flash on Nostr: ⚡️👀 NEW - Coldcard honeypot tests suggest attackers are still targeting only ...
⚡️👀 NEW - Coldcard honeypot tests suggest attackers are still targeting only the easiest wallets!
New community honeypot tests indicate attackers are continuing to prioritize the lowest-hanging fruit from the Coldcard Mk3 RNG vulnerability.
Researcher Cole funded five compromised Mk3 wallets: one with only the vulnerable seed, three protected by 1-, 2-, and 3-word BIP39 passphrases, and one using a random account number. Fourteen hours later, only the unprotected seed-only wallet had been drained.
Separately, James O'beirne's live tripwire dashboard shows just 2 of 17 honeypot wallets swept so far. The only confirmed sweeps have been wallets with no added entropy, while all wallets protected with dice rolls, passphrases, multisig, or other added complexity remain untouched.
The results suggest attackers are currently focusing on the easiest-to-brute-force wallets rather than expending resources on hardened targets, though affected users should still migrate funds immediately rather than relying on temporary protection.
{
"id":"b244f80f46b6cf79e7174e7c4be9076afc6912bffbdb1253dc5d9ebd08a3a916",
"pubkey":"4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at":1786035812,
"kind":1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/417c6614498c25a0cc209e4b6f2788ef33c34bf7573ab968b67a11b98593ccac.mp4",
"m video/mp4",
"dim 1280.0x720.0"
],
[
"client",
"Primal iOS"
]
],
"content":"⚡️👀 NEW - Coldcard honeypot tests suggest attackers are still targeting only the easiest wallets!\n\nNew community honeypot tests indicate attackers are continuing to prioritize the lowest-hanging fruit from the Coldcard Mk3 RNG vulnerability.\n\nResearcher Cole funded five compromised Mk3 wallets: one with only the vulnerable seed, three protected by 1-, 2-, and 3-word BIP39 passphrases, and one using a random account number. Fourteen hours later, only the unprotected seed-only wallet had been drained.\n\nSeparately, James O'beirne's live tripwire dashboard shows just 2 of 17 honeypot wallets swept so far. The only confirmed sweeps have been wallets with no added entropy, while all wallets protected with dice rolls, passphrases, multisig, or other added complexity remain untouched.\n\nThe results suggest attackers are currently focusing on the easiest-to-brute-force wallets rather than expending resources on hardened targets, though affected users should still migrate funds immediately rather than relying on temporary protection.\nhttps://blossom.primal.net/417c6614498c25a0cc209e4b6f2788ef33c34bf7573ab968b67a11b98593ccac.mp4",
"sig":"ef994226d2fec353ee8e0e2af51f275aabc8207caaae97877ebcaa878f0005da1ef2ea089b7fe05051b0ec5267b01223d78a4cf3da33370765841764c95a21a6"
}
