🚨 Bitcoin Blunder: 120K Keys at Risk? OneKey Spills the Beans! 🍵

by

Well, butter my biscuit and call me crypto-curious! 🥴 OneKey, the self-custody wallet that’s supposed to keep your Bitcoin safer than a squirrel’s acorn stash, has just dropped a bombshell. Turns out, a whopping 120,000 Bitcoin private keys are potentially as secure as a screen door on a submarine. All thanks to a little oopsie in the Libbitcoin Explorer (bx) 3.x library-the digital equivalent of leaving your keys under the doormat. 🏠🔑

Here’s the kicker: this flaw, unearthed after the hilariously named “Milk Sad” incident (yes, you read that right, Milk Sad-sounds like a lactose-intolerant cow’s worst day 🐄😭), makes wallets vulnerable to brute-force attacks. Why? Because the library decided to use the Mersenne Twister-32 algorithm, which relies on system time as a seed. That’s like using a sundial to time a rocket launch-not exactly cutting-edge. ⏰🚀

OneKey, in their infinite wisdom, assured everyone on X (formerly Twitter, because why not rename everything?) that their hardware and software wallets are as safe as a baby in a bubble wrap factory. 🛡️👶 But here’s the twist: if you’ve been using software wallets with weaker randomness, moving your recovery phrases to hardware wallets might be like trading a leaky boat for a slightly less leaky one. 🚣♂️💦

“The vulnerability disclosed in the Milk Sad incident does not affect the mnemonic or private key security of any OneKey hardware or software wallet.”

– OneKey (@OneKeyHQ) October 17, 2025

OneKey’s Security Circus 🎪

OneKey didn’t stop at just saying “Oops, our bad.” They went full Sherlock Holmes, testing their mnemonic generation across macOS, Windows, Android, and iOS. 🕵️♂️ The verdict? Their random number generators are NIST SP 800-22 and FIPS 140-2 compliant-basically, they’re the Usain Bolt of randomness. 🏃♂️💨 Even their browser version uses Chrome’s built-in security tools, and their mobile apps lean on the operating systems’ own security features. Fancy, right?

But wait, there’s more! Every OneKey hardware wallet has its own chip that generates random numbers internally, following security rules stricter than a librarian on a Saturday night. 📚🤫 Older models? They’re not slacking either, meeting global security standards like they’re running for office. 🗳️

Meanwhile, in the shadowy corners of the internet, Cisco Talos and Google discovered that the North Korean hacking group Famous Chollima is up to no good. These digital mischief-makers are hiding malware in blockchain smart contracts using a sneaky trick called “EtherHiding.” Their target? Job seekers, because nothing says “career opportunity” like a fake interview designed to steal your crypto and personal info. 🕵️♂️💼

Moral of the story? Randomness matters more than your aunt’s secret cookie recipe. 🍪 And hardware wallets? They’re the bouncers of the crypto club, keeping the bad guys guessing. 💪🔒

Read More

2025-10-18 10:19