密钥安全性风险

A major exploit of Coldcardwallets has highlighted the risks associated with private keys, with thousands of addresses affected and estimated losses of over $111 million. The hack, which occurred due to a flaw in the generation of seed phrases, has led to the compromise of numerous private keys, allowing attackers to access and steal funds.

安全风险

The Coldcard wallet is designed to keep private keys offline, but the affected versions, running firmware 4.0.1 to 5.0.3, had a flaw in the generation of seed phrases. This allowed attackers to reconstruct the seeds and access the corresponding private keys, without physically touching the devices. Galaxy Research estimates that the losses could exceed $130 million once all transactions are analyzed.

行业影响

The incident has sparked a debate about the security of private keys and the role of hardware wallets in protecting them. While hardware wallets have been touted as a secure solution, the Coldcard hack shows that they are not foolproof. Ben-Natan argues that the reliance on private keys creates a single point of failure, and that users must either remain vigilant and take responsibility for their security or delegate it to a trusted third party.

用户责任

The fact that users who protected their seeds with an additional passphrase (BIP-39) were largely unaffected highlights the importance of user responsibility in security. This incident serves as a reminder that security is an ongoing process, and that users must remain proactive in protecting their assets.