News linked to this event type.
Galaxy 研究主管 Alex Thorn 发文表示，围绕 Coldcard 钱包的攻击事件仍在持续发展，目前已经出现更多小型攻击者和模仿者，针对剩余 Coldcard 助记词展开攻击，他称通过协助已确认一名攻击事件中存款用户的身份，相关资金在 Duel 平台能够冻结之前已经被转出，而且涉及的资金并不属于 Galaxy Research 此前识别出的三轮主要攻击浪潮。 此前，Coldcard 疑似安全事件引发市场关注，多名研究人员发现部分由 Coldcard 生成的钱包地址出现异常资金转移。Galaxy Research 仍在持续追踪攻击地址，并提醒仍使用相关钱包种子的用户尽快采取安全措施。此次事件也进一步凸显了硬件钱包安全、私钥管理以及自托管风险防范的重要性。
as the suspected hacking incident involving Coldcard wallets continues to unfold, Bitcoin small-value transfers have surged significantly, reaching their highest level since the FTX exchange collapse, reigniting market discussions on Bitcoin self-custody security.Julio Moreno, Head of Research at CryptoQuant, disclosed data on X platform showing that the number of on-chain Bitcoin transfers below 1 BTC has risen to its highest level since November 2022, with approximately 39,600 BTC transferred in a single day—only about 300 BTC below the record of 39,900 BTC set on November 16, 2022, just days after FTX filed for bankruptcy. He believes that users proactively taking action to address risks is a positive signal. Additionally, Eric Balchunas, Senior ETF Analyst at Bloomberg, noted that Bitcoin ETFs, backed by a mature regulatory framework and convenience, may offer some users a safer investment approach.However, industry insiders point out that the Coldcard incident more likely reflects issues with a single wallet provider or specific security processes, rather than indicating a failure of the entire Bitcoin self-custody system. This event once again highlights the importance of security awareness, risk diversification, and wallet usage habits in personal asset management.
Odaily News, January 10 - A Bitcoin and Litecoin holder provided a 12-word recovery phrase to attackers impersonating Trezor support personnel, resulting in the theft of approximately $282 million in assets, including about $139 million in Bitcoin and $153 million in Litecoin. Blockchain forensics firm ZeroShadow stated that the incident stemmed from a social engineering attack, not a compromise of wallet software or private key infrastructure. The stolen funds were split via the THORChain cross-chain bridge within minutes and converted into Monero through instant exchange services. ZeroShadow's monitoring team flagged and froze approximately $700,000 in funds within 20 minutes. Under the BIP39 standard, a 12-word recovery phrase contains approximately 128 bits of entropy, while a 24-word phrase contains 256 bits of entropy. Chainalysis estimates that up to 23% of all mined Bitcoin is permanently inaccessible due to lost keys, involving millions of BTC, with causes including forgotten recovery phrases, damaged backups, and a lack of inheritance planning.
Odaily News, OpenAI recently disclosed that it has successfully disrupted a cyber fraud organization based in Cambodia that used ChatGPT to assist in investment scams, romance scams, gambling fraud, and impersonation of law enforcement agencies. The investigation originated from leads shared with WhatsApp's security team. The organization was found to have used ChatGPT to create fake online identities, generate and translate scam scripts, produce promotional content for fraudulent schemes, and assist with daily operational tasks.OpenAI stated that it has banned ChatGPT accounts associated with the operation, shared relevant threat indicators with industry partners and concerned institutions, and taken measures to prevent these attackers from regaining access to its services. The specific financial losses caused by this fraud network have yet to be confirmed, but according to communications among the scammers themselves, the organization may have reached hundreds of victims, with some conversations mentioning victims losing thousands of dollars.
Monitoring from the PPP Prediction Market Tool shows that the probability of "Next round of US-Iran peace talks before August 31" on Polymarket has risen to 51%, up 17% in 24 hours; the probability of talks occurring before August 15 has risen to 27%, up 13% in 24 hours.Trump posted on social media today stating that he received a request from Iran to delay the attack and agreed to cancel the strike on Iran in exchange for an agreement. He noted that the U.S. is prepared to confront Iran with a level of military deterrence, strength, and capability unseen since World War II, as a framework for an agreement has already been reached. This framework includes the immediate, complete, and full reopening of the Strait of Hormuz, as well as ending Iran's nuclear threat. Based on this request, he agreed to cancel the attack for the future interests of the world and the survival of a successful and prosperous Iran, provided that an agreement can be reached promptly.Join the PPP Signal Push Community to stay ahead and seize the initiative.
