"A hardware wallet is supposed to be the safest place to keep Bitcoin," writes The Street, since it never connects to the internet, its keys never leave the device, and "the whole point is that an attacker would need to physically hold it to steal anything." The problem is that anyone who can reproduce the recovery seed doesn't need to possess the COLDCAR, Nerds.xyz points out. More from The Street: [The recovery seed] is supposed to come from a hardware random number generator producing 128 bits of entropy, a number so large that guessing it is computationally impossible. It wasn't. According to Block's engineering team a single code change on March 1, 2021 caused the firmware to silently fall back to a software-based generator instead of the hardware one. On Mk3 devices the effective search space collapsed to roughly 40 bits. Coinkite has confirmed that figure and called it preliminary. The gap between 128 bits and 40 bits is not a matter of degree. It is the difference between a lock that cannot be picked and one that can be brute-forced by anyone with rented cloud computing.... Chainalysis found the attacker went after the largest balances first, pulling more than $30 million in the opening ten minutes. Within about 25 minutes, roughly 594 BTC had moved out of some 500 single-signature wallets. One victim lost around $1.8 million... Coinkite has shipped fixed firmware, but with a warning that matters more than the patch itself. Updating does not repair an existing seed. A seed created with weak entropy stays weak forever. Affected users have to generate an entirely new wallet on updated hardware and move their coins to it. By Saturday morning Galaxy research was tracking 1,158.66 BTC, worth roughly $75.1 million, taken from 2,673 addresses, according to the article. And "The Coldcard exploit is ONGOING," Galaxy Research posted an hour ago on X.com. "Move Coldcard single-sig funds to safe locations immediately!" We have reported ~600 addresses we believe to be hackers holding funds stolen from Coldcard-generated weak entropy addresses to federal investigators, industry compliance firms, and cross-industry cyber investigators. Thanks to Slashdot reader BrianFagioli for sharing the news.

Read more of this story at Slashdot.

Apple is facing a new lawsuit accusing the company of allowing a fraudulent Bitcoin wallet app to remain on its App Store for more than a week after users reported significant losses.

According to the complaint, three individuals collectively lost approximately $1.84 million after downloading an app that impersonated the legitimate Sparrow Wallet. The victims entered their Bitcoin seed phrases into the fake application, enabling scammers to drain their funds. One plaintiff reported losing $875,000, while another lost $840,000; the delay in removing the app after the first report allegedly contributed to further losses.

The lawsuit claims Apple’s marketing and App Store presentation led users to believe applications available on the platform undergo careful vetting and are safe. Plaintiffs allege the company ranked the fraudulent app and even included it in curated cryptocurrency app collections alongside genuine Bitcoin wallets. The legal action accuses Apple of violating consumer-protection laws, engaging in fraudulent and negligent misrepresentation, and failing to adequately warn consumers about risks.

This is not the first time Apple has faced similar claims. In 2021, cryptocurrency holders sued the company over a fake wallet app scam; that case was ultimately dismissed by a federal judge.

Apple has stated that it has removed apps impersonating Sparrow Wallet from the App Store and terminated the associated developer accounts.

MacDailyNews Note: The plaintiffs are seeking reimbursement of the stolen assets along with compensatory and punitive damages.

---

‎
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Apple faces lawsuit over fake Bitcoin wallet left on App Store after massive losses appeared first on MacDailyNews.