# private key Related Articles

HTX News Center provides the latest articles and in-depth analysis on "private key", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

15 Malicious Actors Exploited Coldcard Hardware Wallet Vulnerability

More than 15 distinct malicious actors exploited a vulnerability in the Coldcard hardware wallet, according to Alex Thorn of Galaxy Digital. Analysis of victim reports, including one involving the theft of under 1 BTC, led to the discovery of an attack that drained 12 BTC from 126 addresses. The estimated losses from this exploit have reached $100 million across three confirmed attack waves, with a potential fourth wave possibly raising total losses to around $130 million in Bitcoin. The incident has reignited debate about the security of cold storage. Notably, Haseeb Qureshi of Dragonfly suggested that spending roughly $2 on AI-powered code auditing could have potentially prevented the exploit, as some AI models reportedly identified the vulnerability in under 20 minutes post-disclosure. The core flaw was a critical reduction in private key entropy within the device's firmware. Instead of the standard 128 bits of entropy provided by a 12-word seed phrase, Coldcard's key generation was limited to just 40 bits, significantly simplifying the task for attackers. This case draws parallels to the 2023 "Milk Sad" vulnerability in Libbitcoin Explorer, highlighting how firmware errors compromising entropy can repeat across different products. The widespread exploitation by over 15 parties underscores how quickly vulnerability information spreads after disclosure.

cryptonews.ruYesterday 09:05

15 Malicious Actors Exploited Coldcard Hardware Wallet Vulnerability

cryptonews.ruYesterday 09:05

Forbes: 7 Million Bitcoins Exposed to Quantum Computing Risk—Must BTC Change Its "Lock"?

**Forbes: Quantum Computing Threatens 7 Million Bitcoin — Must BTC Change Its "Lock"?** A Forbes article explores the emerging threat quantum computing poses to Bitcoin's cryptography, which secures an estimated 7 million BTC (~$470 billion). While a machine capable of breaking Bitcoin's Elliptic Curve Digital Signature Algorithm (ECDSA) doesn't yet exist, researchers are raising alarms. Google studies suggest the required number of qubits for such an attack is decreasing rapidly. The risk applies to "exposed" public keys, found in early "Satoshi-era" addresses or reused addresses, but exposure does not equal theft. The Bitcoin developer community is divided on solutions. Proposals include BIP-360 for new quantum-resistant address types and the more controversial BIP-361, which would eventually freeze non-migrated, vulnerable coins to prevent future quantum theft. Startups like American Fortress are entering the space, claiming solutions like a backward-compatible soft fork to auto-freeze vulnerable wallets. However, its claims are met with caution as its technical paper is unpublished and its design unaudited. The article frames this as a high-stakes race, weighing urgent security upgrades against Bitcoin's foundational principles and long-term viability.

marsbit08/03 06:25

Forbes: 7 Million Bitcoins Exposed to Quantum Computing Risk—Must BTC Change Its "Lock"?

marsbit08/03 06:25

Injective software package hit by malicious supply chain attack – Details

In a software supply chain attack, malicious actors compromised the Injective Labs TypeScript SDK (@injectivelabs/sdk-ts v1.20.21) by uploading a tainted version to the npm registry. The attackers gained access to a legitimate contributor's GitHub account to distribute malicious commits. The compromised package, disguised as a routine update, contained malware that activated only when developers used specific wallet generation functions, stealing private keys and mnemonic seed phrases. This breach impacted approximately 50,000 weekly downloads and spread through transitive dependencies in 17 other Injective packages. While a clean version (v1.20.23) was later released, the malicious package remained accessible. Affected users are advised to rotate credentials, create new wallets, and move their funds.

ambcrypto07/10 15:03

Injective software package hit by malicious supply chain attack – Details

ambcrypto07/10 15:03

Cryptocurrency Asset Recovery: A Lucrative, Under-the-Radar Business

Cryptocurrency Asset Recovery: A Lucrative, Low-Key Business The article discusses the burgeoning business of cryptocurrency asset recovery, driven by common yet often crippling user errors rather than sensational hacking incidents. Key problem areas include selecting the wrong blockchain for a deposit, omitting required memos/tags when sending to exchanges, physical wallet device failures, errors in backing up or modifying seed phrases, and issues with frozen accounts or withdrawals on centralized exchanges. As cryptocurrency adoption grows among mainstream users—including retail investors and businesses—these operational mistakes increase. The decentralized nature of crypto places full responsibility for asset security on users, who may lack the technical expertise to navigate complex chains, wallets, and protocols. Even centralized exchanges, while offering some support, often present users with cumbersome, non-intuitive processes for resolving issues. This creates a persistent and growing demand for professional recovery services. However, the field is rife with risks, including middlemen without real expertise and outright scammers who promise guaranteed recovery, request sensitive information like private keys, or charge advance "fees." Legitimate service providers typically avoid absolute guarantees, as recovery feasibility depends heavily on the specific technical or administrative circumstances of each case. The business is evolving from an informal market into a professional one requiring a combination of technical analysis, exchange/platform communication, and legal/compliance knowledge. The article concludes by noting the author's partnership with a professional recovery team, offering preliminary assessments for issues like incorrect deposits, wallet access problems, or exchange account freezes, with an emphasis on realistic evaluation over promises.

链捕手05/20 06:41

Cryptocurrency Asset Recovery: A Lucrative, Under-the-Radar Business