Liquid Network a perdu près de 320 millions de dollars en Bitcoin en l'espace de quelques heures, sans qu'aucune clé n'ait été volée. Explications.

Reuters reports: Liquid Network, a Bitcoin-based payments and settlement network, said on Sunday that about $320 million was withdrawn from its federation wallet in a hack. "Purported white-hat hackers" withdrew around 4,000 of the 4,200 bitcoin held in its Liquid Federation wallet, Liquid Network said in a post on X. "Liquid wallets will be impacted," their post concluded, adding "and we're sorry for any inconvenience."

Read more of this story at Slashdot.

N’importe qui peut mettre son ordinateur au travail pour tenter de récupérer les 300 000 € qui dorment sur ce site. La somme est bien réelle, la méthode parfaitement légale et aucune inscription n’est nécessaire. Seul problème : vos chances sont faibles (infiniment faibles).

Trois actualités à retenir cette semaine dans le cyberespace : le fabricant de portefeuilles Bitcoin Coinkite reconnaît l'ampleur d'un piratage massif dû à un bug vieux de 2021, OpenAI reconstitue comment ses agents autonomes ont créé leur propre forum secret avant de pirater Hugging Face et l'Armurerie Lavaux devient la dernière victime en date d'une série de fuites visant les tireurs français.

Depuis le 31 juillet, l'alerte rouge est lancée chez les utilisateurs de Coldcard. Ce portefeuille matériel dédié au Bitcoin est visé par des piratages massifs, la faute à un bug de compilation resté invisible depuis 2021.

"A hardware wallet is supposed to be the safest place to keep Bitcoin," writes The Street, since it never connects to the internet, its keys never leave the device, and "the whole point is that an attacker would need to physically hold it to steal anything." The problem is that anyone who can reproduce the recovery seed doesn't need to possess the COLDCARD, Nerds.xyz points out. More from The Street: [The recovery seed] is supposed to come from a hardware random number generator producing 128 bits of entropy, a number so large that guessing it is computationally impossible. It wasn't. According to Block's engineering team a single code change on March 1, 2021 caused the firmware to silently fall back to a software-based generator instead of the hardware one. On Mk3 devices the effective search space collapsed to roughly 40 bits. Coinkite has confirmed that figure and called it preliminary. The gap between 128 bits and 40 bits is not a matter of degree. It is the difference between a lock that cannot be picked and one that can be brute-forced by anyone with rented cloud computing.... Chainalysis found the attacker went after the largest balances first, pulling more than $30 million in the opening ten minutes. Within about 25 minutes, roughly 594 BTC had moved out of some 500 single-signature wallets. One victim lost around $1.8 million... Coinkite has shipped fixed firmware, but with a warning that matters more than the patch itself. Updating does not repair an existing seed. A seed created with weak entropy stays weak forever. Affected users have to generate an entirely new wallet on updated hardware and move their coins to it. By Saturday morning Galaxy research was tracking 1,158.66 BTC, worth roughly $75.1 million, taken from 2,673 addresses, according to the article. And "The Coldcard exploit is ONGOING," Galaxy Research posted an hour ago on X.com. "Move Coldcard single-sig funds to safe locations immediately!" We have reported ~600 addresses we believe to be hackers holding funds stolen from Coldcard-generated weak entropy addresses to federal investigators, industry compliance firms, and cross-industry cyber investigators. Thanks to Slashdot reader BrianFagioli for sharing the news.

Read more of this story at Slashdot.