hashpwn

Terms of Service & Privacy Policy Effective Date: Aug 31, 2025 Welcome to hashpwn.net (“we,” “our,” or “us”). By accessing or using hashpwn.net or any of its subdomains (collectively, the “Services”), you agree to comply with and be bound by these Terms of Service. This includes, but is not limited to, the forum and any Services we may provide under the hashpwn.net domain. If you do not agree, please discontinue use of the Services. 1. Eligibility You must be at least 18 years old to register for or use any hashpwn.net Services. By using our Services, you represent that you meet this requirement. 2. User Conduct When using any hashpwn.net Service, you agree not to: Post, share, or request personally identifiable information (PII). Share, request, or distribute illegally obtained data (e.g., combo lists, stolen data, etc). Engage in hate speech, harassment, or unlawful activities. Attempt to compromise, disrupt, or misuse any Service we provide. Post, share, request, or link to any sexually explicit, pornographic, or sexually suggestive content. Our Services are intended for ethical cybersecurity research, discussion, and learning. Illegal activity is strictly prohibited. 3. User Content You retain ownership of any content you post, upload, or submit to hashpwn.net Services. By submitting content, you grant hashpwn.net a non-exclusive, worldwide license to store, display, and distribute your content as necessary to operate and provide the Services. Requests for deletion of publicly posted content will be honored, except in rare cases where retention is required for legal, security, moderation, or administrative reasons (e.g., evidence of abuse). Account deletion and personal data removal requests will always be honored. 4. Privacy & Data Collection We respect your privacy. We collect basic technical information such as IP address, cookies, browser type, and usage analytics. We use this information only for site functionality, security, and moderation. We may log usage data to maintain service quality. We do not sell, rent, or share your information with third parties for advertising or marketing purposes. Users may request removal of their personal data. 5. Disclaimer of Warranties All Services provided by hashpwn.net are offered “as is” and without warranties of any kind, whether express or implied. We do not guarantee uptime, availability, or error-free operation for any Service. Use of hashpwn.net Services is at your own risk. 6. Limitation of Liability To the fullest extent permitted by law, hashpwn.net, its owners, administrators, moderators, and affiliates are not liable for any damages arising from use of our Services, including but not limited to loss of data, downtime, security issues, or service interruptions. 7. Termination We reserve the right to suspend, restrict, or terminate accounts or access to any hashpwn.net Service at our discretion for violations of these Terms or other reasons deemed necessary to protect the community and infrastructure. 8. Changes to the Terms We may update these Terms at any time. Changes will be posted on this page with a new effective date. Continued use of our Services after updates are posted constitutes acceptance of the revised Terms. 9. Contact For questions, concerns, or requests, please contact: @cyclone (Admin/Owner)

@tuman has been temp banned (7 days) for hijacking other user's threads 3x times after being warned to stop. Read the rules, or get banned. https://forum.hashpwn.net/post/31

COLDCARD RNG Flaw Linked to $88.6M Bitcoin Theft A firmware bug in COLDCARD hardware wallets allowed attackers to recover wallet seeds and steal an estimated 1,367 BTC, worth about $88.6 million, from 4,585 Bitcoin addresses. [image: 1785771133334-81cb70b0-b828-4d30-8b10-81698e0e963c-image.jpeg] Affected COLDCARD firmware was supposed to use the STM32 hardware RNG (Random Number Generator) when creating wallet seeds. Instead, an integration error caused it to fall back to MicroPython’s deterministic Yasmarang pseudorandom number generator. The fallback was seeded using values such as: Device identifiers System timing data Real-time clock values Previous RNG state These values are not secure sources of cryptographic randomness. An attacker could generate possible wallet seeds offline, derive the related Bitcoin addresses, and compare them against funded addresses on the public blockchain. Once a match was found, the attacker could derive the private keys and move the funds. The transaction pattern supports the theory of an automated attack. Many wallets were swept using the same unusually high fee rate, with no change outputs. The flaw affected several COLDCARD models and firmware versions, including older Mk2 and Mk3 devices and some Mk4, Mk5, and Q firmware releases. Fixed firmware is now available, but updating alone does not protect a seed that was generated by vulnerable firmware. Affected users should: Install the fixed firmware Generate a new seed Verify the new wallet address Move funds to the new wallet Sources: Block Bitcoin Engineering: Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware Coinkite: COLDCARD Security Advisory https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ BleepingComputer: COLDCARD Wallet RNG Flaw Likely Linked to $88 Million Bitcoin Theft https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/ Galaxy Research: Initial On-Chain Analysis of the Wallet Sweeps https://x.com/glxyresearch/status/2083181683067506899

v0.5.3; 2026-07-25 https://github.com/cyclone-github/pcfg-go/releases/tag/v0.5.3 pcfg_guesser ~2× faster than v0.5.2 ~2,578% faster than Python3 pcfg_guesser.py Reduce long-run RAM growth in pcfg_guesser (priority-queue frontier) Compact parse-tree representation (interned type IDs, packed nodes, arena reuse) Contiguous index-based heap (fewer per-item allocations) Reuse OMEN optimizer cache per worker Prefer []byte guess building to cut string churn Same generation logic; parallel stdout interleaving may differ across runs Rename trainer to pcfg_trainer

Escrow ID# 90767 • Algorithm: sha512crypt $6$, SHA512 (Unix), -m 1800 • Total hashes: 3 • Price per hash: $1.0005 • Escrow URL: https://hashes.com/en/escrow/item/?id=90767 • Download hashes: 90767_1800.zip

Scheduled Host Maintenance Our host will be performing scheduled maintenance that requires a reboot of the VPS hosting hashpwn. During this maintenance, the forum and related hashpwn services will go offline temporarily. Expected downtime is less than 30 minutes, although we have not been given an exact ETA for when the reboot will occur. This notice is just to give everyone a heads up.