hashpwn

Terms of Service & Privacy Policy Effective Date: Aug 31, 2025 Welcome to hashpwn.net (“we,” “our,” or “us”). By accessing or using hashpwn.net or any of its subdomains (collectively, the “Services”), you agree to comply with and be bound by these Terms of Service. This includes, but is not limited to, the forum and any Services we may provide under the hashpwn.net domain. If you do not agree, please discontinue use of the Services. 1. Eligibility You must be at least 18 years old to register for or use any hashpwn.net Services. By using our Services, you represent that you meet this requirement. 2. User Conduct When using any hashpwn.net Service, you agree not to: Post, share, or request personally identifiable information (PII). Share, request, or distribute illegally obtained data (e.g., combo lists, stolen data, etc). Engage in hate speech, harassment, or unlawful activities. Attempt to compromise, disrupt, or misuse any Service we provide. Post, share, request, or link to any sexually explicit, pornographic, or sexually suggestive content. Our Services are intended for ethical cybersecurity research, discussion, and learning. Illegal activity is strictly prohibited. 3. User Content You retain ownership of any content you post, upload, or submit to hashpwn.net Services. By submitting content, you grant hashpwn.net a non-exclusive, worldwide license to store, display, and distribute your content as necessary to operate and provide the Services. Requests for deletion of publicly posted content will be honored, except in rare cases where retention is required for legal, security, moderation, or administrative reasons (e.g., evidence of abuse). Account deletion and personal data removal requests will always be honored. 4. Privacy & Data Collection We respect your privacy. We collect basic technical information such as IP address, cookies, browser type, and usage analytics. We use this information only for site functionality, security, and moderation. We may log usage data to maintain service quality. We do not sell, rent, or share your information with third parties for advertising or marketing purposes. Users may request removal of their personal data. 5. Disclaimer of Warranties All Services provided by hashpwn.net are offered “as is” and without warranties of any kind, whether express or implied. We do not guarantee uptime, availability, or error-free operation for any Service. Use of hashpwn.net Services is at your own risk. 6. Limitation of Liability To the fullest extent permitted by law, hashpwn.net, its owners, administrators, moderators, and affiliates are not liable for any damages arising from use of our Services, including but not limited to loss of data, downtime, security issues, or service interruptions. 7. Termination We reserve the right to suspend, restrict, or terminate accounts or access to any hashpwn.net Service at our discretion for violations of these Terms or other reasons deemed necessary to protect the community and infrastructure. 8. Changes to the Terms We may update these Terms at any time. Changes will be posted on this page with a new effective date. Continued use of our Services after updates are posted constitutes acceptance of the revised Terms. 9. Contact For questions, concerns, or requests, please contact: @cyclone (Admin/Owner)

found_11660.txt left_375722.txt

COLDCARD RNG Flaw Linked to $88.6M Bitcoin Theft A firmware bug in COLDCARD hardware wallets allowed attackers to recover wallet seeds and steal an estimated 1,367 BTC, worth about $88.6 million, from 4,585 Bitcoin addresses. [image: 1785771133334-81cb70b0-b828-4d30-8b10-81698e0e963c-image.jpeg] Affected COLDCARD firmware was supposed to use the STM32 hardware RNG (Random Number Generator) when creating wallet seeds. Instead, an integration error caused it to fall back to MicroPython’s deterministic Yasmarang pseudorandom number generator. The fallback was seeded using values such as: Device identifiers System timing data Real-time clock values Previous RNG state These values are not secure sources of cryptographic randomness. An attacker could generate possible wallet seeds offline, derive the related Bitcoin addresses, and compare them against funded addresses on the public blockchain. Once a match was found, the attacker could derive the private keys and move the funds. The transaction pattern supports the theory of an automated attack. Many wallets were swept using the same unusually high fee rate, with no change outputs. The flaw affected several COLDCARD models and firmware versions, including older Mk2 and Mk3 devices and some Mk4, Mk5, and Q firmware releases. Fixed firmware is now available, but updating alone does not protect a seed that was generated by vulnerable firmware. Affected users should: Install the fixed firmware Generate a new seed Verify the new wallet address Move funds to the new wallet Sources: Block Bitcoin Engineering: Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware Coinkite: COLDCARD Security Advisory https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ BleepingComputer: COLDCARD Wallet RNG Flaw Likely Linked to $88 Million Bitcoin Theft https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/ Galaxy Research: Initial On-Chain Analysis of the Wallet Sweeps https://x.com/glxyresearch/status/2083181683067506899

