不能像破解加密USB种子密码那样暴力破解PIN码。
>are secure even when the host is infected.
>即使主机被感染也是安全的。
Assuming it has a display that shows you what you're signing and allows you to verify your addresses for deposits. If you decrypt your usb seed it's already over, the seed is gone and it's not even necessary to give you a fake transaction to sign.
前提是它有个显示屏，能显示你要签名的内容，还能让你验证收款地址。如果你的USB种子被解密了，那一切已经结束了，种子已经泄露，甚至没必要给你伪造一笔交易去签名。
It's not some made up scenario as this old video shows why a HW with a display protects you from things like clipboard malware
这不是什么编造的场景，这个老视频说明了为什么带显示屏的硬件钱包能保护你免受剪贴板恶意软件之类的攻击。
>>62564969
lunc baggies are the 2nd lowest IQ people in crypto
LUNC的死忠是币圈智商第二低的人。
nobody can take the crown from pulse baggies
没人能从Pulse的死忠手里抢走冠军。
（如果你觉得这篇文章有启发，可以点击这里付费）