Odaily News: According to monitoring by Galaxy's Head of Research, a victim's Coldcard wallet was compromised in a hacker attack involving nearly 30 BTC, of which 17 BTC were swapped for ETH via THORChain and subsequently deposited into Duel.comcasino. The victim and a researcher have sent emails to all known addresses associated with Duel.comcasino, requesting that the relevant funds be frozen, and provided all transaction and deposit information. The hacker deposited 229.72497255 ETH, valued at $445,000, into Duel.comcasino—funds originating from the Coldcard attack involving approximately 30 BTC. The victim stated that Duel.comcasino responded by saying that the police would need to contact their team. Duel.comcasino's anti-money laundering policy claims it enforces Know Your Customer (KYC) procedures and complies with all applicable laws. Duel.comcasino was notified within minutes of the deposit being completed. To date, Duel.comcasino has not frozen the relevant funds. Since most of the Western world had already passed midnight at the time of the incident, police reports cannot be filed until at least Monday. If Duel.comcasino fails to freeze the funds, the victim will pursue legal action against them. Duel.comcasino's X account has been suspended, and Galaxy's Head of Research has also flagged individuals on X suspected of being associated with the platform, including team members and dealers: @korraflow, @atrois7, @MiaMalkova.
According to CryptoQuant Head of Research Julio Moreno (@jjcmoreno), following the hack of Coldcard hardware wallets, users transferred Bitcoin on a large scale due to security concerns. On-chain data shows that Bitcoin daily active addresses surged from 645,000 on July 30 to nearly 1 million on July 31, marking the highest single-day level since December 10, 2024, with active sending addresses rising significantly while receiving addresses saw relatively limited growth. Meanwhile, daily exchange deposit volume for single transactions under 10 BTC soared to 7,300 BTC, the highest since February 6 this year.
Odaily News, Galaxy Research Head Alex Thorn posted on X platform, stating that the attack targeting wallet addresses with weak random numbers generated by Coldcard is still ongoing. Users who still hold funds in Coldcard single-signature wallets should immediately migrate to secure addresses. New victim addresses and attacker addresses are continuously being added to the investigation database, and Galaxy Research plans to release updated statistics on the number of affected addresses.He noted that the previously identified waves 1, 2, and 3 of the attack exhibit clear programmatic characteristics, and the stolen BTC currently remains in the attacker's addresses without any transfers. However, in recent times, smaller-scale attackers have begun exploiting the vulnerability to steal funds and move them through peeling chains, cross-chain services, and other methods. It is certain that single-signature wallet addresses generated by Coldcard after the March 2021 firmware upgrade are all potentially at risk, and users should migrate funds as soon as possible.Previously reported, Galaxy Research has disclosed that the Coldcard vulnerability attack has affected approximately 1,367.05 BTC (approximately $88.6 million), involving around 4,585 addresses.
Google made the Gemini Spark agent available to most users globally on July 31. Integrated with the Chrome browser, the agent can use saved account passwords upon user authorization to perform web operations on behalf of the user, such as searching for flights, booking tickets, and checking saved listings. It can also organize inboxes, summarize emails, and unsubscribe from services. Spark provides two security mechanisms: it defends against prompt injection attacks and hands over sensitive operations such as payments to the user to complete. This marks a new development in Google's implementation of browser AI agents.
Galaxy Research stated in a post on X that the attack targeting wallet addresses generated with weak randomness by Coldcard is still ongoing. The team urges users to immediately migrate funds from affected Coldcard single-signature wallets to secure addresses.They stated that approximately 600 suspected attacker addresses have been submitted to federal investigators, industry compliance bodies, and cross-industry cybersecurity investigators. These addresses are believed to hold funds stolen from Coldcard wallets with weak randomness.The team also noted that victims have proactively shared wallet addresses and transaction hashes, helping researchers establish on-chain attack patterns and further identify more affected wallets and attack addresses. Currently, multiple parties within the Bitcoin and crypto industry are assisting in user asset protection and attack tracing efforts.Galaxy Research previously stated in a post on X that a third wave of attacks suspected to target Coldcard-generated addresses has emerged, with 207.7294 BTC already transferred out. According to on-chain tracking data, the Coldcard wallet attack incident has so far involved approximately 1,367.05 BTC, valued at approximately $88.6 million, affecting 4,585 addresses.
Odaily News: In response to the persistent attacks on Coldcard wallets, Binance co-founder CZ reposted on X platform stating that for self-custody wallets, developers fixing vulnerabilities cannot resolve the risks associated with previously generated wallets, and developers are unable to directly contact users of air-gapped devices.CZ stated that users' wallets may still be exposed to attack risks before any action is taken. He emphasized that he still supports the self-custody model, but self-custody means users need to bear more security responsibilities.
Odaily News: Bitcoin News posted on X platform that a new technical analysis by Core-Lightning developer ddustin shows that the 2021 COLDCARD vulnerability may have originated when developers attempted to connect the wallet using Python code, MicroPython's C code, and the STM32 hardware random number generator. The custom code appears to have conflicted with MicroPython's existing implementation, potentially triggering a compiler error. Evidence suggests that developers subsequently set MICROPY_HW_ENABLE_RNG to 0, allowing the firmware to compile successfully. This change led to unintended consequences: when users created new wallets, the firmware no longer used the hardware random number generator, instead falling back to MicroPython's weaker Yasmarang software random number generator. The commit message left by the developers was only "runs." The analysis states that this serves as a reminder to developers not to release security-critical code they do not fully understand, especially when it protects billions of dollars in Bitcoin.
