Coldcard Debacle Exposes Vulnerability in Closed-Source Software
The recent Coldcard hardware wallet debacle has exposed a critical vulnerability in the world of cryptocurrency security. Over the last few days, over $90 million worth of Bitcoin was stolen from nearly 5,000 addresses due to a flaw in the wallet's seed generation process.
The issue arose when it was discovered that a preprocessor guard had routed seed generation to a weak software PRNG (pseudorandom number generator) instead of the hardware entropy source. This meant that the effective entropy collapsed to around 40 bits, making it vulnerable to attack.
The flaw had been present in the firmware for over five years, and attackers were able to sweep the affected addresses before anyone even realized what was happening. It's believed that someone used AI to comb through the publicly available firmware to find the bug, which highlights the growing threat of AI-assisted attacks on cryptocurrency security.
The incident has sparked concerns about the use of closed-source software in the industry, with many experts arguing that it provides a false sense of security. In reality, anything distributed is readable, and highly skilled AI can find vulnerabilities in even the most complex code.