News linked to both this project and an event.
Hardware wallet manufacturer Trezor has announced that, in light of recent supply chain security incidents, the company has decided to reduce the number of its resellers in order to conduct more effective vetting of its partners.Trezor emphasized that there is currently no evidence suggesting its devices have been compromised, and that this adjustment is a precautionary measure taken out of an abundance of caution.
According to official statements, hardware wallet manufacturer Ledger has released a 72-hour update regarding the security incident involving Southeast Asian distributor CryptoBilis. Ledger stated that it is currently cooperating with relevant law enforcement agencies, noting that the number of affected devices is limited and that its internal systems and official direct sales channels remain unaffected. To date, all confirmed cases linked to the disclosed fund theft incidents involve devices sold through distributor CryptoBilis; CryptoBilis has confirmed that it has ceased sales of all hardware wallets.
Ethereum co-founder Vitalik Buterin warned in a post that AI-accelerated mathematical research could pose a severe threat to existing cryptographic systems within the next two years, particularly lattice-based cryptography (Lattices), ML-DSA, and FHE schemes, with ECDSA also facing a heightened risk of being compromised sooner than anticipated. Vitalik noted that AI could replicate breakthroughs akin to the transition from naive factorization to the Number Field Sieve, substantially undermining the security of lattice-based cryptography. In such a scenario, hash-based schemes would comprehensively outperform lattice-based ones in efficiency. The Ethereum Lean Roadmap is already progressing toward a "pure-hash" approach, employing signature schemes like WOTS or SPHINCS+ without incorporating any lattice-based components. From a personal standpoint, Vitalik offers the following recommendations: • Prioritize hash-based schemes, replacing lattice cryptography in feasible scenarios • Conservatively estimate lattice parameter sizes, with a recommendation to increase key sizes by a factor of 10 • Ensure privacy protocols avoid posting encrypted data on-chain, opting instead for off-chain transmission through third parties • Utilize offline confirmation for multi-signature wallets to prevent signatures from being publicly exposed • It is acceptable to retain funds in "fresh addresses" that have never initiated a transaction; however, address migration must be handled with extreme care, as losses resulting from operational errors may far exceed those caused by hacker breaches.
: Bitcoin News posted on X platform, stating that Bitcoin Core developer instagibbs claimed to have successfully reproduced the reported COLDCARD vulnerability on a newly initialized COLDCARD MK3 device, using only the number of button presses during the setup process, and said, "Sorry, now is the time to panic." He believes the issue affects MK2/MK3 devices, but stated that it is currently unable to confirm whether the MK4 has the vulnerability. Developer Antoine Poinsot stated that the key difference is that the MK4 uses a hardware random number generator to provide entropy for the seed and actually utilizes the microcontroller's True Random Number Generator (TRNG), while the MK3 does not. The proof of concept and mnemonic phrase verification are still under review.