keys

Bitcoin News posted on the X platform that Bitcoin developers have launched a new visualization tool to explain how entropy works and how to generate randomness for Bitcoin private keys.The tool covers true random number generators (TRNG), pseudo-random number generators (PRNG), rolling dice, and flipping coins.

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

According to monitoring by Bitcoin News, Nunchuk stated that some keys on the Nunchuk platform are generated by Coldcard Mk4, but these keys will not be used directly.Nunchuk will derive independent keys through custom logic, making them less susceptible to lookup table attacks based on leaked Coldcard seeds. Nunchuk added that, given enough time, it believes attackers may eventually incorporate these derived keys as well.

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

Programmer Stefan Thomas holds an IronKey encrypted USB drive containing the private keys for 7,002 bitcoins, which were earned as a reward for his 2011 educational video "What is Bitcoin?" Recently valued at approximately $111,000 each, this amounts to about $777 million.The IronKey device is set to permanently lock and delete its contents after 10 incorrect password attempts. Thomas has tried 8 times and has only 2 attempts left. The manufacturer Kingston stated that there are no backup passwords or alternative recovery methods aside from the original password set by the user. Thomas has sought assistance from the digital forensics company Naxo and security researcher Chris Tarnovsky, and he previously declined Unciphered due to having reached a verbal agreement with both teams. As of the end of 2025, the IronKey remains stored in a Swiss vault, with no confirmation of a successful recovery by mid-2026.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.

Humanity Protocol founder Terence Kwok posted on the X platform confirming a security incident, stating that this incident involves the private key leak of a Humanity Foundation member. For safety reasons, users are advised not to interact with cross-chain bridges or any liquidity pools until safety is confirmed. The team is working with security experts and exchange partners to resolve the issue.According to previous reports, associated addresses of Humanity Protocol have been stolen for over 31 million dollars.

The Huobi HTX VIP private class "AI + Trading from Theory to Practice" was held in Shanghai, where early Bitcoin miner and pyra.io CTO Tian Jia shared the development of quantum computing and the impact of AI on trading.He believes that the average time it takes to threaten "Bitcoin addresses with exposed public keys" is 7 to 8 years, with a range of 5 to 15 years. The required number of logical qubits is between 1200 and 2400, while the number of physical qubits is less than 500,000. Additionally, Bitcoin also has defensive measures; it can migrate to PQC, or post-quantum cryptography, although there are significant challenges, such as the locking issue of Satoshi's coin.

According to Cryptopolitan, the Digital Asset Exchange Alliance (DAXA) in South Korea has introduced new compliance standards requiring exchanges to revoke API keys suspected of being improperly shared among users. The new regulations aim to combat market manipulation, false orders, and other behaviors that exploit shared or leaked API credentials.According to the new guidelines, DAXA member exchanges will take strict measures when suspicious API sharing behavior is detected. After enhanced monitoring and user warnings, users will be required to undergo mandatory re-authentication. Upbit, Bithumb, Coinone, Korbit, and Gopax are all regulated by DAXA, and these exchanges will also implement an IP whitelist system to restrict API access only from approved addresses. The Financial Supervisory Service of Korea stated that automated trading currently accounts for about 30% of domestic cryptocurrency trading volume.

In response to the unauthorized access event of the internal code repository disclosed by GitHub, Zhao Changpeng reminded, "If the code contains an API Key, even if it is in a private repository, it should be reviewed and replaced immediately."

Echo Protocol announced that its eBTC deployment on Monad experienced unauthorized activity, resulting in abnormal minting and financial losses. Preliminary investigations indicate that the issue stemmed from the compromise of the administrator keys related to the Monad deployment, with approximately $816,000 in assets currently confirmed to be affected.Echo stated that the Monad network itself was not affected and continues to operate normally. The team has regained control of the administrator keys and has destroyed the remaining 955 eBTC held by the attacker. The project further clarified: the current incident appears to be limited to the Monad deployment; there is no evidence to suggest that the Aptos side has been affected; aBTC on Aptos and eBTC on Monad are independent, non-bridgeable assets; the current related risk exposure on Aptos is approximately $71,000.As an additional precaution, Echo has suspended the cross-chain functionality of the Monad deployment and has begun upgrading the related EVM bridging contracts and permission control mechanisms, while reminding users not to interact with any unofficial claims, refund, or recovery pages.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