Based on the latest information from the official website and the v1.531 release notes, here is an updated summary of mdxfind as a digital multi-tool, now with GPU acceleration. MDXfind v1.531: The Swiss Army Knife, Now with a Power Drill Forget single-purpose tools. MDXfind is the cryptographic equivalent of a Swiss Army knife—a hybrid CPU/GPU brute-force hash searcher that tests a single plaintext candidate against 994+ hash algorithms simultaneously. Version 1.531 (August 2026) transforms it from a hand tool into a power tool. 1. The Blade You Need for Unknown Hashes Most crackers require you to know the hash type upfront. MDXfind doesn't care. "ALL" Mode: A single command can identify and crack hashes from a pile of mixed, unidentified dumps, running them against its entire library of algorithms. Filtering Power: You can pare the search space using boolean operators like -h 'ALL' -h '!salt,!user' to exclude salted or username-based hashes and focus on what matters. 2. The New Power Drill: Full GPU Acceleration This is the headline feature of v1.531. The tool now leverages OpenCL to offload intensive cracking work to your graphics card. Massive Parallelism: GPU acceleration dramatically increases candidate testing rates for compute-bound algorithms. Smarter Work Distribution: The dispatch logic was overhauled. Previously, expensive types like SCRYPT ran on a single core. Now, the gate uses rate / Livesalts instead of raw hashes/sec. Measured improvement: SCRYPT on 1,800 salts went from 1× to 4.3× parallel throughput. Compute-bound types gain even more. Platform Support: Runs on x86_64, i686, ARM6/7/8, AArch64, ppc64le, FreeBSD, Windows, and macOS with SSE2/SSSE3/NEON runtime dispatch. 3. "Chained" Attacks (The Nested Blade) It excels at tackling complex, nested hashing constructions that stymie other tools. Iterations: Need to test md5(md5($pass)) or up to 4 billion iterations? Just tweak the -i parameter. Exotics: Supports rare chained formats like MD5DECBASE64MD5BASE64MD5 and the newly added SHA1CRYPT ($sha1$, hashcat 15100) and GOST-YESCRYPT ($gy$). 4. The Crowbar: Cracking the Uncrackable (New Types in v1.531) Four new, difficult hash types were added: -m e999 [SHA1CRYPT] — NetBSD/Juniper sha1crypt, $sha1$ (ha#1a5fb4shcat 15100). Iterated HMAC-SHA1 with the password as the persistent key. Input is liberal and output is conformant: the 28-character digest field encodes 21 bytes where SHA-1 produces only 20, and NetBSD pads the final group with digest[0] wrapped around. hashcat's published -m 15100 example hash uses 0 for that byte and is therefore nonconformant; mdxfind accepts that spelling and reports the correct NetBSD/corpus one. The wrap convention was confirmed against 8,262 real hashes, 8,262 of 8,262. -m e998 GOST-YESCRYPT — $gy$. HMAC-Streebog256(HMAC-Streebog256(Streebog256(K), M), yescrypt(K, S)), where the inner HMAC message is the setting without its trailing $. Validated 25 of 25 against libxcrypt 4.4.27 across distinct real salts, plus salt lengths 4/8/12/16 and empty, and against an independently written third-party implementation. -m e1001 CMIYC — $cmiyc$, a contest-local type recovered from a stripped AIX PowerPC binary. Memory-hard: 64 MiB working set and 9,437,184 SHA-512 operations per candidate per salt. Validated against real hashes with known plaintexts. -m e884 SCRYPT now also accepts the $7$ crypt spelling in addition to SCRYPT:N:r:p:b64salt:b64hash. The $7$ form packs N/r/p as crypt64 characters and uses the salt as raw ASCII rather than base64, so it is normalised at load into the canonical form; both spellings are emitted on a crack. -m e1000 7ZIP — 7-Zip AES, $7z$ (hashcat 11600). Verifies by checking the AES zero-padding on the final ciphertext block rather than decrypting and decompressing, so Deflate64 archives crack — hashcat and john both report "exhausted" on those even when the password is in the wordlist, because neither implements a Deflate64 decompressor in its verify path. Stock 7z2john output exceeds mdxfind's line limit — the entire encrypted stream sits in the final field, roughly 113 KB even for a small archive — so tools/7z2mdx.py truncates that field to the two ciphertext blocks stage 1 actually needs. 5. The Bottle Opener: Modular Companion Tools It doesn't work alone. The distribution includes: mdsplit – Automatically sorts cracked hashes into per-hashtype files, drastically reducing target list size for other tools. getpass – Password extractor. hashpipe – A new companion introduced in v1.531 (exact function detailed in the release notes). 6. The Ergonomic Grip: Real-Time Status & Stability When dealing with massive wordlists, you need to know if it's working. Comfort Messages: Outputs status updates every 15 seconds showing candidates/second and "busyness" (w=), so you can tune the attack. Pausing: Ctrl-Z suspends the process, and fg resumes it without losing progress. Critical Stability Fixes: Heap Corruption Fixed: A bug that caused free(): invalid pointer crashes during hash loading was resolved. The code now passes AddressSanitizer on a 55,404-hash corpus. User-Defined Types: Now have a separate address space from built-in types, preventing accidental aliasing. Windows Fixes: Hostnames now report correctly (via GetComputerNameA), and debug dumps no longer target the non-existent /tmp directory. In Short MDXfind v1.531 is no longer just a Swiss Army knife—it's a Swiss Army knife with a built-in power drill.** If your hash list is a black box, this is the one tool you need to pry it open, now at GPU speed. Release notes: https://github.com/Cynosureprime/mdxfind/releases/tag/v1.531 Github: https://github.com/Cynosureprime/mdxfind and https://www.mdxfind.com/

Escrow ID# 91081 • Algorithm: Blockchain, My Wallet, V2, -m 15200 • Total hashes: 152 • Price per hash: $210.7681 • Escrow URL: https://hashes.com/en/escrow/item/?id=91081 • Download hashes: 91081_15200.zip

Scheduled Host Maintenance Our host will be performing scheduled maintenance that requires a reboot of the VPS hosting hashpwn. During this maintenance, the forum and related hashpwn services will go offline temporarily. Expected downtime is less than 30 minutes, although we have not been given an exact ETA for when the reboot will occur. This notice is just to give everyone a heads up.