钱包安全 · 172

A user's CEX account lost $750,000 in BTC due to Google verification cloud sync issues

According to GoPlus monitoring, according to GoPlus monitoring, a Bitcoin holder has just safely transferred assets from a Coldcard MK4 hardware wallet to a centralized exchange to avoid the risk of the hardware wallet itself being stolen, but his Google account was hacked within 12 hours after the transfer was completed. As a result, the exchange account was logged in and about 750,000 US dollars of bitcoins were emptied because Google Verification Cloud sync was enabled. GoPlus points out that such attacks usually do not rely on brute force cracking, but are achieved through social worker phishing and weak password crashing into databases. Common routes include: phishing pages inducing the input of Google passwords, malicious browser plug-ins or cracking software to steal cookies and passwords, reuse weak passwords, and resetting passwords after email or phone numbers have been taken over.

6d ago

Crypto industry renews debate over who should hold private keys due to $130 million Coldcard wallet theft

Comparatively, a wallet security incident involving the loss of about $130 million in bitcoins is once again triggering discussions in the crypto industry about the asset escrow model: should Bitcoin holders rely on personal self-custody or switch to institutional custody. Some firmware of hardware wallet vendor Coldcard had random number generation bugs in 2021, causing some mnemonic words generated by the device to be predictable. The vulnerability was discovered many years later. Currently, more than 5,200 addresses and about 2,000 BTC have been stolen, and the scale of losses is about 130 million US dollars. After the incident, some investors began to switch to Wall Street escrow products. The data shows that the US spot Bitcoin ETF had a net inflow of around $626 million in the days following the incident. Bloomberg ETF analyst Eric Balchunas said such security incidents could further drive money flows to ETFs. However, the Bitcoin core community still adheres to the concept of self-management. Casa co-founder Jameson Lopp said recent events should not diminish users' confidence in self-hosting, pointing out that third-party hosting is also risky. Peter Todd, an early Bitcoin Core developer, also believes that self-hosting's long-term security record is superior to centralized institutions. Michael Tanguma, co-founder of Bitcoin escrow platform Onramp, believes that both solutions are flawed. He said that concentrating large amounts of assets in a single institution will form a honeypot, while hardware wallets face risks such as supply chain, firmware, and random number generation. Tanguma proposed a multi-agency hosting solution, that is, multiple supervised agencies hold separate keys through a multi-signature mechanism, and any transaction requires multiple agencies to sign together to reduce the risk of a single point of failure. However, the model has also sparked controversy. Critics believe that although multi-agency hosting improves security, it also introduces licensing management, which conflicts with the decentralized concept that Bitcoin initially sought. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is looking for new escrow solutions suitable for long-term wealth management. The Coldcard vulnerability once again highlights how to balance security, decentralization, and ease of use remains a core challenge facing the Bitcoin ecosystem. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

12d agoburnking

Bloomberg Analyst: Five Bitcoin ETFs, including IBIT, have accumulated inflows of $6.2 billion after the Coldcard hack

On Twitter, Bloomberg senior ETF analyst Eric Balchunas wrote on the X platform that since the Coldcard wallet security incident this weekend, including iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), ARK 21Shares Bitcoin Many Bitcoin ETFs, including ETF (ARKB) and ProShares Bitcoin ETF (BITO), recorded capital inflows for multiple consecutive trading days, with a cumulative net inflow of approximately US$620 million. Analysts said that it is currently impossible to confirm a direct link between the Coldcard incident and ETF capital inflows, but in the long run, some users may switch to Bitcoin investment products managed by large financial institutions due to concerns about self-custody security. This capital inflow is also seen as a demonstration of the value of traditional finance (TradFi) Bitcoin products in terms of security and custodial capabilities. Market participants pointed out that for some investors, choosing an ETF with a mature risk control system and institutional custodian capabilities may be more attractive than relying on small wallet vendors to guarantee asset security on their own. According to this view, with the gradual institutionalization of the Bitcoin market, secure custody, asset recovery mechanisms, and compliance guarantees are becoming important factors for investors to choose investment channels. The competitive advantage of traditional financial institutions in the field of digital assets is being further demonstrated. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

