Article URL: https://onekey.so/anzen/coldcard-entropy-failure/ Comments URL: https://news.ycombinator.com/item?id=49205595 Points: 5 # Comments: 3

Two files, four lines, five years unnoticed. This is the COLDCARD entropy failure taken apart step by step — what the defect was, how attackers found the wallets, what affected owners should do — and the four checks OneKey runs so the same thing cannot happen here quietly. Six steps, no jargon. The note beside each one is the precise technical version, for anyone who wants to check the work. A hardware wallet does several jobs. It shows you what you are actually signing rather than asking you to trust the screen of an infected computer, and it keeps your key inside a chip built to resist being opened. Every one of those defences assumes the same thing: that the number your key was derived from could not have been guessed. If it could, an attacker never has to get past any of them. The pool a 24-word phrase is supposed to be drawn from holds roughly one number for every thousand atoms in the observable universe. The point was never that your phrase is hidden. It is that the pool cannot be searched. 12 words carry 128 bits of entropy, 24 carry 256, plus a checksum from the SHA-256 of that entropy. BIP-39 stretches the result into the BIP-32 master key. 12 words carry 128 bits of entropy, 24 carry 256, plus a checksum from the SHA-256 of that entropy. BIP-39 stretches the result into the BIP-32 master key. A 2021 firmware change quietly stopped the wallet asking its dedicated randomness chip for that number, and had ordinary software calculate one instead. Side by side, this is the entire incident: It is tempting to read that as security cut by two thirds. It is not. Each bit doubles the work, so losing 88 of them does not shrink the job by a factor of three — it shrinks it by a factor of 2⁸⁸. A trillion is still a large number to a person; it is not a large number to someone renting high-performance machines to work through it one at a time. Seed generation moved from ckcc.rng_bytes() to ngu.random.bytes(). Coinkite estimates about 40 bits of remaining search space on Mk3 and about 72 on Mk4/Mk5/Q, against a 128-bit target. Independent analysis by Block reaches the same order — under 2⁴⁰·⁷ and under 2⁷³·³ — and finds narrower conditions where far less is left.2