Ah, I wasn't aware of that one (I don't visit that subforum on a regular basis) Maybe it would make sense to move the earlier topic over here for more visibility? @Mod, please archive or lock down this thread if needed, thanks. |
|
|
|
Vendor advisory: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incidentVendor tweet: https://x.com/Trezor/status/2087885428313543059We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026.
The data exposed:
- Full names
- Shipping addresses
- Phone numbers
- Email addresses
The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezors strict 90-day data storage policy (we were also able to negotiate the same terms with fulfillment partners, who follow the same policy).
All affected customers have been contacted separately by email.
Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts.
NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels.
|
|
|
|
I don't consider stable coins crypto, they must have centralization to exist therefore by definition cannot be a crypto currency.
NFTs for me is a maybe and I own a SATOSHICARD
The three that succeeded all did for the same reasons:
1. a huge txn is treated no differently than a tiny one
2. speed of txn and/or speed to enter a market is unmatched
3. fees are manageable within each scope
4. regulator entities had limited power
5. ownership is immutable
The next big use case will succeed for these same reasons. I evaluate all projects against these criteria.
In case you haven't seen it, there's a nice bid for a SATOSHICARD on the DEX; https://www.tokenscan.io/tx/3164909First large XCP bid for a SATOSHICARD in ages. |
|
|
|
Security Advisory: Update BTCPay Server to 2.4.2 Immediately https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
[EDIT] Locked (duplicate topic) |
|
|
|
|
Updated total drained: 1128.47 BTC
|
|
|
|
Updated total drained: 1082.65 BTC @glxyresearch
We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by
@clay_garrett
1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul 30 a 41-minute window, blocks 960,183-960,191. That preceded the hardware-wallet vendor's public advisory by ~30 hours.
Signature: every sweep paid an identical hardcoded 30.0 sat/vB a 30-75x overpay vs the 0.4-1.0 sat/vB median that week and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds. Victims: 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44 consistent with multi-path key scanning.
Proceeds consolidated within minutes and have NOT moved since:
- bc1qq85v2c9...cu9r 562.02 BTC
- bc1qx76cae2...fhe3 398.48 BTC
- bc1q8jy96fe...tp3q 89.62 BTC
- bc1qnk4zh9q...fecp0 32.45 BTC (unmoved)
|
|
|
|
|
There are fresh reports of wallet sweeps on CT.
Move your coins off Coldcard vulnerable addresses ASAP.
|
|
|
|
https://x.com/clay_garrett/status/2082980440525132245clay_garrett: There are 695 earlier transactions with the same full fingerprint that transactions in the known set had. These transactions moved another 488.10957948 BTC. If this is part of the same attack, itd bring the total to 1,082.58680432 BTC.
[...]
We scanned all 888,661 transactions in blocks 960050960230. Each match in the original wave had these shared properties: version 2, locktime 0, final sequence on every input, one output and inputs from one source address, a P2WPKH destination, one homogeneous supported input type and a 30 sat/vB pre-signing fee estimate.
|
|
|
|
|
True, details are still unclear - I've updated the OP - but there's a growing amount of evidence (on twitter and reddit) seemingly pointing to coldcard.
|
|
|
|
https://x.com/Rob1Ham/status/2082896614218203616[EDIT] Vendor advisory post: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/Technical deep dive: https://blog.coinkite.com/entropy-technical-backgrounder/From Reddit: Hoax__
It doesn't appear to be an isolated theft. The receiving address 'bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0' has received about 594 BTC (approx $37.8M) from 500 different addresses in a 15 min window (between 01:31-01:56 UTC 30/07/26). Many of the other sending addresses have been dormant for years, similar to your address. All the affected addresses contained more that 0.15 BTC at the time of the transactions.
The only way to issue a sending transaction is to have the associated private key/seed phrase. For the volume of address suspected to be compromised there could be two potential attack vectors. Either be a supply chain attack, when the hardware device purchased was compromised. Or it could be a cryptographic flaw within the hardware device where the device generates users seed phrases in such a way that an attacker could predict them, similar to the Ill Bloom vulnerability from earlier in the month.
Theft address has consolidated most of the funds in bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.
|
|
|
|
New activity going on for the good old FDCARD! Could be worth checking if you still have some of those gathering dust in old wallets. Last sale for 2700 XCP on the Counterparty DEX a few days ago (look at the Orders tab) https://www.tokenscan.io/asset/FDCARD |
|
|
|
New activity going on for the good old FDCARD! Could be worth checking if you still have some old cards gathering dust. Last sale for 2700 XCP on the Counterparty DEX a few days ago (look at the Orders tab) https://www.tokenscan.io/asset/FDCARD |
|
|
|
Hey, really cool project! One question, how does this address get multiple 4096 rewards (all with zero_count = 7) within the same block? Does this require a custom miner? I've only used Horizon so far, and it seems to be limited at one reward per block, unless I'm missing something. Are there other miners available to non-technical users? Also, there's a typo in your last post "$ZELD is live on Horizon Market on April 2nd, 2025" That should be 2026 I guess  {
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "0000000f4d6e77da40bae232c7acde4364811c16e84fc81733fd1cc1d74e50a7",
"vout": 0,
"zero_count": 7
},
{
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "00000002bb27fe1c2ac28a8f65486b9ec7c00af1c4fc735fe7db1f1f89cd7bbf",
"vout": 0,
"zero_count": 7
},
{
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "0000000385eee13d62f9c3bf2bafbec91e1fe4cff849cb8eff98dfe0564f6622",
"vout": 0,
"zero_count": 7
},
{
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "00000007f6be936cc62abd4dcba0051a8f86eb22f9a651dcddbf3730f4904e80",
"vout": 0,
"zero_count": 7
},
{
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "0000000ed22603a0343a1457765b883792ae5afc155e261e9dade2875dc8ed99",
"vout": 0,
"zero_count": 7
},
{
"address": "bc1qk63lqktl4qgc2fx3jfmzs5w46cykfffrujm5lg",
"block_index": 942606,
"reward": 409600000000,
"txid": "0000000ed5bdce09d80c755df9f871dbe0dcb33c943afcedf0a6f92b1bc20094",
"vout": 0,
"zero_count": 7
},...
|
|
|
|
|
Yup I'm still available to work on a hash dump if needed.
By the way, keep in mind there is also some BCH in there.
|
|
|
|
|
Before anything else, disconnect your computer from the network and take multiple backups of your wallet file.
Then look up your wallet address on an explorer such as mempool.space, to confirm what the current balance is.
Also, do not respond to any private messages.
|
|
|
|
A Legendary member offered his service to you in Page1, you might want to try it. If you're into a more reputable service ( user with 2 positive trust ratings), try this instead: /index.php?topic=240779.0Yep, I'm still available for password recovery (through GPU-based bruteforce) if needed. |
|
|
|
|
Not sure if you're aware of this, but your tx has an empty scriptsig, maybe that's the issue.
(Just a wild guess)
|
|
|
|
|
Show Posts
