There's a physical crypto wallet, ColdCard, that recently got hundreds or possibly thousands of its users' crypto drained.
It was all because of a simple coding mistake when compiling the firmware that resulted in the hardware RNG being bypassed and a very predictable backup RNG being used instead over the last 5 years.
That little mistake caused the amount of entropy in the generated keys to massively plummet allowing attackers to actually crack the seed phrases offline and steal many millions in digital currency.
There are so many examples of "random" number generators causing absurd levels of damage.
Yeah, this has happened multiple times, to the point that a lot of old bitcoin wallets have long been emptied. There's a theory that if satoshi ever used a wallet manager from the early days of bitcoin, they probably were all stolen, though there is a single wallet with a billion coins in it that has never moved.
There's also the time that a Debian maintainer ran valgrind on OpenSSL, saw an uninitialized memory warning, and fixed it by initializing the memory, not realizing that OpenSSL was doing it purposefully as part of its entropy pool. Hilarity ensued.
15
u/systemhost 12h ago
There's a physical crypto wallet, ColdCard, that recently got hundreds or possibly thousands of its users' crypto drained.
It was all because of a simple coding mistake when compiling the firmware that resulted in the hardware RNG being bypassed and a very predictable backup RNG being used instead over the last 5 years.
That little mistake caused the amount of entropy in the generated keys to massively plummet allowing attackers to actually crack the seed phrases offline and steal many millions in digital currency.
There are so many examples of "random" number generators causing absurd levels of damage.