15d agoburnking

Ledger CTO: Coldcard Vulnerability Warns Hardware Wallet Security Needs to Adapt to the AI Era

According to Decrypt, according to Decrypt, Ledger's chief technology officer Charles Guillemet said that the Coldcard vulnerability revealed the weakness of random number generation of hardware wallets, and emphasized that AI is reshaping the cybersecurity attack and defense pattern. Guillemet notes that the security model for hardware wallets “lives and deaths depend on random numbers,” and this incident proved this in the most expensive way. Ledger stated that its hardware wallet was unaffected because its mnemonic words were generated by a hardware random number generator within a certified security element, with no software fallback path, and a full 256-bit random number was generated each time. Guillemet believes that open source code is not equivalent to security if it is not fully reviewed. AI is enabling attackers to scan code and identify vulnerabilities at machine speed, and defense must advance at the same speed. This requires reliance on security design, hardware, and mathematics. Guillemet suggests that users should understand how random numbers are generated and whether they have been independently certified when choosing a hardware wallet.

17d ago

Bloomberg ETF analysts question Coldcard's security capabilities: it's “unbelievable” that a team of about 5 people runs an important wallet

Comparing news, Bloomberg senior ETF analyst Eric Balchunas posted an article on the X platform commenting on the Coldcard wallet security incident. He questioned whether a company of only about 5 people was suitable for such an important Bitcoin storage role, and said that the number of employees behind Coldcard “seems unbelievably low”. If a bank has only 5 employees and is headquartered in Canada, would people be willing to store their lifetime savings in it? This may be viewed as a characteristic in the crypto industry, but from a traditional financial perspective, this would be a clear sign of risk. Balchunas further stated that in comparison, institutions with larger teams, such as Coinbase and Ledger, may have an advantage in terms of secure investment and operational capabilities, even if users need to bear higher transaction costs. Bitcoin ETFs provide an alternative: investors can get both the security guarantees provided by large, specialized, regulated financial institutions, and enjoy lower management fees.

19d ago

The Coldcard attack continues to ferment, and the Galaxy research director says there are “imitators” targeting the remaining mnemonic words

Comparing the news, Alex Thorn, head of research at Galaxy, wrote that the attack incident surrounding the Coldcard wallet continues to develop. More small attackers and imitators have now appeared to attack the remaining Coldcard mnemonics. He said that by helping to confirm the identity of a depositor in the attack, the relevant funds were transferred out before the Duel platform could be frozen, and the funds involved were not part of the three major attacks previously identified by Galaxy Research waves. Earlier, the suspected Coldcard security incident attracted market attention, and several researchers discovered abnormal fund transfers in some wallet addresses generated by Coldcard. Galaxy Research continues to track the attack address and reminds users who still use the relevant wallet torrent to take security measures as soon as possible. The incident also further highlighted the importance of hardware wallet security, private key management, and self-hosting risk prevention. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

19d agoburnking

ETH Summer 2026: The Summer of Ethereum ended successfully in Kuala Lumpur

On June 24, the “ETH Summer 2026 Ethereum Summer” in Kuala Lumpur, co-hosted by Synbo Protocol, ETHPanda and LXDAO, came to a successful conclusion in Kuala Lumpur, Malaysia. The event focused on “How far is it from ordinary users in the Web3 application era?” Discuss and engage builders from wallets, security, community, infrastructure, and industry research institutes. During the event, participants shared and exchanged views on topics such as the on-chain market, market infrastructure, Southeast Asian Web3 development, community growth, and actual application implementation. The organizer, Synbo, said it hopes to push Web3 further from infrastructure construction to a more realistic user scenario by connecting developers, entrepreneurs, communities and capital. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

57d agoburnking

How to “steal” $290 billion in bitcoins through a lawsuit without a private key?

