k3tan

Public heads-up for GPU cloud / rental providers and Trust & Safety teams: There is a publicly disclosed hardware-wallet entropy issue that may lead to abuse of consumer GPU rentals — especially multi-GPU NVIDIA RTX 3090 / 4090 and similar CUDA cards — for offline BIP-39 seed recovery. References: • Coinkite advisory: blog.coinkite.com/coldcard-m… • Technical background: blog.coinkite.com/entropy-te… • Live theft tracker: coldcard-watch.vercel.app/ What this looks like technically: • Offline search of a reduced BIP-39 seed space via bulk PBKDF2-HMAC-SHA512 (2048 iterations) • Mk3: does not need GPUs — that space is small enough to brute-force cheaply, and Mk3 seeds are already linked to on-chain thefts • Mk4 and later: does need large amounts of compute. Those seeds are stronger but still weaker than full design entropy for some pre-fix units. Rough ballpark: recovering one seed ≈ ~10× RTX 4090s for about a day • On rental platforms this tends to look like long-running custom CUDA/hashing binaries or containers on multi-GPU 30/40-series instances — not normal training/inference API usage Why this matters now: the low-hanging fruit (Mk3 and the weakest seeds that need little or no GPU) appears largely drained already — the tracker above shows the ongoing thefts. The next wave is Mk4-and-later seeds, which are compute-bound. Large blocks of rented consumer GPUs are the bottleneck for attackers. This is not a vulnerability report against any platform. It's context so abuse / trust teams can: 1. Route future reports on this topic correctly 2. Optionally watch for suspicious multi-GPU, long-running custom CUDA jobs 3. Have background if law enforcement or researchers get in touch cc: @vast_ai @runpod @clore_ai @TensorDock @SaladTech @akashnet @MassedCompute @Hyperstackcloud @fluidstack Happy to help any team dig in.