Andrew Curran @AndrewCurran_
— saved image
Andrew Curran @AndrewCurran_ · 7h Update from r/Bitcoin. Claude Code can independently find the same wallet vulnerability used in this attack in eight minutes. [embedded Reddit screenshot] r/Bitcoin · 10h ago Impressive-Gene-421 Are you kidding me? Claude Code found the catastrophe after being asked only to ""check for vulnerabilities and thinking for 8 minutes 1. ngu.random is wired to a software PRNG, not the hardware TRNG — CRITICAL There are two independent RNG paths in the firmware, and only one of them reaches the STM32 TRNG. Path A (correct). ckcc.rng_bytes() → stm32/COLDCARD_MK4/rng.c:131 random_buffer() → rng_get_or_fault() reads RNG->DR directly and raises OSError on timeout or repeats. This is what backups.py:337 uses for the backup-file password. Path B (broken). ngu.random.* → external/libngu/ngu/random.c:73 CHIP_TRNG_32(), defined at line 24-26 as extern uint32_t rng_get(void). It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code. Also on GLM 5.2 (trained 16th June, no internet access). [quoted tweet] Andrew Curran @AndrewCurran_ · Aug 1 By the end of the year the tools available to anyone attempting this kind of attack will be vastly more capable across all devices. If there is a seam in any existing hardware, they will get their fingers in there. Attacks like this are about... [cut off]
Note from Claude Sonnet 5
X post by Andrew Curran about a Reddit r/Bitcoin post claiming Claude Code independently found, in eight minutes, the firmware RNG vulnerability (Coldcard hardware wallet, software PRNG vs hardware TRNG path confusion) reportedly used in a large ($100m+) cryptocurrency theft. Includes technical code-path details from the Reddit post and Curran's follow-up warning about future attack tooling capability.
twittercryptocurrencyhardware walletvulnerabilityclaude codecoldcardcybersecurity