Back to News
ImportantSourceForesight News

慢雾:ColdCard 私钥漏洞或源于构建配置错误禁用硬件随机数

Foresight News 消息,据慢雾发文称,硬件钱包 ColdCard 近期遭遇重大私钥漏洞,损失约 1719 枚 BTC。SlowMist 安全团队以 Mk3 固件 4.1.9 为例,完整重现了攻击链,漏洞根源在于构建配置错误将「MICROPY_HW_ENABLE_RNG」设置为 0,导致 STM32 硬件真随机数发生器被禁用,随机数生成路径转而回退至非密码学安全的 Yasmarang 软件伪随机数生成器,其状态几乎完全可预测,使有效熵值降至约 40 比特(Mk2/Mk3 机型)或约 72 比特(Mk4/Mk5/Q 机型)。 攻击者据此精确建模按键消耗模式,结合 GPU 集群暴力枚举候选空间,推导出私钥并匹配全网单签 P2WPKH 地址实施资金盗取。SlowMist 建议受影响用户立即升级至已修复固件,生成全新助记词,并在确认新地址可正常使用后再迁移全部资金。
Disclaimer: The views above are the author's only and do not represent 711BTC. Nothing here constitutes investment advice.

Related

07-08 20:33

Report: TradeFi contract trading volume accounted for 11% of total contract trading volume in the first five months of 2026.

According to a recent stablecoin industry report released by Binance Research on July 8th, in the first five months of 2026, TradeFi-related perpetual contracts accounted for approximately 11% of the total perpetual contract trading volume, with a cumulative trading value exceeding $1.1 trillion. Binance's trading value exceeded $500 billion, representing a market share of approximately 47%.

07-08 20:31

The Bank of Korea has released a regulatory proposal suggesting that personal stablecoin transactions exceeding $10,000 should be limited to transfers from verified wallets.

According to Mars Finance, the legal team of the Bank of Korea has published a research paper titled "Regulatory Scheme for Foreign Remittance Transactions Targeting Stablecoins," proposing regulatory recommendations for large-scale stablecoin transactions. The paper, referencing current South Korean foreign exchange control regulations, proposes constraints on stablecoin transfers exceeding $10,000 between individuals, requiring such transactions to be conducted only between officially certified wallets, along with a pre-reporting mechanism. The institution acknowledges that there are technical obstacles to fully controlling unregistered wallets, but due to anti-money laundering compliance requirements, it is necessary to strengthen restrictions on large-scale cross-border stablecoin fund flows. South Korean regulators have previously repeatedly stated the need to improve the monitoring system for cross-border crypto asset transactions using non-custodial wallets; this paper further refines and implements the regulatory approach.

07-08 20:22

Gate responded to online rumors of user asset theft: An urgent investigation is underway, and preliminary assessments indicate it is an isolated incident.

According to Foresight News , Gate responded to online reports of user assets being stolen, stating that the incident shows the customer made a withdrawal between 3:00 PM and 4:00 PM on July 7th, and reported the loss to online customer service at 5:00 PM on July 8th. Gate has initiated an investigation, and the incident is currently under urgent investigation. Preliminary assessments indicate it is an isolated case, there are no system security vulnerabilities, and the website is operating normally. Preliminary investigations suggest this incident may be related to a leak of user information; the specific details are under investigation. Gate will disclose further details as soon as the investigation concludes.

07-08 20:19

Justin Sun has staked $430 million in Ethereum on Lido, yielding an annualized return of approximately $9.5 million.

According to Odaily Lens monitoring, Justin Sun Sun has been continuously staking ETH through Lido Finance. 23 hours ago, Justin Sun staked another 13,000 ETH, worth approximately $23.08 million, bringing his total staked ETH on Lido to 247,436 stETH, currently valued at approximately $430.2 million. Data shows that since February 2023, this staking position has generated a total of 11,307 stETH staking profits, worth approximately $26.82 million. Based on the current profit level, Justin Sun position has an annualized return of approximately $9.5 million.

07-08 20:17

Guangdong: By the end of 2027, the province's urban digital infrastructure support capabilities will be significantly enhanced.

According to Mars Finance, 11 departments, including the Guangdong Provincial Government Service and Data Management Bureau, recently issued the "Guangdong Provincial Action Plan for Promoting the Digital Transformation of Cities and Building Smart Cities." The plan emphasizes using cities as comprehensive carriers for the construction of Digital Guangdong, promoting infrastructure connectivity, data integration, platform interoperability, business integration, and a smooth ecosystem. It also aims to actively explore future-oriented smart city management models and achieve high-quality development of the Guangdong-Hong Kong-Macao Greater Bay Area smart city cluster. By the end of 2027, the province's urban digital infrastructure support capabilities will be significantly enhanced, the level of efficient digital governance will be greatly improved, digital public services will be more efficient and convenient, the momentum of digital economic development will be fully released, and the digital ecosystem will be comprehensively and collaboratively guaranteed. A number of effective and replicable typical application scenarios for digital transformation will be implemented, with Guangzhou, Shenzhen, Foshan, and Dongguan taking the lead in building efficient smart governance systems and implementing a number of advanced, usable, and independently controllable large-scale urban models. By 2030, no fewer than 10 cities will have achieved full-area digital transformation, achieving an overall leap in the digital transformation of cities throughout the province, forming a number of new smart city benchmarks and digital China city models with regional competitiveness and national influence. (Cailian Press)

07-08 20:10

Morgan Stanley reiterated its "overweight" rating on RKLB and raised its bullish price target to $293.

Odaily Odaily that Morgan Stanley reiterated its "Overweight" rating on Rocket Lab (RKLB) and maintained its target price of $105, but raised its most bullish target price from $185 to $293. Morgan Stanley analysts believe that the acquisition of Iridium will expand Rocket Lab's potential market space and reposition the company as a vertically integrated space platform. While SpaceX has significant scale and cost advantages over Rocket Lab, the latter is moving closer to the former's model.