According to Politico, Poland's major cryptocurrency exchange Zondacrypto is facing a serious fraud investigation. Its former CEO went missing in 2022, taking with him the private keys to a cold wallet containing 4,500 bitcoins (currently worth over $340 million). The current CEO has admitted to being unable to access the wallet and has recently been reported to have fled to Israel. Prosecutors estimate potential losses for customers to be around $97 million.On-chain data shows that the bitcoin balance in the platform's hot wallet has plummeted by 99.7% since mid-2024, with users generally reporting difficulties in withdrawing funds. Polish Prime Minister Tusk estimates that up to 30,000 users may be affected.Tusk publicly accused the platform of being funded by Russian-linked money, used to finance opposition lawmakers to obstruct Poland's cryptocurrency regulatory legislation. He bluntly stated that this is a "Polish version of a Ponzi scheme" and criticized the president for vetoing the localization of the EU MiCA framework twice, making Poland a "paradise for scammers."The platform's board stated that they failed to obtain "verifiable information" from the missing CEO and have collectively resigned. The founder has been missing since 2022, and the previously mentioned "suspect kidnapping allegations" case is still under investigation. This incident is expected to prompt Poland and the EU to strengthen regulatory scrutiny of cryptocurrency exchanges.

Syndicate has released an update regarding the recent security incident, stating that the leakage of private keys led to the malicious upgrade of bridging contracts on two chains, resulting in the theft of approximately 18.5 million SYND (about $330,000) and around $50,000 in customer tokens. Affected users will receive full compensation, and SYND holders will receive additional compensation.The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of insider involvement. The root cause of the vulnerability was the storage of private keys in a password manager, and the upgrade process did not utilize multi-signature or hardware signing. Syndicate is strengthening security measures, including adding an encryption layer outside the password manager and implementing multi-signature or hardware signing for the upgrade path.

Project Eleven today awarded the Q-Day prize to researcher Giancarlo Lelli, who successfully derived a 15-digit elliptic curve private key from a public key using publicly accessible quantum hardware, marking the largest scale demonstration of its kind to date, a 512-fold increase from the 6-digit demonstration in September 2025.Lelli used a variant of Shor's algorithm for the elliptic curve discrete logarithm problem, which is the mathematical foundation of the Bitcoin signature scheme, with the awarded hardware featuring approximately 70 qubits. Currently, no known quantum computer can crack real Bitcoin wallets, and the security of Bitcoin's 256-bit elliptic curve remains far beyond current quantum capabilities. Notably, Google lowered its resource estimates for ECDLP-256 on March 31 and set a target for the migration to quantum cryptography after 2029, followed by Cloudflare, and the UK's NCSC also set migration milestones from 2028 to 2035.On-chain data shows that approximately 6.93 million BTC are at potential quantum risk due to exposed public keys. The Bitcoin community has proposed BIP 360 and BIP 361 to promote the migration to quantum-resistant output types, but the coordination challenges of a decentralized network remain the biggest hurdle.

The Solana ecosystem DeFi protocol Meteora announcement has noted the latest developments regarding the security incident of the cloud hosting platform Vercel. The environment keys were immediately rotated and logs were checked 12 hours ago, and everything is normal. The official team will continue to monitor the situation to ensure the safety of Meteora and its users.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.

The exchange Zonda stated that its cold wallet holding 4,503 bitcoins (worth approximately $334 million) is currently inaccessible.Zonda CEO Przemysław Kral issued a video statement claiming that the private key for the wallet was never handed over during the company's transition. The private key was supposed to be transferred by Zonda's founder and former CEO Sylwester Suszek, but Sylwester Suszek has been missing since 2022. Przemysław Kral denied allegations of misappropriating funds and stated that an unusual surge in withdrawal requests was triggered by negative media coverage. Zonda plans to take legal action against false statements and is committed to fulfilling its obligations to customers. The exchange was renamed from BitBay to Zonda in 2021.

This morning, 60,000 ETH were redeemed from Ethereum staking and transferred to Coinbase. According to analysis by Yu Jin, the owner of this ETH is Andrew Keys, co-founder of DARMA Capital, and this ETH has been staked for nearly 5 years.In recent days, these ETH have been largely redeemed and aggregated, then transferred to Coinbase. During the nearly 5 years of staking, these ETH earned approximately 18% in coin-based returns (16,000 ETH, worth 34.2 million USD).