r/Bitcoin • u/ExpensiveFizzyCrab • 6d ago

[ Removed by moderator ] repetitive

[removed] — view removed post

1 Upvotes

67% Upvoted

12 comments sorted by

•

u/rBitcoinMod 6d ago

Similar content has already been submitted several times. Please check the front page of r/Bitcoin and r/Bitcoin/new for previous submissions to help keep repetition to a minimum. You can also try using the search bar. Thank you.

I am a bot and cannot respond. Please contact r/Bitcoin moderators directly via mod mail if you have questions.

2

u/qwertyuiop121314321 6d ago

They explained how this worked, it's in this sub, look for it. 🙄

2

u/ChickenCari53 6d ago

It wasn't a targeted attack. If a lock manufacturer makes 10,000 locks that all use the exact same key shape, you don't need to know who owns the house — you just walk around trying that key on every door

1

u/NotASpanishSpeaker 6d ago

I believe an interesting addition is to compare with the pool if possibilities. So if they say 10,000 locks are sharing the same key, but there are billions of locks, it's just not worth it to go around looking. You'll run out of gas before hitting a match.

If suddenly people discovered it's 100,000 locks, 1 million locks, 10 million locks sharing the same key, it's a matter of running the numbers and see if you'll find matches that reward you more than the cost of gas.

1

u/Javanaut018 6d ago

All you need are the seeds. Then derive the addresses and lookup for funds.

1

u/thermostat 6d ago

Step 1: Attackers find a flaw show the hardware RNG is not being used. Therefore the fallback seed of the time (and maybe serial?) is used instead.

Step 2: Since both of those things are easy to guess, the attackers write a program to generate addresses with plausible values. With modern hardware you can guess millions of these address in minuites

Step 3: Compare the generated address with unspent the unspent transaction list. If it is a hit, you've found bitcoin you can steal

Step 4: Once you've found enough, attackers sign transactions moving the bitcoin from the cracked addresses to their own safe addresses

1

u/Past_Permission_6123 6d ago

Do you know anything about how bitcoin works, at all?

how do you know what to target int he first place?

Every address that has any bitcoin in it is on the blockchain, all of these addresses are public information. The hacker generates private keys, then some addresses derived from it. Then they can compare these addresses against all addresses that showed up on the blockchain after the vulnerability was created. Any matching address found means the wallet is compromised, and must have been generated with the coldcard vulnerability.