I’m assuming this is not the case but I had this idea pop into my head and I don’t know what to believe anymore so I figured I’d share.

If any of these cold card hackers used LLMs and stupidly used an API key instead of a local / offline model to write the code to sweep the coldcard wallets, couldn’t the inference companies be subpoenaed to identify any users who prompted suspicious things around the time of this attack?

Most likely the code was written for a long time prior to the attack by the main attacker but any follow up attacker would’ve likely used LLMs.

Looking for a new hardware wallet. I like that it’s multi Sig, 2 of 3. Phone, Device, Bitblock. My only concern is that I like having a seed phrase. If something happens, unlikely 2/3 keys fail at the same time, I’d like to be able to quickly transfer funds into a different wallet.

I’m an average HODLer. Not super technical or into code. What’s everyone think?

Having been involved in btc in 2011 to 2014 and coming back to it last year I really hated the whole KYC thing when I learnt about it. It means we lose anonymity and must pay tax. Apparently in exchange we get security? Except we don't? If your coins are jacked KYC does Jack shit to get them back. What is the benefit? Even if there is some minor ones I dont see it outweighing the costs.

The infamous Lubian hack saw $3.5 billion siphoned off from a Chinese mining pool.

That was just six years ago, and yet a company like ColdCard has learned nothing from the biggest heist in recent crypto history?

The Technical Cause: Weak Entropy
Independent cybersecurity teams, including Arkham Intelligence and the Milk Sad research team, revealed that the hack was not a complex network breach but rather an exploitation of weak cryptographic key generation.

The Flaw: LuBian utilized a flawed pseudo-random number generator algorithm (similar to vulnerabilities found in Libbitcoin Explorer software).

The Exploit: Instead of using a secure, uncrackable 256-bit random number, the wallet software used a highly vulnerable 32-bit seed to generate its private keys.

The Result: This severely lacked entropy, allowing hackers to easily brute-force and replicate LuBian's private keys within just a couple of hours, seamlessly draining the wallets.

So the 24 words is just like each word represents 11 bit arrangement right, and so when you start adding 11 x 24 and stack them together, to guess that exact arrangement is astronomical right?

So I thought, ok, the passphrase thing is one extra 11 bit. But I saw you can add like way more characters that no way 11 bits could be used to describe that.

So effectively what's happening, is that last 25th word (I'm saying effectively like all in all at the end of the day) being turned into just a longer than 11 bits and tacked on to the end of that long string of that (264 - checksum = )254 bits?

But I don't get it, someone said the 25th word can be up to 100 characters which is like at least 800 extra bits, so that would mean the entropy would be like 1054 bits? I just don't get it.

Thanks

I am new, but I have finally decided to get involved. During Covid I was strongly offered to buy a bitcoin but I didn't have $20k to lose neither did I have any trust in it back then. I'm thinking to give it a try and buy 1btc for a start. Any advice you could give to a newbie? Is it even a good time to buy it? I'm not looking to make a big spread unless I leave it for a few years.