By KarenZ, Foresight News Original title: Can You Claim $290 Billion of BTC Ownership Without a Private Key? The New York court received a peculiar affirmative action: some claim they “found” 39,069 bitcoin wallets that had been dormant for a long time. The attachment submitted with the complaint was 889 pages long, and each line was a Bitcoin address, like a list of lost items in the digital world. 1feeXv6b is in first place... It has long been viewed by on-chain observers and Mt. Gox is linked to stolen bitcoins. The case went to the Supreme Court of New York County, New York on May 1, 2026. The plaintiff used the anonymous name Noah Doe, and two other companies, ABC Company and XYZ Company, which also hid their real names. The defendant, on the other hand, wrote John Does 1-39,069, pointing to the unidentified potential rights holders behind these addresses. The plaintiffs asked the court to confirm that these wallets and their corresponding digital assets belonged to them according to law. According to estimates by the founder of the on-chain analysis platform Timechain Index, listed addresses hold a total of about 3.79 million BTC, worth close to $290 billion. The court has yet to decide on this number or asset ownership. However, here's an absurd and serious question: can a string of chain addresses that everyone can see but no one can easily spend can really be “taken” by someone like a wallet on a park bench? He first found the address and then sent a “solicitation notice” to the address. According to the indictment, the story begins in October 2024. Noah Doe claims he has identified security issues with some digital wallets, and holders may have lost the ability to withdraw assets. Afterwards, he developed an algorithm to find self-hosted wallets that had no trading activity for at least five years and looked like they might have been abandoned. In the plaintiff's account, a wallet was included in the initial scope and mainly met several conditions: the address had no transfers or other visible activities for at least five years; the wallet was not part of a third-party custodian such as an exchange, but was kept by the holder; during its slumber period, the price of Bitcoin experienced a significant rise, but the address still did not act to realize profits or transfer assets. According to the lawsuit, he found the address in three batches: “Found” here did not mean finding a hard drive, paper wallet, or mnemonic phrase containing private keys. According to the complaint, he identified and kept address records of these wallets, then wrote the records onto a USB drive and submitted them to the 17th Division of the New York Police Department. The complaint alleges that the police returned these USB's a few months later. The plaintiff described this process as having deposited the discovered property with the police in accordance with New York's law on the acquisition of property. If the story stops here, it sounds like a bizarre digital lost property report. What really made the coin community notice this incident was the next notification action. From the end of June to July 2025, someone began sending very small transactions to a group of long-dormant Bitcoin addresses and writing notification information in the OP_RETURN data field of the transaction. OP_RETURN can permanently leave short messages on the Bitcoin chain, like a sticker on an electronic bulletin board that no one can erase. The notification directs the recipient to the Salomon Brothers web page. The website claims that the relevant wallet appears to have been lost or abandoned, and that its customers have taken “presumptive possession” of the wallet. The actual owner must identify themselves by October 10, 2025, including through assets in a mobile wallet or submitting proof of ownership. If there is no response, they may be taken to court as evidence that rights have been waived. The design is quite clever, and quite outrageous: first send a registered letter on a chain to the sleeping address, then interpret the silence as no one claims it. The problem is that Bitcoin addresses don't open mailboxes. People who have lost their private keys can't respond with transactions; holders who have died can't respond; holders of long-term cold storage may not pay attention to this small amount of money at all. In the Bitcoin world, quiet can mean a lot of things. The plaintiff wanted the court to interpret this silence as unclaimed. Galaxy saw an astonishing on-chain experiment before the lawsuit was made public, and the action had left plenty of traceable traces. On October 8, 2025, Galaxy Research released a report specifically analyzing Salomon Brothers-related...

86d agoburnking#Bitcoin #private key

[Comparative Daily News Picks] The Federal Reserve kept interest rates unchanged as scheduled; Powell: Determined to defend the independence of the Federal Reserve and continue to serve as a Federal Reserve board member for a “period of time”; Meta supports some creators to settle in USDC and access Solana and Polygon wallets; 21Shares executives: Bitcoin may hit 100,000 US dollars during the year, and institutions are entering the market at an accelerated pace

