# Vulnerability Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Vulnerability", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Thanks to Dice Rolls, Bitcoin Keys Are Stored Offline, But Not Everyone Will Do It

The article discusses using dice rolls to generate secure Bitcoin wallet seeds, providing entropy independent of potentially flawed hardware random number generators. It explains that each fair dice roll offers about 2.585 bits of entropy, with around 50 rolls needed for a standard 12-word seed phrase and 99+ recommended for higher security. This method gained attention after a vulnerability was revealed in some Coldcard hardware wallets, where a faulty firmware RNG (dating back to 2021) compromised generated keys. The analysis notes that while a dice-generated main seed was safe from this specific flaw, other Coldcard functions (like creating paper wallets, backup keys, or passwords) could still be vulnerable if they used the defective RNG. The piece argues that while dice-based entropy is technically robust, the manual process is error-prone, tedious, and unrealistic for most new users, who might make mistakes in recording or inputting rolls. It concludes that while manual entropy generation should remain an option for advanced users, the long-term goal is to develop reliable, user-friendly hardware and software that securely generates randomness without requiring specialized knowledge. Coldcard users are advised to check their firmware version and replace any secondary secrets (like paper wallet keys) created with vulnerable devices, while also considering multi-signature setups with devices from different manufacturers for added security.

cryptonews.ru08/01 21:37

Thanks to Dice Rolls, Bitcoin Keys Are Stored Offline, But Not Everyone Will Do It

cryptonews.ru08/01 21:37

Coinkite Warns Coldcard Mk3 Owners After Reports of $38 Million in Bitcoin Losses

Coldcard manufacturer Coinkite has issued a security alert after reports surfaced of a coordinated loss of approximately 594 BTC (worth around $38 million) from numerous old, single-signature addresses on July 30, 2026. CEO Rodolfo Novak stated the company is prioritizing the investigation, though it has not officially confirmed a direct link to Coldcard devices. Preliminary findings indicate a potential vulnerability affecting Coldcard Mk3 devices that generated seeds using firmware versions from 4.0.1 (March 2021) to 5.0.3. Mk4, Q, and Mk5 models are reportedly not affected. The suspected issue relates to weak randomness in seed generation on some older Mk2 and Mk3 firmware, not a supply chain compromise. Coinkite notes wallets protected by a user-set BIP-39 passphrase appear at minimal risk. For vulnerable Mk3 users not using a passphrase, the company recommends migrating funds to a new seed generated on an unaffected device, advising caution and test transactions first. As temporary measures for those with only an Mk3, Coinkite suggests either setting a strong BIP-39 passphrase and moving funds, or generating a new seed via the device's "dice roll" import method, which bypasses its internal random number generator. A full technical analysis is pending as the investigation continues. The incident has drawn significant attention within the Bitcoin community given Coldcard's reputation as a secure, air-gapped hardware wallet.

cryptonews.ru07/31 05:16

Coinkite Warns Coldcard Mk3 Owners After Reports of $38 Million in Bitcoin Losses

cryptonews.ru07/31 05:16

OpenAI, Open-Sourced

OpenAI has open-sourced its code security tool, Codex Security CLI. The tool, which originated from the private beta project Aardvark in October 2025, is designed to automatically discover, verify, and fix vulnerabilities in codebases. It functions as an application security agent, first analyzing a repository to build a threat model, then identifying and ranking vulnerabilities based on real-world impact, and finally testing them in a sandbox for validation. According to OpenAI, in its first 30 days, the tool scanned over 1.2 million commits, uncovering 792 critical and 10,561 high-severity vulnerabilities, with a reported reduction of over 50% in false positives upon repeated scans of the same repositories. However, initial user experiences on platforms like Hacker News highlighted significant issues, particularly concerning cost and reliability. Developers reported failed scans that consumed substantial portions of API rate limits and incurred high expenses, with one user noting a cost of approximately $13 for an aborted run. The high cost is attributed to the tool's default configuration, which uses the premium GPT-5.6-sol model with inference intensity set to "extra-high." The release follows public statements by NVIDIA's Jensen Huang advocating for open-source AI. While OpenAI has open-sourced the application-layer CLI and SDK, the core AI models remain proprietary. The move opens the door for community development and potential adaptations of the tool.

marsbit07/30 07:43

OpenAI, Open-Sourced

marsbit07/30 07:43

Bitcoin Panicking? Mythos Cracks Post-Quantum Cryptography Algorithm in 60 Hours

Claude Mythos Preview, a new AI system from Anthropic, has made significant breakthroughs in fundamental cryptanalysis, targeting the mathematics underlying algorithms rather than just implementation bugs. Its first target was HAWK, a candidate in the NIST post-quantum signature standardization process. Mythos identified a previously unexploited symmetry (a nontrivial automorphism) in the lattice structure of HAWK, effectively halving its effective key strength. It achieved this feat in just 60 hours, a task that had eluded two years of human expert review. Crucially, the human operator was not a lattice cryptography expert, primarily managing the project while AI agents debated and discovered the attack path. Its second, more dramatic achievement was against a simplified 7-round version of AES-128, the world's most widely used symmetric encryption algorithm. Initially reluctant, stating the task was "impossible," Mythos was prompted to "try novel ideas." It then autonomously rewrote its own agent framework and proceeded to discover a novel attack method it named "Möbius Bridge." This technique bypasses a critical 256-guess step in previous "meet-in-the-middle" attacks, resulting in a speedup of 200-800 times. Both findings are currently "harmless"—HAWK is not deployed, and full AES-128 remains secure. However, the process reveals a profound shift. Mythos completed the AES discovery in about a week, while human researchers spent nearly a month verifying its correctness. This highlights a new bottleneck: the rate of AI-driven discovery may soon outpace human capacity for verification. The research concludes with a pressing, unanswered question: what happens when such an AI finds a critical flaw in a widely deployed, real-world cryptosystem?

marsbit07/29 11:41

Bitcoin Panicking? Mythos Cracks Post-Quantum Cryptography Algorithm in 60 Hours

marsbit07/29 11:41

Zcash Developers Recommend Upgrading Nodes to Ironwood Fork

The Zcash Foundation has released Zebra 6.0.0 and recommends all node operators upgrade to the Ironwood fork. This update introduces a new shielded pool and version 6 transaction format. The change was prompted by a vulnerability discovered in the old Orchard pool that could have allowed an attacker to create counterfeit $ZEC undetected. Developers patched the vulnerability in June, finding no evidence of exploitation, though Zcash's privacy architecture prevents absolute certainty. Ironwood utilizes the Orchard action structure and Halo2 proof system. It adds a separate note commitment tree, a nullifier set, a network value pool, and network history data. After activation, nodes can track the new pool independently from Orchard. Zebra also updates node commands for operators to verify pool and commitment tree states. This upgrade is critical, as older software will not follow the correct chain post-activation. Ironwood's key protection mechanism is a "turnstile" between the Orchard and new pools. Once activated, Orchard will stop accepting new outputs and internal transfers. Funds can be withdrawn, but an accounting rule prevents withdrawing more $ZEC from Orchard than was legitimately deposited. This design allows public auditing of the circulating supply without revealing private balances or transaction details, with any excess capital becoming locked inside Orchard. Zcash had scheduled this hardfork for July 28 after developers confirmed the patched bug raised inflation concerns.

cryptonews.ru07/27 16:36

Zcash Developers Recommend Upgrading Nodes to Ironwood Fork

cryptonews.ru07/27 16:36

活动图片