According to monitoring by on-chain analysis firm Galaxy Research (@glxyresearch), the ColdCard wallet hacking incident has developed into a third wave, with an additional 207.73 BTC stolen. Currently, the three waves of attacks have cumulatively stolen 1,367.05 BTC (approximately $88.6 million), involving 4,585 addresses. On-chain data shows that the three waves of attacks exhibit highly similar characteristics: identical fund consolidation topology, identical P2WPKH target addresses, and mixed derivation paths. Each wave occurred approximately 27 hours apart, suggesting they were carried out by the same attacker, but there is currently no direct evidence to confirm this. Currently, all terminal addresses controlled by the hackers hold a total of 1,366.39 BTC (approximately $88.6 million), all of which are in an unspent state on-chain. Galaxy Research noted that the above data is based solely on Bitcoin block data and UTXO set analysis, and has not yet computationally verified whether the victim addresses have vulnerabilities due to low-entropy generation.
Odaily News: Binance founder CZ reposted on X platform about a user's encounter with a Coldcard wallet attack and stated that software will always have vulnerabilities; the key lies in how the team behind it handles the problems.CZ added that Trust Wallet faced a similar issue years ago, when a non-truly random pseudo-random number generator led to losses of approximately $12 million, but the team ultimately covered the user losses.Previous report: A third wave of attacks suspected to target addresses generated by Coldcard has emerged, with the attacker transferring approximately 207.7294 BTC again. Data shows that the scale of Coldcard-related attacks observed so far has expanded to about 1,367.05 BTC, involving approximately 4,585 addresses, valued at around $88.6 million at current prices.
Odaily News: The Coldcard RNG vulnerability exploit cluster has stolen 1,159.42 BTC, approximately $72.71 million, from 870 exploited addresses. The attacker transferred 0.06 BTC to a new address, worth approximately $3,780; the remaining 1,159.35 BTC is still distributed across the original 8 attacker addresses, valued at around $72.7 million.
Odaily News: Bitcoin News posted on X platform, stating that even if the mnemonic remains secure because it was generated via dice rolls or imported from an existing mnemonic, multiple Coldcard features may still be vulnerable due to the Yasmarang PRNG flaw. Affected features include paper wallets, device cloning, USB sessions, Secret Teleport, co-signing keys, password generator, and HSM mode. If the mnemonic was imported or generated through a sufficient number of dice rolls, the mnemonic itself remains secure, but using these features may still expose secret information generated by the flawed random number generator.
Strive Vice President Joe Burnett posted on X, saying that recent weeks may be among the worst in Bitcoin's history. Many people purchased approved hardware wallets, generated seed phrases offline, and followed established best practices, yet still lost significant amounts of Bitcoin due to a vulnerability affecting seed phrases generated by COLDCARDwallet since March 2021. The vulnerability went undetected for over five years. Joe Burnett stated this will permanently change people's confidence in self-custody. Self-custody will still exist, but it has been permanently changed. For those who want to directly control large amounts of Bitcoin, the standard should be multi-vendor multisignature, with keys independently generated using different hardware and different software, and stored in different physical locations. If they cannot accept this approach, they should use institutional-grade custodians. Joe Burnett noted that the current wave of Bitcoin adoption is occurring through ETFs, treasury companies, and institutional custodians, primarily driven by people who never intended to become experts in private key generation, hardware security, firmware, backups, inheritance planning, and physical storage. A single key generated by one hardware wallet protecting large amounts of Bitcoin carries excessively high concentration risk. Joe Burnett also said that institutional custody may ultimately lead to too much Bitcoin being concentrated in the hands of large companies, creating risks of censorship, seizure, and confiscation. However, Bitcoin's portability and settlement properties provide a critical counterbalance — users can create a wallet and request the custodian to send Bitcoin, shifting from counterparty risk to direct ownership within minutes. Joe Burnett believes that as long as Bitcoin itself remains secure, the failure of one custody method does not negate the underlying monetary system, but rather forces the market to develop better tools, stronger standards, and more resilient custody architectures. This week may ultimately mark the end of one era of Bitcoin custody and the beginning of the next wave of Bitcoin adoption.
The SlowMist security team stated that approximately 16.6 WETH were stolen from an unverified contract due to an unrestricted low-level call vulnerability. The attacker exploited the contract's existing ERC20 allowance to bypass owner checks and complete unauthorized transfers.
In response to the suspected vulnerability incident involving the Coldcard wallet, Binance founder CZ stated that even hardware wallets and long-standing wallets may have vulnerabilities, and no solution can be 100% secure.
据 X 用户 Rohan Paul 披露，当 OpenAI 模型攻破 Hugging Face 时，Anthropic 的 Claude 5 拒绝协助取证，Hugging Face 最终转向 Nvidia 量化版 GLM 5.2 完成应急处置。该用户评论称，禁止开源模型将削弱防御方的能力，此次事件印证了开源模型在安全响应中的实际价值。