Web3 news selected by the editor every day: “The Federal Reserve keeps interest rates unchanged as scheduled” Comparative News, the Federal Reserve kept the benchmark interest rate unchanged at 3.50%-3.75%, and remained on hold for the third consecutive session, in line with market expectations. [Powell: Determined to defend the independence of the Federal Reserve and continue to serve as a Federal Reserve Board member for a “period of time”] Comparing news, Federal Reserve Chairman Powell said at a press conference that he will continue to serve as a Federal Reserve member “for a while” after he steps down as chairman. Powell pointed out that in the past three months, the Federal Reserve has been hit harder than ever before, and he is determined to defend the independence of the Federal Reserve. Powell made it clear that the damage he was talking about was not political criticism, but only a legal lawsuit. He said, “What happened in the past three months left me with no choice but to stay in office.” Powell said the Department of Justice will not investigate him again unless the federal inspector general requests a criminal transfer. However, Powell is not satisfied with this. He said, “I will continue to serve as a member of the Federal Reserve, the term is yet to be determined,” and promised to “keep a low profile.” [Meta supports some creators to pay with USDC and connect to Solana and Polygon wallets] In comparison, Meta has begun providing some creators with the option to settle in USDC, and users can directly withdraw the proceeds to Solana or Polygon based wallets. Creators can bind to crypto wallets (such as MetaMask, Phantom, etc.) to receive funds. The payments service is powered by Stripe and may provide users with crypto-related tax reports. Meta also warned that stablecoin payments have inherent risks, and users need to ensure their own account and wallet security; in case of technical issues or special circumstances, the company may also switch to other payment methods to complete the settlement. According to previous news, Meta is planning to further lay out stablecoin-related businesses during the year. [21Shares Executive: Bitcoin may hit $100,000 during the year, and institutions are entering the market at an accelerated pace] In comparison, 21Shares Chief Investment Officer Adrian Fritz said that spot Bitcoin ETFs continue to attract capital inflows and are strengthening Bitcoin's central position in institutional asset allocation, even if the price is still fluctuating below $80,000. Adrian Fritz pointed out that Bitcoin ETFs have accumulated nearly $2 billion in capital since this year, with funding sources covering arbitrage and options strategy transactions for retail investors, institutions, and hedge funds. As traditional asset management institutions such as Morgan Stanley accelerate their deployment, crypto assets are being more widely incorporated into multi-asset portfolio allocations. The current daily trading volume of Bitcoin has exceeded 50 billion US dollars, and the level of liquidity is close to that of large technology stocks such as Nvidia. The ETF mechanism provides both primary and secondary market liquidity, making it gradually become an “institutional-grade asset”. Although the market is still being suppressed by the macro and interest rate environment, Adrian Fritz believes that ETF capital inflows have shifted from speculative drive to structural demand, and expects Bitcoin to challenge the $100,000 mark during the year, driven by factors such as geopolitical improvements, continued capital inflows, and short recovery. At the same time, the differentiation of altcoins has intensified, and the market is shifting to an asset selection logic that places more emphasis on fundamentals and cash flow. [Hyperliquid layout prediction market plans to explore the zero opening fee challenge Polymarket] Comparing news, Hyperliquid is accelerating its entry into the prediction market circuit and plans to compete with platforms such as Polymarket and Kalshi through the newly launched “outcome tokens (outcome tokens)” mechanism. According to the recently disclosed fee structure, Hyperliquid uses a “zero fee for opening a position, closing or settlement fees” model in incident transactions, and covers various scenarios such as casting, trading, destruction, and settlement. The platform also provides lower transaction costs for “aligned quote tokens”, including market-making rebate increases and fee discount mechanisms. This feature will be introduced through the HIP-4 upgrade, enabling users to trade binary contracts based on real-world events in the same account and integrate with existing spot and perpetual contract systems to form a unified trading environment. The forecast market has grown rapidly in recent years, with an overall transaction volume of over $63.5 billion in 2025. Hyperliquid's previously launched HIP-3 has driven its unlicensed perpetual contract market to account for more than 3 of the platform's trading volume...

114d agoWendy#Compare Daily Picks

Data: Over the past 10 years, crypto hacking has cost more than $17 billion

Comparative news, according to Cointelegraph, DeFiLama data shows that 518 hacking incidents have occurred in the cryptographic field in the past 10 years, with cumulative losses of more than 17 billion US dollars. Most of these losses are related to private key leaks, phishing, and other credential attacks. As smart contract security continues to improve, attackers are moving more towards wallet security, signature infrastructure, development tools, and user operations. Recently, Kelp DAO's RsETH cross-chain bridge was attacked, and approximately 116,500 RsETH were stolen, worth about $290 million to $293 million at the time.

122d ago