🚨
They broke the 4 wallets with passphrase.
The hacker from the Coldcard attack, after a week, broke the wallets with passphrase.
Let’s remember that the example used the BIP-39 dictionary words, meaning they are 2048 easy and well-known words in English.
Finding a single word requires only 2048 attempts.
By brute force, finding that key takes just a few seconds:
- 1 word is trivial: seconds or less.
Combinations: 2.048
- 2 words is easy: minutes with decent hardware.
Combinations: 4.2 million
- 3 words is moderate: hours with modern GPUs.
Combinations: 8.59 billion
While those times are fast, it’s because the attacker already had the seed phrase and knew that wallet (which was made public) had as its passphrase BIP-39 dictionary words.
As a recommendation, the passphrase gives you time to take action, and that time depends on how strong that key is.
- Never use 1, 2, or 3 words from the BIP-39 list as a passphrase (they’re easy).
- Never use only numbers; they’re easy.
- Spanish words are stronger than English ones.
- Use mixed characters (uppercase, lowercase, numbers, and symbols).
They broke the 4 wallets with passphrase.
The hacker from the Coldcard attack, after a week, broke the wallets with passphrase.
Let’s remember that the example used the BIP-39 dictionary words, meaning they are 2048 easy and well-known words in English.
Finding a single word requires only 2048 attempts.
By brute force, finding that key takes just a few seconds:
- 1 word is trivial: seconds or less.
Combinations: 2.048
- 2 words is easy: minutes with decent hardware.
Combinations: 4.2 million
- 3 words is moderate: hours with modern GPUs.
Combinations: 8.59 billion
While those times are fast, it’s because the attacker already had the seed phrase and knew that wallet (which was made public) had as its passphrase BIP-39 dictionary words.
As a recommendation, the passphrase gives you time to take action, and that time depends on how strong that key is.
- Never use 1, 2, or 3 words from the BIP-39 list as a passphrase (they’re easy).
- Never use only numbers; they’re easy.
- Spanish words are stronger than English ones.
- Use mixed characters (uppercase, lowercase, numbers, and symbols).